| 1 |
Dne 19.2.2012 21:51, Sven Vermeulen napsal(a): |
| 2 |
> On Sun, Feb 19, 2012 at 10:07:26AM +0100, TomᨠDobrovolný wrote: |
| 3 |
> In that case, your /dev/console is mislabeled, and you are currently running |
| 4 |
> with dontaudits disabled (the many rlimitinh and other privilege attempts |
| 5 |
> that are by default not audited by SELinux are shown), which might cause |
| 6 |
> some confusion on the denials. |
| 7 |
> |
| 8 |
> Relabel the system, also relabel your /dev when /dev isn't mounted (there's |
| 9 |
> a part about setfiles in the SELinux installation instructions just for |
| 10 |
> that) and enable dontaudits again (semodule -B). |
| 11 |
> |
| 12 |
> Wkr, |
| 13 |
> Sven Vermeulen |
| 14 |
> |
| 15 |
I think, that /dev/console has correct label (on --bind / /mn/gentoo) - |
| 16 |
|
| 17 |
crw-------. 1 root root system_u:object_r:console_device_t 5, 1 Feb 20 |
| 18 |
01:34 /mnt/gentoo/dev/console |
| 19 |
|
| 20 |
You are right, I have had dontaudits disabled, I enable it and denials |
| 21 |
more then less. |
| 22 |
|
| 23 |
But for now I have one avc denials -- the /etc/init.d/sysctl cannot set |
| 24 |
kernel parameters, but direct calling of syctl -p can. avc error is: |
| 25 |
avc: denied { sys_admin } for pid=1860 comm="sysctl" capability=21 |
| 26 |
scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:initrc_t |
| 27 |
tclass=capabilty |
| 28 |
|
| 29 |
and audit2allow -w said: Missing type enforcement (TE) allow rule. |
| 30 |
|
| 31 |
Is this rule really missing in base policy, or I forgot to emerge some |
| 32 |
policy module. |
| 33 |
|
| 34 |
-- |
| 35 |
|
| 36 |
Thanks |
| 37 |
Tomas Dobrovolny |
Archives