Re: [gentoo-hardened] "Out of the box" SELinux policy questions...

[Antoine Martin]

[snip]
> messages.  But some of the rules it recommends just look wrong to me.
> Things like this:
>
> allow consoletype_t file_t:chr_file { getattr ioctl read write };
> allow consoletype_t file_t:dir search;
> allow dmesg_t file_t:chr_file { read write };
The original avc message would be helpful here.
Bear in mind that audit2allow just generates an allow rule, which may or 
may not be what you need. In a lot of cases a dontaudit rule will do.

> I was under the impression that nothing should ever be permitted to
> transition to file_t, and that errors referencing the file_t domain mean
> there's something mis-labelled.
Indeed, which is why the original avc message would be helpful (as it 
would allow you to figure out which file was being accessed).

 > In this case, it looks like
> /dev/console is the biggest culprit, but I've also 20 or so errors from
> initrc, a few from ifconfig, a half-dozen from udev.  If I install, say,
> sshd or sudo, I get more, even after merging and reloading their policy
> files.
Do you have udev mounted under /dev? devpts mounted under /dev/pts?
I prefer to use a static /dev or tmpfs (which supports security labels)

Antoine
-- 
gentoo-hardened@g.o mailing list