Both dbus and lvm want to read other processes' command lines. In the case of dbus, this is for use in log messages, which is probably useful. In the case of lvm, it is just to print in a warning if the parent process leaks fds to it, which I doubt is important enough to allow. Index: policy/modules/services/dbus.te =================================================================== --- policy/modules/services/dbus.te.orig +++ policy/modules/services/dbus.te @@ -94,6 +94,7 @@ corecmd_read_bin_sockets(system_dbusd_t) corecmd_exec_bin(system_dbusd_t) +domain_read_all_domains_state(system_dbusd_t) domain_use_interactive_fds(system_dbusd_t) files_read_etc_files(system_dbusd_t) Index: policy/modules/system/lvm.te =================================================================== --- policy/modules/system/lvm.te.orig +++ policy/modules/system/lvm.te @@ -243,6 +243,7 @@ corecmd_exec_bin(lvm_t) corecmd_exec_shell(lvm_t) +domain_dontaudit_read_all_domains_state(lvm_t) domain_use_interactive_fds(lvm_t) files_read_etc_files(lvm_t) -- Martin Orr -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
