On Sun, 2013-05-19 at 14:15 +0300, Thorsten Scherf wrote:
Following setup:
iucv instance is started via upstart to make iucv connections available in a z/VM environment:
# cat /etc/init/iucv.conf start on runlevel [2345] stop on runlevel [01] respawn exec /usr/bin/iucvtty lnxterm
iucvtty is running in init_t:
# ps -efZ|grep iucv system_u:system_r:init_t:s0 root 1788 1 0 13:56 ? 00:00:00 /usr/bin/iucvtty lnxterm
Using ts-shell to connect from a central server to this system produces the following AVC:
type=AVC msg=audit(1368960989.210:22183): avc: denied { transition } for pid=1761 comm="login" path="/bin/bash" dev=dasda3 ino=379 scontext=system_u:system_r:local_login_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process type=SYSCALL msg=audit(1368960989.210:22183): arch=80000016 syscall=11 per=400000 success=yes exit=11 a0=b6070570 a1=3fffffbd920 a2=b6083870 a3=4a42fac3a0 items=0 ppid=1756 pid=1761 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=3 comm="bash" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
This is the output from audit2allow:
#!!!! This avc is a constraint violation. You will need to add an attribute to either the source or target type to make it work. #Contraint rule: allow local_login_t unconfined_t:process transition;
What is the recommended way to avoid this AVC?
i think this is a mcs constraint issue:
cat > mytest.te <<EOF policy_module(mytest, 1.0.0) gen_require(` type local_login_t; ') mcs_process_set_categories(local_login_t) EOF
make -f /usr/share/selinux/devel/Makefile mytest.pp sudo semodule -i mytest.pp
Cheers, Thorsten
-- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux