Hi Dan,
We added the domain_obj_id_change_exemption(pwrecoveryd_t) to our src module but no luck.
And also our app does not do a setfscreatecon() call however from the syslogs we found Calls to setfscreate() by our app.
Is there a way to look at the constraints on a RHEL5 box using seinfo.
As indicated earlier in the email thread , the seinfo command on RHEL5 does not have the "--constrain" option.
Thanks, Anamitra
On 5/21/13 8:36 AM, "Anamitra Dutta Majumdar (anmajumd)" anmajumd@cisco.com wrote:
Hi Dan,
Thanks for the pointer . Will give this a try.
-Anamitra
On 5/21/13 6:07 AM, "Daniel J Walsh" dwalsh@redhat.com wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
- The AVC denial is type=AVC msg=audit(1369081665.408:8113): avc:
denied { create } for pid=18379 comm="usermod" name="passwd+" scontext=specialuser_u:system_r:pwrecoveryd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
The avc shows a process running as SELinux user is attempting to create a file labeled system_u:object_r:etc_t:s0. Since you are changing the SELinux user component you get an AVC. Does your app do a setfscreatecon() call?
domain_obj_id_change_exemption(pwrecoveryd_t) is probably what you need. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlGbcZkACgkQrlYvE4MpobMVegCfVG3yKECgQriAUxY8mxAA85cJ cP8AnisdaxW1NcIvuwMzRp65r+/KiEeV =R7ik -----END PGP SIGNATURE-----
-- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux