> So I'm curious as to why this isn't working for you. Did the restorecon
> command in fact change the label of the program to iptables_exec_t? Did
> you get the same AVC message as before?
>
OK, I did the following after "semanage fcontext -a -t iptables_exec_t
/usr/sbin/ipset" and "restorecon -v /usr/sbin/ipset":
[root@dev1 ~]# sesearch --type -s shorewall_t -t iptables_exec_t
Found 1 semantic te rules:
type_transition shorewall_t iptables_exec_t : process iptables_t;
[root@dev1 ~]# ls -lasZ /usr/sbin/ipset
-rwxr-xr-x. root root system_u:object_r:iptables_exec_t:s0 /usr/sbin/ipset
[root@dev1 ~]# service shorewall start
Starting Shorewall: [FAILED]
==============syslog========================================================
Jun 29 22:42:01 dev1 shorewall[2667]: Compiling...
Jun 29 22:42:02 dev1 kernel: type=1400 audit(1277847722.204:30394):
avc: denied { create } for pid=2790 comm="ipset"
scontext=unconfined_u:system_r:shorewall_t:s0
tcontext=unconfined_u:system_r:shorewall_t:s0 tclass=rawip_socket
Jun 29 22:42:02 dev1 kernel: type=1400 audit(1277847722.207:30395):
avc: denied { create } for pid=2792 comm="ipset"
scontext=unconfined_u:system_r:shorewall_t:s0
tcontext=unconfined_u:system_r:shorewall_t:s0 tclass=rawip_socket
Jun 29 22:42:02 dev1 shorewall[2667]: Compiling /etc/shorewall/zones...
Jun 29 22:42:02 dev1 shorewall[2667]: Compiling /etc/shorewall/interfaces...
Jun 29 22:42:02 dev1 shorewall[2667]: Determining Hosts in Zones...
Jun 29 22:42:02 dev1 shorewall[2667]: Preprocessing Action Files...
Jun 29 22:42:02 dev1 shorewall[2667]: Pre-processing
/usr/share/shorewall/action.Drop...
Jun 29 22:42:02 dev1 shorewall[2667]: Pre-processing
/usr/share/shorewall/action.Reject...
Jun 29 22:42:02 dev1 shorewall[2667]: Compiling /etc/shorewall/policy...
Jun 29 22:42:02 dev1 shorewall[2667]: Compiling /etc/shorewall/blacklist...
Jun 29 22:42:02 dev1 shorewall[2667]: ERROR: ipset names in Shorewall
configuration files require Ipset Match in your kernel and iptables :
/etc/shorewall/blacklist (line 11)
Jun 29 22:42:02 dev1 shorewall[2667]: ERROR:Shorewall start failed
================================================================================
So, as you can see it clearly does NOT work for some reason! Applying my
own/patched policy module (myshorewall.pp) does the trick. Any suggestions?
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
