On 09/26/2009 05:56 AM, tarnait wrote:
> Hi,
>
> yeah the console problem was that I use static udev, and the underlying /dev/console didn't have the proper label. Now I'm down to two problems:
>
> #============= iptables_t ==============
> allow iptables_t pppd_t:packet_socket { read write };
Most likely a leaked file descriptor, if you dontaudit this everything should work fine.
>
> #============= pppd_t ==============
> allow pppd_t unconfined_home_dir_t:dir search;
Probably can also be dontaudit. pppd_t is just searching the homedir of the process that launched it.
>
>
> as I use iptables to redirect traffic from wlan0 to ppp0 I assue it's safe to add them.
>
> Thanks for your help, Kindest Regards
>
>
>
>
> ________________________________
> Von: Paul Howarth <paul@xxxxxxxxxxxx>
> An: Dominick Grift <domg472@xxxxxxxxx>
> CC: fedora-selinux-list@xxxxxxxxxx
> Gesendet: Samstag, den 26. September 2009, 02:10:58 Uhr
> Betreff: Re: Dear List members
>
> On Fri, 25 Sep 2009 18:38:20 +0200
> Dominick Grift <domg472@xxxxxxxxx> wrote:
>
>> On Fri, Sep 25, 2009 at 03:35:52PM +0000, tarnait wrote:
>>> type=AVC msg=audit(1253870574.325:17): avc: denied { search }
>>> for pid=921 comm="pppd" name="root" dev=sda1 ino=12
>>> scontext=system_u:system_r:pppd_t:s0
>>> tcontext=unconfined_u:object_r:unconfined_home_dir_t:s0 tclass=dir
>>> Was caused by: Missing type enforcement (TE) allow rule.
>>>
>>> You can use audit2allow to generate a loadable
>>> module to allow this access.
>>>
>>
>> This also *may* be a labelling issue. pppd wants to search /root
>> dir. /root dir has type unconfined_home_dir_t. see if this is
>> correct: matchpathcon /root restorecon -R /root
>>
>> /root usually has type admin_home_t and i do not see any good reason
>> why pppd should be able to search it. misconfiguration/misusage maybe?
>
> pppd looks for ~/.ppprc, so if you're using it as root (e.g. to connect
> to your ISP) you're going to see this. Haven't found any way of turning
> it off either.
>
> Paul.
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list@xxxxxxxxxx
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>
>
>
>
>
>
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list@xxxxxxxxxx
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
