Neale Ferguson writes:
> Thanks. I used the chcon command to change the context but am still having
> problems and seeing this in the audit log:
>
> type=AVC msg=audit(1296596790.809:1547): avc: denied { execute } ...
Now it's complaining about execute whereas before it was only
complaining about read. I'm no expert here, but I believe the types
of object are in general different from the types of subjects for
Type Enforcement which is the usual SELinux policy.
If you look in the selinux-policy SRPM (just do a build-prepare with
rpmbuild -bp), you'll find the source for the snmpd policy in
directory serefpolicy-3.7.19/policy/modules/services in files snmp.fc,
snmp.if and snmp.te for, respectively, the contexts for particular
directory names (for use with restorecon), the interfaces and the
underlying types. I'm looking at Fedora 13 but it's probably close.
I see stuff in there for it reading lib files and executing init
scripts and so on but I see nothing for loading dynamic modules.
If you want to solve this properly rather than using a blunt hammer
then you could maybe look at the apache.* policy files in the same
directory and see how the httpd_modules_t type is implemented there
to handle Apache DSOs and use similar type and interface definitions
for snmpd.
--Malcolm
--
Malcolm Beattie
IBM Mainframe Systems and Software Business, Europe
IBM UK
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
----------------------------------------------------------------------
For more information on Linux on System z, visit
http://wiki.linuxvm.org/
