selinux February 2009

selinux@lists.fedoraproject.org

43 participants
57 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

TCP server howto
by Jan Kasprzak 05 Mar '09

05 Mar '09

Hello, what is a recommended way of allowing a domain to act as a generic TCP server. I.e. to create a stream socket, bind(2) it to a single defined port with INADDR_ANY, listen(2) on it, accept(2) connections on it, and communicate (read/write/send*/recv*) on it. So far I am using audit2allow, and it has led me to the following setup (actual reading/writing not verified yet, more rules would probably be needed): allow $1 hi_reserved_port_t:tcp_socket name_bind; allow $1 inaddr_any_node_t:tcp_socket node_bind; allow $1 self:capability net_bind_service; However, I guess hi_reserver_port_t is not a _single_ port. I have seen the network_port() macro in corenetwork.if, but using network_port($1, tcp,654,s0); gives a syntax error. Is there any high-level macro for setting up a single port and allowing it to be bound, listened, read and written? [ my system is Fedora 10 with the targeted policy ] Thanks, -Yenya -- | Jan "Yenya" Kasprzak <kas at {fi.muni.cz - work | yenya.net - private}> | | GPG: ID 1024/D3498839 Fingerprint 0D99A7FB206605D7 8B35FCDE05B18A5E | | http://www.fi.muni.cz/~kas/ Journal: http://www.fi.muni.cz/~kas/blog/ | >> If you find yourself arguing with Alan Cox, you’re _probably_ wrong. << >> --James Morris in "How and Why You Should Become a Kernel Hacker" <<

4 5

SELinux user login problem
by prakash hallalli 02 Mar '09

02 Mar '09

Hi All, I have created myuser user and i created custom module for user. i have followed same below steps. #vi myuser.te policy_module(myuser, 0.0.1) role myuser_r; userdom_unpriv_user_templete(myuser)

3 10

Re: f10 vs selinux again.
by Dominick Grift 01 Mar '09

01 Mar '09

On Sat, 2009-02-28 at 15:32 -0500, Gene Heskett wrote: > On Saturday 28 February 2009, Dominick Grift wrote: > >On Sat, 2009-02-28 at 14:15 -0500, Gene Heskett wrote: > >> On Saturday 28 February 2009, Dominick Grift wrote: > >> >On Sat, 2009-02-28 at 12:53 -0500, Gene Heskett wrote: > >> >> Greetings all; > >> >> > >> >> I have just upgraded then updated as much as possible, an F8 > > > >install to > > > >> >> F10. selinux is now denying ConsoleKit and friends, and awstats. > > > >F10 will > > > >> >> run without console-kit-daemon I find, but I went so far as to > > > >touch > > > >> >> /.autorelabel & reboot & leave it to contemplate its sins for an > > > >hour or > > > >> >> so as there is nearly 2TB of drives here. Didn't help. > >> >> > >> >> So Now I have selinux disabled, and everything it working. Can > > > >this be > > > >> >> addressed? > >> > > >> >Can you show use the avc denials related to your issues? avc denials > > > >are > > > >> >sent to /var/log/audit/audit.log and can be retrieved with the > > > >ausearch > > > >> >command. For example use: ausearch -m avc -ts today, to retrieve > > > >today's > > > >> >avc denials. > >> > >> None today, I turned it off, yesterdays is attached. > >> > >> >You state that you updated as much as possible. What did you not > > > >update? > > > >> About 70 packages are left, all the java stuff cuz I've installed from > > > >Sun, > > > >> I've nuked fedora's firefox cuz I already had 3.0.6 (had to fix that > > > >up by > > > >> hand and some of the menus are still fubar) and anytime I do a -devel, > > > >it > > > >> barfs over strigi. What the heck does that thing do anywho? > >> > >> I also am not running the F10 kernel cuz I have to set stakes and call > > > >a > > > >> surveyer to measure screen scrolling speed, so I'm running 2.6.28.7 > > > >and am > > > >> building the xorg drm and xf86-r6xx-r7xx-radeonhd trees. Now glxgears > > > >says > > > >> 275-300 fps and I can tolerate it. Anyway, from the yumex screen: > >> > >> 14:05:14 : Error in Dependency Resolution > >> 14:05:14 : Missing Dependency: xine-lib(plugin-abi) = 1.25 is needed > > > >by > > > >> package xine-lib-extras-freeworld-1.1.16.2-1.fc10.i386 > > > >(rpmfusion-free- > > > >> updates) > >> Missing Dependency: kernel-uname-r = 2.6.27.15-170.2.24.fc10.i686 is > > > >needed by > > > >> package > > > >kmod-fglrx-2.6.27.15-170.2.24.fc10.i686-8.573-1.9.1.fc10.1.i686 > > > >> (rpmfusion-nonfree-updates) > >> Missing Dependency: strigi-libs = 0.5.11-1.fc10 is needed by package > > > >strigi- > > > >> devel-0.5.11-1.fc10.i386 (fedora) > >> > >> I might be able to get a list of updates (if you need them) not done > > > >from yum. > > > >> I use yumex most of the time. > >> > >> Thanks Dominick > > > >No that is fine, thanks. Which version of selinux-policy is currently > >installed? > > > >I picked a few of the denials out of there and both were allowed in the > >rawhide policy. > > > >This leads me to think that either you are running a old version of the > >selinux-policy or that the fixes in rawhide policy have not been pushed > >to Fedora 10 policy yet. > > > I'll go for the latter as there isn't an update available. > [root@coyote Documents]# rpm -qa|grep policy > checkpolicy-2.0.16-3.fc10.i386 > selinux-policy-3.5.13-18.fc10.noarch > policycoreutils-2.0.57-11.fc10.i386 > policycoreutils-gui-2.0.57-11.fc10.i386 > selinux-policy-targeted-3.5.13-18.fc10.noarch > > >I either case you can create custom policies to allow these denials. > > > >A quick (and dirty) way is to "cat avc-denials.txt | audit2allow -M > >mydenials; /usr/sbin/semodule -i mydenials.pp > > And that upchucks. It generates mydenials.pp, then: > [root@coyote Documents]# /usr/sbin/semodule -i mydenials.pp > libsepol.link_modules: Tried to link in a non-MLS module with an MLS base. > libsemanage.semanage_link_sandbox: Link packages failed > /usr/sbin/semodule: Failed! > > Looks like I may be missing something? Can you give me to output of sestatus? you could try /usr/sbin/semodule -s targeted -i mydenials.pp You might also consider /usr/sbin/semodule -b base.pp (this should replace the base module) man semodule This looks like something that could have gone wrong during the upgrade. It claims that a MLS base module is installed but you have installed selinux-policy-targeted you should really c.c. fedora-selinux-list so that knowledgeable people like dwalsh can give suggestions as well. > >caution: i did not review all denials in your list, however most look > >like they should be allowed. > > > >You should not let issues like these persuade you to disable SELinux. > >You can also run SELinux is permissive mode which will act as an > >intrusion detection system but will not prevent policy violations. > > I am not terribly paranoid about running selinux, Dominick, I have all my > local network behind an x86 version of dd-wrt & its locked up pretty tight. > selinux is last ditch. In 2 years, no one has gotten past dd-wrt that I > didn't first give them the password to it. I see my running it as more of the > playing of a role, that of the canary in the coal mine if you will. > > >hth , Dominick > >

