Re: [gentoo-hardened] SELinux boot errors

[Markus Bartl]

Mike Edenfield schrieb: Markus Bartl wrote: Ok thats one thing. But the real nasty thing is the denial of write access to resolv.conf which leads to an improper network configuration. I would really be happy about any suggestions. What kind of network setup do you have in your conf.d/net file?  It's not your dhcp client that is being denied access -- it's runscript.sh itself.  Your dhcp client should be running it its own context (dhcpc_t) which has the proper access. And, as always, if the policy on your system is missing something you need to boot, it's fairly straightforward to make a local policy module.  You can then use audit2allow and pipe those avc messages through it. A good tutorial can be found here: http://www.gentoo.org/proj/en/hardened/selinux/selinux-handbook.xml?part=3&chap=5 Ok. I wrote the following policy: policy_module(boot,1.0) require {         type initrc_t, net_conf_t; } allow initrc_t net_conf_t:file { setattr write }; I compiled it and added it to the existing policy using semodule -i boot.pp That did what it should :-) Maybe this should be included in the base-policy shipped with gentoo. My next step is setting up a dhcp- and a nameserver on this machine. Regards, Markus