In rawhide (upstart) mls, I'm seeing avcs like
allow initrc_t init_t:unix_dgram_socket sendto;
allow init_t staff_t:unix_dgram_socket sendto;
allow init_t user_t:unix_dgram_socket sendto;
Reading the init.if file there is an empty, depreciated udp interface
for init.
Adding the following to the init_telinit interface fixes the avc, but
it looks like the new interface may be the old udp ...
--- serefpolicy-3.3.1/policy/modules/system/init.if.orig 2008-03-08
14:57:10.000000000 -0600
+++ serefpolicy-3.3.1/policy/modules/system/init.if 2008-03-08
14:58:08.000000000 -0600
@@ -470,10 +470,12 @@ interface(`init_write_initctl',`
interface(`init_telinit',`
gen_require(`
type initctl_t;
+ type init_t;
')
dev_list_all_dev_nodes($1)
allow $1 initctl_t:fifo_file rw_fifo_file_perms;
+ allow $1 init_t:unix_dgram_socket sendto;
init_exec($1)
')
joe
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
