Re: [gentoo-hardened] SELinux init denial on startup

[Chris PeBenito]

On Tue, 2004-06-01 at 13:23, Robert Paskowitz wrote:
> audit(1086055551.860:0): avc:  denied  { search } for  pid=1
> exe=/sbin/init name=vcs1 dev= ino=607 scontext=system_u:system_r:init_t
> tcontext=system_u:object_r:sysfs_t tclass=dir

This one is a puzzler.  I bet its not fatal.

> audit(1086055554.481:0): avc:  denied  { search } for  pid=325
> exe=/bin/bash name=run dev=hdb3 ino=1812855
> scontext=system_u:system_r:update_modules_t
> tcontext=system_u:object_r:var_run_t tclass=dir

This one isn't fatal, I fixed it in the cvs policy.

> audit(1086055582.167:0): avc:  denied  { append } for  pid=5430
> exe=/usr/sbin/syslog-ng name=tty12 dev=hdb3 ino=98640
> scontext=system_u:system_r:syslogd_t
> tcontext=system_u:object_r:tty_device_t tclass=chr_file
> audit(1086055582.168:0): avc:  denied  { setattr } for  pid=5430
> exe=/usr/sbin/syslog-ng name=tty12 dev=hdb3 ino=98640
> scontext=system_u:system_r:syslogd_t
> tcontext=system_u:object_r:tty_device_t tclass=chr_file

You need to uncomment the tty line in syslogd.fc:

# The syslog can log to this tty:
#/dev/tty12             -c      system_u:object_r:syslogd_tty_device_t

Then `chcon system_u:object_r:syslogd_tty_device_t /dev/tty12`

> audit(1086055582.167:0): avc:  denied  { search } for  pid=5430
> exe=/usr/sbin/syslog-ng name=vc dev= ino=181
> scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:sysfs_t
> tclass=dir

This one is probably happening for the same reason as the one for init.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
Embedded Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243