Dne 19.2.2012 21:51, Sven Vermeulen napsal(a):
> On Sun, Feb 19, 2012 at 10:07:26AM +0100, Tomáš Dobrovolný wrote:
> In that case, your /dev/console is mislabeled, and you are currently running
> with dontaudits disabled (the many rlimitinh and other privilege attempts
> that are by default not audited by SELinux are shown), which might cause
> some confusion on the denials.
>
> Relabel the system, also relabel your /dev when /dev isn't mounted (there's
> a part about setfiles in the SELinux installation instructions just for
> that) and enable dontaudits again (semodule -B).
>
> Wkr,
> Sven Vermeulen
>
I think, that /dev/console has correct label (on --bind / /mn/gentoo) -
crw-------. 1 root root system_u:object_r:console_device_t 5, 1 Feb 20
01:34 /mnt/gentoo/dev/console
You are right, I have had dontaudits disabled, I enable it and denials
more then less.
But for now I have one avc denials -- the /etc/init.d/sysctl cannot set
kernel parameters, but direct calling of syctl -p can. avc error is:
avc: denied { sys_admin } for pid=1860 comm="sysctl" capability=21
scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:initrc_t
tclass=capabilty
and audit2allow -w said: Missing type enforcement (TE) allow rule.
Is this rule really missing in base policy, or I forgot to emerge some
policy module.
--
Thanks
Tomas Dobrovolny