3 10

Re: f10 vs selinux again.
by Dominick Grift 28 Feb '09

28 Feb '09

On Sat, 2009-02-28 at 14:15 -0500, Gene Heskett wrote: > On Saturday 28 February 2009, Dominick Grift wrote: > >On Sat, 2009-02-28 at 12:53 -0500, Gene Heskett wrote: > >> Greetings all; > >> > >> I have just upgraded then updated as much as possible, an F8 install to > >> F10. selinux is now denying ConsoleKit and friends, and awstats. F10 will > >> run without console-kit-daemon I find, but I went so far as to touch > >> /.autorelabel & reboot & leave it to contemplate its sins for an hour or > >> so as there is nearly 2TB of drives here. Didn't help. > >> > >> So Now I have selinux disabled, and everything it working. Can this be > >> addressed? > > > >Can you show use the avc denials related to your issues? avc denials are > >sent to /var/log/audit/audit.log and can be retrieved with the ausearch > >command. For example use: ausearch -m avc -ts today, to retrieve today's > >avc denials. > > > None today, I turned it off, yesterdays is attached. > > >You state that you updated as much as possible. What did you not update? > > About 70 packages are left, all the java stuff cuz I've installed from Sun, > I've nuked fedora's firefox cuz I already had 3.0.6 (had to fix that up by > hand and some of the menus are still fubar) and anytime I do a -devel, it > barfs over strigi. What the heck does that thing do anywho? > > I also am not running the F10 kernel cuz I have to set stakes and call a > surveyer to measure screen scrolling speed, so I'm running 2.6.28.7 and am > building the xorg drm and xf86-r6xx-r7xx-radeonhd trees. Now glxgears says > 275-300 fps and I can tolerate it. Anyway, from the yumex screen: > > 14:05:14 : Error in Dependency Resolution > 14:05:14 : Missing Dependency: xine-lib(plugin-abi) = 1.25 is needed by > package xine-lib-extras-freeworld-1.1.16.2-1.fc10.i386 (rpmfusion-free- > updates) > Missing Dependency: kernel-uname-r = 2.6.27.15-170.2.24.fc10.i686 is needed by > package kmod-fglrx-2.6.27.15-170.2.24.fc10.i686-8.573-1.9.1.fc10.1.i686 > (rpmfusion-nonfree-updates) > Missing Dependency: strigi-libs = 0.5.11-1.fc10 is needed by package strigi- > devel-0.5.11-1.fc10.i386 (fedora) > > I might be able to get a list of updates (if you need them) not done from yum. > I use yumex most of the time. > > Thanks Dominick > No that is fine, thanks. Which version of selinux-policy is currently installed? I picked a few of the denials out of there and both were allowed in the rawhide policy. This leads me to think that either you are running a old version of the selinux-policy or that the fixes in rawhide policy have not been pushed to Fedora 10 policy yet. I either case you can create custom policies to allow these denials. A quick (and dirty) way is to "cat avc-denials.txt | audit2allow -M mydenials; /usr/sbin/semodule -i mydenials.pp caution: i did not review all denials in your list, however most look like they should be allowed. You should not let issues like these persuade you to disable SELinux. You can also run SELinux is permissive mode which will act as an intrusion detection system but will not prevent policy violations. hth , Dominick

1 0

f10 vs selinux again.
by Gene Heskett 28 Feb '09

28 Feb '09

Greetings all; I have just upgraded then updated as much as possible, an F8 install to F10. selinux is now denying ConsoleKit and friends, and awstats. F10 will run without console-kit-daemon I find, but I went so far as to touch /.autorelabel & reboot & leave it to contemplate its sins for an hour or so as there is nearly 2TB of drives here. Didn't help. So Now I have selinux disabled, and everything it working. Can this be addressed? -- Cheers, Gene "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) "It may be that our role on this planet is not to worship God but to create him." -Arthur C. Clarke

2 1

selinux denying access to "unknown"
by John Oliver 26 Feb '09

26 Feb '09

System is a fresh install of RHEL 5.2 [root@testbed ~]# service httpd start Starting httpd: [FAILED] [root@testbed ~]# tail -1 /var/log/messages Feb 23 17:33:34 testbed setroubleshoot: SELinux is preventing /usr/sbin/httpd (httpd_t) "execstack" access to <Unknown> (httpd_t). For complete SELinux messages. run sealert -l bda3d483-5ff5-4465-a9af-c2896cd7adb0 [root@testbed ~]# sealert -l bda3d483-5ff5-4465-a9af-c2896cd7adb0 Summary SELinux is preventing /usr/sbin/httpd (httpd_t) "execstack" access to <Unknown> (httpd_t). Detailed Description SELinux denied access requested by /usr/sbin/httpd. It is not expected that this access is required by /usr/sbin/httpd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for <Unknown>, restorecon -v <Unknown>. There is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 - or you can disable SELinux protection entirely for the application. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Changing the "httpd_disable_trans" boolean to true will disable SELinux protection this application: "setsebool -P httpd_disable_trans=1." The following command will allow this access: setsebool -P httpd_disable_trans=1 Additional Information Source Context root:system_r:httpd_t:s0 Target Context root:system_r:httpd_t:s0 Target Objects None [ process ] Affected RPM Packages httpd-2.2.3-6.el5 [application] Policy RPM selinux-policy-2.4.6-30.el5 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.disable_trans Host Name testbed Platform Linux testbed 2.6.18-8.el5 #1 SMP Fri Jan 26 14:15:21 EST 2007 i686 i686 Alert Count 2 Line Numbers Raw Audit Messages avc: denied { execstack } for comm="httpd" egid=0 euid=0 exe="/usr/sbin/httpd" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 pid=15177 scontext=root:system_r:httpd_t:s0 sgid=0 subj=root:system_r:httpd_t:s0 suid=0 tclass=process tcontext=root:system_r:httpd_t:s0 tty=(none) uid=0 How am I supposed to figure out what it's unhappy about if it won't tell me? -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

