When I use sesearch I appear to be seeing allow rules that are in
tunables that are off. The rules below come from
auth_manage_all_files_except_shadow which is in a disabled tunable.
joe
--
sesearch -A -t jcdx_icm_var_t /etc/selinux/mls/modules/active/base.pp
/etc/selinux/mls/modules/active/modules/*pp
...
allow nfsd_t { file_type -shadow_t } : dir { ioctl read getattr
lock search } ;
allow nfsd_t { file_type -shadow_t } : file { ioctl read getattr lock } ;
allow nfsd_t { file_type -shadow_t } : dir { getattr search } ;
...
--
getsebool -a | grep nfs_export_all_rw
nfs_export_all_rw --> off
--
tunable_policy(`nfs_export_all_rw',`
fs_read_noxattr_fs_files(nfsd_t)
dev_getattr_all_blk_files(nfsd_t)
dev_getattr_all_chr_files(nfsd_t)
auth_manage_all_files_except_shadow(nfsd_t)
#unprivuser_home_dir_filetrans_home_content(nfsd_t, { file dir })
')
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
