Re: [gentoo-hardened] Problem with SELinux policy

[Chris PeBenito]

On Thu, 2008-03-13 at 22:19 +0100, Florian Tischler wrote:
> I am trying to use SElinux in a Xen DomU. Profile is also
> selinux/2007.0/hardened/amd64. I am using ~amd64 as accept_keywords, don´t
> know if this is a good idea when using selinux.
>
> I get exactly the same error messages like your error messages below + a few
> additional one. (some of them are probably related to xen)
[...]
> audit(1205421548.959:24): avc:  denied  { getattr } for  pid=1561 comm="bash"
> name="xen" dev=proc ino=4026532902 scontext=system_u:system_r:initrc_t
> tcontext=system_u:object_r:proc_xen_t tclass=dir
>
> audit(1205421548.959:25): avc:  denied  { search } for  pid=1561 comm="bash"
> name="xen" dev=proc ino=4026532902 scontext=system_u:system_r:initrc_t
> tcontext=system_u:object_r:proc_xen_t tclass=dir
>
> audit(1205421548.959:26): avc:  denied  { read } for  pid=1561 comm="bash"
> name="capabilities" dev=proc ino=4026532943
> scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:proc_xen_t
> tclass=file
>
> audit(1205421548.963:27): avc:  denied  { getattr } for  pid=1567 comm="grep"
> name="capabilities" dev=proc ino=4026532943
> scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:proc_xen_t
> tclass=file

Can you look through the init scripts to see whats going that it reads
files in /proc/xen?

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243