-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/23/2013 11:14 AM, Tony Scully wrote:
> Hi Vadym,
>
> In fact vasd just runs unconfined under selinux; the issue you have is that
> sshd is running in the sshd_t context, but need to access some files, the
> vasd cache (I think it's via PAM) in /var/opt/quest/vas.
>
> Quest (now Dell) do provide a policy file which allows sshd to access
> these files, here's the text version:
>
>
> module sshdqas 1.0;
>
> require { type semanage_t; type var_t; type sshd_t; type initrc_t; class
> sock_file write; class unix_stream_socket connectto; class file { read
> write getattr open }; }
>
> #============= semanage_t ============== allow semanage_t var_t:sock_file
> write;
>
> #============= sshd_t ============== allow sshd_t
> initrc_t:unix_stream_socket connectto; allow sshd_t var_t:file open; allow
> sshd_t var_t:file { read write getattr }; allow sshd_t var_t:sock_file
> write;
>
>
Well in Fedora these should be labeled var_auth_t.
restorecon -R -v /var/opt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlHu1aEACgkQrlYvE4MpobOs+ACgvyOqx89Obd+oT99OCNyY1Tud
ddYAoLvXS/ZYjwfIyivEdtVbVm+LFt+v
=oN5b
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
