Following setup:
iucv instance is started via upstart to make iucv connections available
in a z/VM environment:
# cat /etc/init/iucv.conf
start on runlevel [2345]
stop on runlevel [01]
respawn
exec /usr/bin/iucvtty lnxterm
iucvtty is running in init_t:
# ps -efZ|grep iucv
system_u:system_r:init_t:s0 root 1788 1 0 13:56 ? 00:00:00 /usr/bin/iucvtty lnxterm
Using ts-shell to connect from a central server to this system produces
the following AVC:
type=AVC msg=audit(1368960989.210:22183): avc: denied { transition }
for pid=1761 comm="login" path="/bin/bash" dev=dasda3 ino=379
scontext=system_u:system_r:local_login_t:s0
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tclass=process
type=SYSCALL msg=audit(1368960989.210:22183): arch=80000016 syscall=11
per=400000 success=yes exit=11 a0=b6070570 a1=3fffffbd920 a2=b6083870
a3=4a42fac3a0 items=0 ppid=1756 pid=1761 auid=500 uid=500 gid=500
euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=3
comm="bash" exe="/bin/bash"
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
This is the output from audit2allow:
#!!!! This avc is a constraint violation. You will need to add an
attribute to either the source or target type to make it work.
#Contraint rule:
allow local_login_t unconfined_t:process transition;
What is the recommended way to avoid this AVC?
Cheers,
Thorsten
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
