On Fri, 19 Mar 2004 20:47, Aleksey Nogin aleksey@nogin.org wrote:
The list is now much smaller than it used to be. I see:
audit(1079689114.447:0): avc: denied { read } for pid=1615 exe=/sbin/route name=resolv.conf dev=hda2 ino=229950 scontext=system_u:system_r:hotplug_t tcontext=system_u:object_r:net_conf_t tclass=file audit(1079689114.448:0): avc: denied { getattr } for pid=1615 exe=/sbin/route path=/etc/resolv.conf dev=hda2 ino=229950 scontext=system_u:system_r:hotplug_t tcontext=system_u:object_r:net_conf_t tclass=file audit(1079689115.057:0): avc: denied { udp_recv } for saddr=131.215.9.49 src=53 daddr=192.168.1.100 dest=32771 netif=wvlan0 scontext=system_u:system_r:hotplug_t tcontext=system_u:object_r:netif_t tclass=netif
can_network(hotplug_t) The above rule solved all that. I'm not sure that's what we desire though. Maybe the program that calls /sbin/route should be running in a different domain? How is this wavelan stuff setup? Why is it different from an ethernet device?