Am Sonntag, den 06.04.2008, 20:11 -0300 schrieb Pedro Lamarão:
> Hello all.
>
> I'm experimenting with a VPN connection set up through the
> NetworkManager panel applet.
>
> I have all certificate and key files stored in my home directory.
>
> Trying to start this VPN connection triggers an AVC DENIED.
>
> host=localhost.localdomain type=AVC msg=audit(1207523029.36:66): avc:
> denied { read } for pid=6400 comm="openvpn" name="pedro.crt" dev=dm-2
> ino=2408465 scontext=system_u:system_r:openvpn_t:s0
> tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
>
> host=localhost.localdomain type=SYSCALL msg=audit(1207523029.36:66):
> arch=40000003 syscall=5 success=no exit=-13 a0=bfa7ef0b a1=8000 a2=1b6
> a3=8d23660 items=0 ppid=6396 pid=6400 auid=500 uid=0 gid=0 euid=0 suid=0
> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="openvpn"
> exe="/usr/sbin/openvpn" subj=system_u:system_r:openvpn_t:s0 key=(null)
>
> It seems to me that this denial makes complete sense, since OpenVPN
> should not be reading users' files.
>
> On the other hand, this NetworkManager configuration functionality
> should allow users to use their own files -- that is, it seems users are
> not required to be root and place files in /etc/openvpn.
>
> Also, most users won't be knowledgeable enough to know how to change
> file label -- and this would be error prone, if there was ever a full
> relabel in the filesystem.
>
> I'll be using all files in /etc/openvpn while this is not sorted out to
> exercise NetworkManager.
>
> --
> P.
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list@xxxxxxxxxx
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Hi,
there is a special SELinux Boolean for that: openvpn_enable_homedirs
You can set this via setsebool or use the SELinux Manager.
regards
Christoph
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
