On [Sun, 19.05.2013 17:15], Dominick Grift wrote:
On Sun, 2013-05-19 at 14:15 +0300, Thorsten Scherf wrote:Following setup: iucv instance is started via upstart to make iucv connections available in a z/VM environment: # cat /etc/init/iucv.conf start on runlevel [2345] stop on runlevel [01] respawn exec /usr/bin/iucvtty lnxterm iucvtty is running in init_t: # ps -efZ|grep iucv system_u:system_r:init_t:s0 root 1788 1 0 13:56 ? 00:00:00 /usr/bin/iucvtty lnxterm Using ts-shell to connect from a central server to this system produces the following AVC: type=AVC msg=audit(1368960989.210:22183): avc: denied { transition } for pid=1761 comm="login" path="/bin/bash" dev=dasda3 ino=379 scontext=system_u:system_r:local_login_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process type=SYSCALL msg=audit(1368960989.210:22183): arch=80000016 syscall=11 per=400000 success=yes exit=11 a0=b6070570 a1=3fffffbd920 a2=b6083870 a3=4a42fac3a0 items=0 ppid=1756 pid=1761 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=3 comm="bash" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) This is the output from audit2allow: #!!!! This avc is a constraint violation. You will need to add an attribute to either the source or target type to make it work. #Contraint rule: allow local_login_t unconfined_t:process transition; What is the recommended way to avoid this AVC?i think this is a mcs constraint issue: cat > mytest.te <<EOF policy_module(mytest, 1.0.0) gen_require(` type local_login_t; ') mcs_process_set_categories(local_login_t) EOF make -f /usr/share/selinux/devel/Makefile mytest.pp sudo semodule -i mytest.pp
This indeed fixed it. Is this something that should go into the default policy? Digging through the mcs_process_set_categories interface, all it does, is to set the mcssetcats attribute on local_login_t. -- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/selinux
