Re: [gentoo-hardened] Problem with SELinux policy

[Florian Tischler]

On Donnerstag, 13. März 2008, Chris PeBenito wrote:
> On Thu, 2008-03-13 at 17:01 +0100, Björn Fahller wrote:
> > On Thursday 13 March 2008 16.27.51 Chris PeBenito wrote:
> > > On Thu, 2008-03-13 at 15:26 +0100, Björn Fahller wrote:
> > > >  Adding 977216k swap on /dev/hda1.  Priority:-1 extents:1
> > > > across:977216k audit(1205311359.150:6): avc:  denied  { write } for
> > > > pid=2470 comm="runscript.sh" name="resolv.conf" dev=hda2 ino=46223216
> > > > scontext=system_u:system_r:initrc_t
> > > > tcontext=system_u:object_r:net_conf_t tclass=file
> > > >  audit(1205311359.154:7): avc:  denied  { setattr } for  pid=2525
> > > > comm="chmod" name="resolv.conf" dev=hda2 ino=46223216
> > > > scontext=system_u:system_r:initrc_t
> > > > tcontext=system_u:object_r:net_conf_t tclass=file
> > >
> > > Do you use net-dns/resolvconf-gentoo?
> >
> > No. Would it help?
>
> It was the only thing I could find that chmod'ed resolv.conf.  I guess
> it requires more investigation.

Hi,

the chmod is in the script /lib/rcscripts/net/system.sh

Florian

> > > >  eth0: link up, 100Mbps, full-duplex
> > > >  audit(1205311366.898:11): avc:  denied  { nlmsg_write } for
> > > > pid=3576 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t
> > >
> > > I'll have to do some investigation on this one.
> >
> > If you use VirtualBox, I can give you the experiment machine to look
> > into.
>
> As a personal policy, I don't log on/connect to other peoples machines.
> However, after a litle more thought, its likely ok.  Its probably from
> setting up the routing tables, which would be expected.



-- 
Florian Tischler
mailto:flo_list2007@×××××.at
icq:11754147
-- 
gentoo-hardened@l.g.o mailing list