On 12/29/2009 01:52 PM, Klaus Lichtenwalder wrote: > Dominick, > > Am Dienstag, den 29.12.2009, 13:02 +0100 schrieb Dominick Grift: > >> Whoops i forgot some policy: > > Ok, I was already wondering whether that could be it, trying to > understand :-) > >> >> echo "policy_module(mygetty, 1.0.0)" > mygetty.te; >> echo "optional_policy(\`" >> mygetty.te; >> echo "gen_require(\`" >> mygetty.te; >> echo "type getty_t;" >> mygetty.te; >> echo "')" >> mygetty.te; >> echo "corecmd_exec_bin(getty_t)" >> mygetty.te; >> echo "corecmd_exec_shell(getty_t)" >> mygetty.te; >> echo "kernel_read_system_state(getty_t)" >> mygetty.te; >> echo "')" >> mygetty.te; >> >> make -f /usr/share/selinux/devel/Makefile mygetty.pp >> sudo semodule -i mygetty.pp >> >> As for system_mail_t: >> >> echo "policy_module(mymail, 1.0.0)" > mymail.te; >> echo "optional_policy(\`" >> mymail.te; >> echo "gen_require(\`" >> mymail.te; >> echo "type system_mail_t;" >> mymail.te; >> echo "')" >> mymail.te; >> echo "term_use_unallocated_ttys(system_mail_t)" >> mymail.te; >> echo "')" >> mymail.te; >> >> make -f /usr/share/selinux/devel/Makefile mymail.pp >> sudo semodule -i mymail.pp >> >> That should help. > > > This helps a lot, as fax receiving (and notifying) works without AVC > denials showing up. No I'm off trying to understand everything. With all > those makros, one get's a lot done with little code :-) Well there was already policy for getty present but it seems to not be sufficient for your configuration (or it may signal misconfiguration on your part) With regard to system_mail_t this is likely due to a bug. (known bug) Where the tty device does not get properly labeled. My fix makes it work but it is not a good fix ( user tty devices need to get labeled properly) If you are certain that you are using getty properly then consider reporting the AVC denials and my policy for getty_t to bugzilla/selinux-policy so that getties policy can be extended to support your configuration. > Thanks again > Klaus > > > > -- > fedora-selinux-list mailing list > fedora-selinux-list@xxxxxxxxxx > https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Attachment:
signature.asc
Description: OpenPGP digital signature
-- fedora-selinux-list mailing list fedora-selinux-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-selinux-list
