[snip]
messages. But some of the rules it recommends just look wrong to me.
Things like this:
allow consoletype_t file_t:chr_file { getattr ioctl read write };
allow consoletype_t file_t:dir search;
allow dmesg_t file_t:chr_file { read write };
The original avc message would be helpful here.
Bear in mind that audit2allow just generates an allow rule, which may or
may not be what you need. In a lot of cases a dontaudit rule will do.
I was under the impression that nothing should ever be permitted to
transition to file_t, and that errors referencing the file_t domain mean
there's something mis-labelled.
Indeed, which is why the original avc message would be helpful (as it
would allow you to figure out which file was being accessed).
> In this case, it looks like
/dev/console is the biggest culprit, but I've also 20 or so errors from
initrc, a few from ifconfig, a half-dozen from udev. If I install, say,
sshd or sudo, I get more, even after merging and reloading their policy
files.
Do you have udev mounted under /dev? devpts mounted under /dev/pts?
I prefer to use a static /dev or tmpfs (which supports security labels)
Antoine
--
[email protected] mailing list
