On Thu, 3 Jul 2008 14:56:11 -0400 Daniel wrote:
DJW> Robert Story wrote:
DJW> >
DJW> > I'm trying to set up a kerberos KDC on a clean up-to-date F9 box in
DJW> > enforcing mode. [...] Also, I get an error when starting krb5kdc:
DJW> >
DJW> > Starting Kerberos 5 KDC: Couldn't open log file /var/log/krb5kdc.log: Permission denied
DJW> >
DJW> > The accompanying avc is:
DJW> >
DJW> > Jul 1 18:04:55 tib kernel: type=1400 audit(1214949895.536:4): avc: denied { create } for pid=1839 comm="krb5kdc" name="krb5kdc.log" scontext=unconfined_u:system_r:krb5kdc_t:s0 tcontext=system_u:object_r:krb5kdc_log_t:s0 tclass=file
DJW> >
DJW> Seems you stumbled upon a strange avc.
DJW>
DJW> If you type
DJW>
DJW> # touch /var/log/krb5kdc.log
DJW> # restorecon /var/log/krb5kdc.log
DJW>
DJW> Then start the service, does it work?
yep.
DJW> This is a long way of saying I need to update the policy to allow
DJW> krbkdc_t to create the file.
DJW>
DJW> Fixed in selinux-policy-3.3.1-76.fc9.noarch
Ok.. while waiting for that, I used audit2allow to load the following
policy:
module mypolicy0807091636 1.0;
require {
type krb5kdc_t;
type krb5kdc_log_t;
class file { create };
}
#============= krb5kdc_t ==============
allow krb5kdc_t krb5kdc_log_t:file create;
But I'm still getting the avc.. What else is missing?
--
Robert Story
SPARTA
Attachment:
signature.asc
Description: PGP signature
-- fedora-selinux-list mailing list fedora-selinux-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-selinux-list
