Hi Dan,
We added the domain_obj_id_change_exemption(pwrecoveryd_t) to our src
module but no luck.
And also our app does not do a setfscreatecon() call however from the
syslogs we found
Calls to setfscreate() by our app.
Is there a way to look at the constraints on a RHEL5 box using seinfo.
As indicated earlier in the email thread , the seinfo command on RHEL5
does not have the
"--constrain" option.
Thanks,
Anamitra
On 5/21/13 8:36 AM, "Anamitra Dutta Majumdar (anmajumd)"
<anmajumd@xxxxxxxxx> wrote:
>Hi Dan,
>
>Thanks for the pointer . Will give this a try.
>
>-Anamitra
>
>On 5/21/13 6:07 AM, "Daniel J Walsh" <dwalsh@xxxxxxxxxx> wrote:
>
>>-----BEGIN PGP SIGNED MESSAGE-----
>>Hash: SHA1
>>
>>
>>> 2. The AVC denial is type=AVC msg=audit(1369081665.408:8113): avc:
>>>denied
>>> { create } for pid=18379 comm="usermod" name="passwd+"
>>> scontext=specialuser_u:system_r:pwrecoveryd_t:s0
>>> tcontext=system_u:object_r:etc_t:s0 tclass=file
>>
>>The avc shows a process running as SELinux user is attempting to create a
>>file
>>labeled system_u:object_r:etc_t:s0. Since you are changing the SELinux
>>user
>>component you get an AVC. Does your app do a setfscreatecon() call?
>>
>>domain_obj_id_change_exemption(pwrecoveryd_t) is probably what you need.
>>-----BEGIN PGP SIGNATURE-----
>>Version: GnuPG v1.4.13 (GNU/Linux)
>>Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>>
>>iEYEARECAAYFAlGbcZkACgkQrlYvE4MpobMVegCfVG3yKECgQriAUxY8mxAA85cJ
>>cP8AnisdaxW1NcIvuwMzRp65r+/KiEeV
>>=R7ik
>>-----END PGP SIGNATURE-----
>
>--
>selinux mailing list
>selinux@xxxxxxxxxxxxxxxxxxxxxxx
>https://admin.fedoraproject.org/mailman/listinfo/selinux
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
