On Sun, 2013-05-19 at 14:15 +0300, Thorsten Scherf wrote:
> Following setup:
>
> iucv instance is started via upstart to make iucv connections available
> in a z/VM environment:
>
> # cat /etc/init/iucv.conf
> start on runlevel [2345]
> stop on runlevel [01]
> respawn
> exec /usr/bin/iucvtty lnxterm
>
> iucvtty is running in init_t:
>
> # ps -efZ|grep iucv
> system_u:system_r:init_t:s0 root 1788 1 0 13:56 ? 00:00:00 /usr/bin/iucvtty lnxterm
>
> Using ts-shell to connect from a central server to this system produces
> the following AVC:
>
> type=AVC msg=audit(1368960989.210:22183): avc: denied { transition }
> for pid=1761 comm="login" path="/bin/bash" dev=dasda3 ino=379
> scontext=system_u:system_r:local_login_t:s0
> tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> tclass=process
> type=SYSCALL msg=audit(1368960989.210:22183): arch=80000016 syscall=11
> per=400000 success=yes exit=11 a0=b6070570 a1=3fffffbd920 a2=b6083870
> a3=4a42fac3a0 items=0 ppid=1756 pid=1761 auid=500 uid=500 gid=500
> euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=3
> comm="bash" exe="/bin/bash"
> subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>
> This is the output from audit2allow:
>
> #!!!! This avc is a constraint violation. You will need to add an
> attribute to either the source or target type to make it work.
> #Contraint rule:
> allow local_login_t unconfined_t:process transition;
>
> What is the recommended way to avoid this AVC?
>
i think this is a mcs constraint issue:
cat > mytest.te <<EOF
policy_module(mytest, 1.0.0)
gen_require(` type local_login_t; ')
mcs_process_set_categories(local_login_t)
EOF
make -f /usr/share/selinux/devel/Makefile mytest.pp
sudo semodule -i mytest.pp
> Cheers,
> Thorsten
>
> --
> selinux mailing list
> selinux@xxxxxxxxxxxxxxxxxxxxxxx
> https://admin.fedoraproject.org/mailman/listinfo/selinux
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
