On Jan 26, 2008 12:20 PM, Tom London <selinux@xxxxxxxxx> wrote:
> Appears a bit more complicated.....
>
> Even after adding all the above, sound is still disabled.
>
> Here is the AVC:
> type=AVC msg=audit(1201376293.488:17): avc: denied { ptrace } for
> pid=2471 comm="console-kit-dae"
> scontext=system_u:system_r:system_dbusd_t:s0
> tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process
> type=SYSCALL msg=audit(1201376293.488:17): arch=40000003 syscall=3
> success=no exit=-3 a0=e a1=bfa13948 a2=1000 a3=0 items=0 ppid=1
> pid=2471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=(none) comm="console-kit-dae"
> exe="/usr/sbin/console-kit-daemon"
> subj=system_u:system_r:system_dbusd_t:s0 key=(null)
>
> I tried removing the above rule, setting "allow_ptrace=1" and
> reinserting the allow rule, but no joy. Still get this AVC and no
> sound.
>
> Also, the new "shutdown" menu item generates lots of AVCs:
>
>
> #============= system_dbusd_t ==============
> allow system_dbusd_t init_exec_t:file { read execute execute_no_trans };
> allow system_dbusd_t initctl_t:fifo_file write;
> allow system_dbusd_t initrc_var_run_t:file { read write lock };
> allow system_dbusd_t lib_t:file execute_no_trans;
> allow system_dbusd_t polkit_auth_exec_t:file { read execute execute_no_trans };
> allow system_dbusd_t polkit_var_lib_t:dir search;
> allow system_dbusd_t polkit_var_lib_t:file { read getattr };
> allow system_dbusd_t polkit_var_run_t:dir search;
> allow system_dbusd_t shell_exec_t:file { read execute };
> allow system_dbusd_t tty_device_t:chr_file { write getattr };
>
> After adding these, still doesn't work.
>
> Will try "semodule -DB"......
>
Wow.... lots of stuff generated by -DB. I attach /var/log/audit/audit.log.
Not sure its relevant, but the only extra console-kit AVC is:
type=AVC msg=audit(1201380675.325:136): avc: denied { sys_tty_config
} for pid=2728 comm="console-kit-dae" capability=26
scontext=system_u:system_r:system_dbusd_t:s0
tcontext=system_u:system_r:system_dbusd_t:s0 tclass=capability
Something else?
tom
--
Tom London
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
