Hi Aaron,
also check if you have modified the selinux code
also keep track of dmesg. i have noticed that few denials are only shown in dmesg so $dmesg | grep avc is quit important while checking the boot time denials.
one more thing you have to be sure is that u switch between permissive and enforce mode on the same build/bootimage.
Thanks and Regards
Gaurav Gangwar
On 24 April 2015 at 09:42, Spector, Aaron <Aaron_Spector@xxxxxxxxxx> wrote:
That sounds like an idea, I'll have to give it a shot. To add a bit more information, I'm seeing a bunch of these changes happen during the boot process in init and I would assume the AVC is cleared between reboots - I've tweaked and added some things there for experimentation. I can boot my system up in permissive and see no problems, but when I restart it in enforcing I start seeing brand new policy violations, things I haven't seen before. It seems odd that the same boot sequence would result in such different behavior.
-Aaron
-----Original Message-----
From: Paul Moore [mailto:paul@xxxxxxxxxxxxxx]
Sent: Thursday, April 23, 2015 5:20 PM
To: Spector, Aaron
Cc: SELinux (selinux@xxxxxxxxxxxxx)
Subject: Re: Switching to enforcing mode introduces new policy issues?
On Thu, Apr 23, 2015 at 5:14 PM, Spector, Aaron <Aaron_Spector@xxxxxxxxxx> wrote:
> Hi all,
>
> I’ve been working on writing my first policy for SELinux and I’ve hit
> a bit of a snag. I’ve gotten the policy clean in permissive mode, but
> when I swap the system over to enforcing, a whole new set of policy issues crop up.
> Everything I’ve read says this isn’t to be expected so I’m a bit
> confused as to what’s happening.
{snip}
> So far what I’ve had to do to get around it is to add to my policy,
> but that doesn’t seem like that should be necessary. If the audit is
> clean in permissive mode, why isn’t it clean in enforcing?
>
> Is it possible that I’m missing policy deny audits when it’s in
> permissive mode?
It's important to remember that when you are in permissive mode you will only see a given SELinux AVC denial *once*, after that it will not be reported until the AVC is reset. My two favorite ways of resetting the SELinux AVC are to run either 'load_policy' or toggle the system from permissive into enforcing and then back into permissive mode. Try that and I suspect that will solve your problem.
-Paul
--
paul moore
www.paul-moore.com
_______________________________________________
Selinux mailing list
Selinux@xxxxxxxxxxxxx
To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx.
To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
_______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
