-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Tom London wrote:
> Running rawhide, targeted.
>
> Had problems after today's rawhide update.
>
> Booting in permissive mode produced:
>
>
> module localxdm 1.0;
>
> require {
> type unconfined_t;
> type security_t;
> type xdm_var_lib_t;
> type syslogd_t;
> type unconfined_execmem_t;
> type xdm_xserver_t;
> type system_map_t;
> type mono_t;
> type xdm_t;
> type mount_t;
> class unix_stream_socket { read write };
> class x_property read;
> class security { check_context compute_create compute_av };
> class file { read write getattr };
> class dir { write read mounton };
> }
>
> #============= mono_t ==============
> allow mono_t unconfined_t:x_property read;
>
> #============= mount_t ==============
> allow mount_t xdm_t:unix_stream_socket { read write };
> allow mount_t xdm_var_lib_t:dir { write read mounton };
>
> #============= syslogd_t ==============
> allow syslogd_t system_map_t:file { read getattr };
>
> #============= unconfined_execmem_t ==============
> allow unconfined_execmem_t unconfined_t:x_property read;
> allow unconfined_execmem_t xdm_t:x_property read;
>
> #============= xdm_t ==============
> allow xdm_t xdm_var_lib_t:dir mounton;
>
> #============= xdm_xserver_t ==============
> allow xdm_xserver_t security_t:dir read;
> allow xdm_xserver_t security_t:file { write read };
> allow xdm_xserver_t security_t:security { check_context compute_create
> compute_av };
>
> I'll attach the raw audit file below.
>
> In addition, there were two avcs produced in /var/log/messages before
> the start of audit:
>
> Mar 8 09:49:52 localhost kernel: type=1400 audit(1204998591.798:3):
> avc: denied { read } for pid=2257 comm="rsyslogd"
> name="System.map-2.6.25-0.95.rc4.local2.fc9" dev=sda3 ino=6064
> scontext=system_u:system_r:syslogd_t:s0
> tcontext=system_u:object_r:system_map_t:s0 tclass=file
> Mar 8 09:49:52 localhost kernel: type=1400 audit(1204998591.798:4):
> avc: denied { getattr } for pid=2257 comm="rsyslogd"
> path="/boot/System.map-2.6.25-0.95.rc4.local2.fc9" dev=sda3 ino=6064
> scontext=system_u:system_r:syslogd_t:s0
> tcontext=system_u:object_r:system_map_t:s0 tclass=file
>
> Not sure all of these need to be "allow", but "semodule -i
> localxdm.pp" makes the system boot and run in enforcing mode.
>
> tom
>
>
>
> ------------------------------------------------------------------------
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list@xxxxxxxxxx
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Tom are you saying the machine would not boot in enforcing mode without
these changes?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkfVOYsACgkQrlYvE4MpobP0eQCfVP90HanVNvfhas765qu+r8L8
DzMAoOqM3MPP3FaV2jSfogLp+MI9xiMQ
=1Zde
-----END PGP SIGNATURE-----
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
