-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
What avc messages are you seeing?
As Dominick anticipated I got:
avc: denied { name_bind } for pid=23725 comm="tor" src=9150 scontext=unconfined_u:unconfined_r:sandbox_net_client_t:s0:c353,c458
tcontext=system_u:object_r:tor_port_t:s0 tclass=tcp_socket
The quickest (but dirty) fix seams to be to configure TBB to bind to another port (I used 9152 instead of tcp/9150). Changing the SocksPort in TBB's torrc + nis_enabled works for me, but I will build a new sandbox domain anyway.
In the end I'd like to have sandbox type that is able to run TBB out of the box without nis_enabled.
(Why is 9150 in tor_port_t anyway? Tor uses 9050 by default. Are there other common configurations that use 9150 for tor?)
I tried to create a copy of sandbox_net_t (with different name) by copying the "sandbox_net_client_t local policy" section from sandboxX.te [1] and the "sandbox_x_domain_template(sandbox_net)" - line, but failed (typeattribute line).
What would be *the* way to create a (renamed) copy of sandbox_net_t? (I'd prefer just to create an exact copy instead of approximating the domain via audit2allow runs.)
After having an exact copy I'd add allow rules to cover binding to tcp/9150.
thanks!
[1] https://git.fedorahosted.org/cgit/selinux-policy.git/tree/sandboxX.te?h=f19-...
-------------------------------------------------
VFEmail.net - http://www.vfemail.net $14.95 ONETIME Lifetime accounts with Privacy Features! 15GB disk! No bandwidth quotas! Commercial and Bulk Mail Options!