2 2

service ypbind restart, denied access requested by genhomedircon
by Per Sjoholm 25 Feb '09

25 Feb '09

On CentOS 5.2 # ypcat -k auto.home * asen20:/export/Server/homes/& yp seems to be working for clients. BUT Feb 24 14:32:54 dox ypserv[5353]: refused connect from 192.168.1.23:661 to procedure ypproc_match (oasen,auto_home;-4) dox and asen20 is same machine (asen20 is a service IPaddress) cd /var/yp; make does not yp]# make gmake[1]: Entering directory `/var/yp/oasen' Updating passwd.byname... failed to send 'clear' to local ypserv: RPC: Timed outUpdating passwd.byuid ..... [root@dox yp]# service ypbind restart Shutting down NIS services: [ OK ] Turning off allow_ypbind SELinux boolean Turning on allow_ypbind SELinux boolean Binding to the NIS domain: [ OK ] Listening for an NIS domain server.. var log messages Feb 24 14:12:49 dox setsebool: The allow_ypbind policy boolean was changed to 0 by root Feb 24 14:12:51 dox setsebool: The allow_ypbind policy boolean was changed to 1 by root Feb 24 14:12:51 dox setroubleshoot: SELinux is preventing genhomedircon (semanage_t) "node_bind" to <Unknown> (inaddr_any_node_t). For complete SELinux messages. run sealert -l 70aadaea-686d-45b6-a10e-f4d5909b49bf Feb 24 14:12:51 dox setroubleshoot: SELinux is preventing genhomedircon (semanage_t) "name_bind" to <Unknown> (hi_reserved_port_t). For complete SELinux messages. run sealert -l 4c554775-348e-41b7-aa4b-74216b06e26e Feb 24 14:12:51 dox setroubleshoot: SELinux is preventing genhomedircon (semanage_t) "name_connect" to <Unknown> (portmap_port_t). For complete SELinux messages. run sealert -l 3ee7b441-b219-4684-8a42-1448513cd5b2 Feb 24 14:12:52 dox ypbind: bound to NIS server asen20.oasen.dyndns.org # sealert -l 70aadaea-686d-45b6-a10e-f4d5909b49bf Summary: SELinux is preventing genhomedircon (semanage_t) "node_bind" to <Unknown> (inaddr_any_node_t). Detailed Description: SELinux denied access requested by genhomedircon. It is not expected that this access is required by genhomedircon and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context root:system_r:semanage_t Target Context system_u:object_r:inaddr_any_node_t Target Objects None [ tcp_socket ] Source genhomedircon Source Path /usr/bin/python Port <Unknown> Host dox.oasen.dyndns.org Source RPM Packages python-2.4.3-21.el5 Target RPM Packages Policy RPM selinux-policy-2.4.6-137.1.el5 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name dox.oasen.dyndns.org Platform Linux dox.oasen.dyndns.org 2.6.18-92.1.22.el5 #1 SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64 Alert Count 2 First Seen Tue Feb 24 14:08:17 2009 Last Seen Tue Feb 24 14:12:48 2009 Local ID 70aadaea-686d-45b6-a10e-f4d5909b49bf Line Numbers Raw Audit Messages host=dox.oasen.dyndns.org type=AVC msg=audit(1235481168.486:50364): avc: denied { node_bind } for pid=5378 comm="genhomedircon" scontext=root:system_r:semanage_t:s0 tcontext=system_u:object_r:inaddr_any_node_t:s0 tclass=tcp_socket host=dox.oasen.dyndns.org type=SYSCALL msg=audit(1235481168.486:50364): arch=c000003e syscall=49 success=no exit=-13 a0=5 a1=7ffff31e1eb0 a2=10 a3=3 items=0 ppid=5376 pid=5378 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=8550 comm="genhomedircon" exe="/usr/bin/python" subj=root:system_r:semanage_t:s0 key=(null) # sealert -l 4c554775-348e-41b7-aa4b-74216b06e26e Summary: SELinux is preventing genhomedircon (semanage_t) "name_bind" to <Unknown> (hi_reserved_port_t). Detailed Description: SELinux denied access requested by genhomedircon. It is not expected that this access is required by genhomedircon and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context root:system_r:semanage_t Target Context system_u:object_r:hi_reserved_port_t Target Objects None [ tcp_socket ] Source genhomedircon Source Path /usr/bin/python Port 890 Host dox.oasen.dyndns.org Source RPM Packages python-2.4.3-21.el5 Target RPM Packages Policy RPM selinux-policy-2.4.6-137.1.el5 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name dox.oasen.dyndns.org Platform Linux dox.oasen.dyndns.org 2.6.18-92.1.22.el5 #1 SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64 Alert Count 2 First Seen Tue Feb 24 14:08:17 2009 Last Seen Tue Feb 24 14:12:48 2009 Local ID 4c554775-348e-41b7-aa4b-74216b06e26e Line Numbers Raw Audit Messages host=dox.oasen.dyndns.org type=AVC msg=audit(1235481168.488:50365): avc: denied { name_bind } for pid=5378 comm="genhomedircon" src=890 scontext=root:system_r:semanage_t:s0 tcontext=system_u:object_r:hi_reserved_port_t:s0 tclass=tcp_socket host=dox.oasen.dyndns.org type=SYSCALL msg=audit(1235481168.488:50365): arch=c000003e syscall=49 success=no exit=-13 a0=5 a1=7ffff31e1de0 a2=10 a3=3 items=0 ppid=5376 pid=5378 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=8550 comm="genhomedircon" exe="/usr/bin/python" subj=root:system_r:semanage_t:s0 key=(null) # sealert -l 3ee7b441-b219-4684-8a42-1448513cd5b2 Summary: SELinux is preventing genhomedircon (semanage_t) "name_connect" to <Unknown> (portmap_port_t). Detailed Description: SELinux denied access requested by genhomedircon. It is not expected that this access is required by genhomedircon and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context root:system_r:semanage_t Target Context system_u:object_r:portmap_port_t Target Objects None [ tcp_socket ] Source genhomedircon Source Path /usr/bin/python Port 111 Host dox.oasen.dyndns.org Source RPM Packages python-2.4.3-21.el5 Target RPM Packages Policy RPM selinux-policy-2.4.6-137.1.el5 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name dox.oasen.dyndns.org Platform Linux dox.oasen.dyndns.org 2.6.18-92.1.22.el5 #1 SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64 Alert Count 2 First Seen Tue Feb 24 14:08:17 2009 Last Seen Tue Feb 24 14:12:48 2009 Local ID 3ee7b441-b219-4684-8a42-1448513cd5b2 Line Numbers Raw Audit Messages host=dox.oasen.dyndns.org type=AVC msg=audit(1235481168.490:50366): avc: denied { name_connect } for pid=5378 comm="genhomedircon" dest=111 scontext=root:system_r:semanage_t:s0 tcontext=system_u:object_r:portmap_port_t:s0 tclass=tcp_socket host=dox.oasen.dyndns.org type=SYSCALL msg=audit(1235481168.490:50366): arch=c000003e syscall=42 success=no exit=-13 a0=5 a1=7ffff31e2040 a2=10 a3=3 items=0 ppid=5376 pid=5378 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=8550 comm="genhomedircon" exe="/usr/bin/python" subj=root:system_r:semanage_t:s0 key=(null)

2 3

Fedora policy sources
by Per Sjoholm 23 Feb '09

23 Feb '09

Where can I find targeted policy source for Fedora 9/10 and CENTOS 5.2 as an rpm file. Is it same as reference policy on found on oss.tresys.com ?

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux February 2009