type_transition and sigchild

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



 

Hi there,

 

I’m a beginner of SELinux and i’m trying to implement “type_transition”  (process mode),  this is my rules:

 

###### TYPE TRANSITION FOR lvm_t  ############################

role diskadm_role_r types lvm_t;

 

type_transition diskadm_role_t lvm_exec_t : process lvm_t;

allow diskadm_role_t lvm_exec_t : file { getattr read open execute};

allow diskadm_role_t lvm_t: process transition;

 

#########################################################

 

 

But when I launch lvm commands, for example “lvdisplay” I receive this message:

 

###############################################################

bash-4.1# lvdisplay

lvdisplay: error while loading shared libraries: /lib64/ld-linux-x86-64.so.2: cannot apply additional memory protection after relocation: Permission denied

 

###############################################################

 

I go to see in audit.log, and i’ve these avc-denied:

 

###############################################################

type=AVC msg=audit(1361254531.179:7044668): avc:  denied  { sigchld } for  pid=3968 comm="bash" scontext=ssh_role_u:diskadm_role_r:lvm_t:s0 tcontext=ssh_role_u:diskadm_role_r:diskadm_role_t:s0 tclass=process

###############################################################

 

I should create only a new rule  for “allow lvm_t diskadm_role_t: process sigchild”, but there is a good reason because I must allow this? I’m reading/studing a guide for “type_transition” in "SELinux By Example book" and in this link: http://selinuxproject.org/page/TypeRules  but i don’t see anything about “sigchild” and it’s not highlighted nowhere as requirement for "type_transition" rule.

 

Thanks in advance,

 

Maurizio Pagani

 

--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux

[Index of Archives]     [Fedora Users]     [Fedora Desktop]     [Big List of Linux Books]     [Yosemite News]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

  Powered by Linux