Not sure this was the best approach. but it's working !
Downloaded the selinux-policy-targeted-sources and added the following to the policy.conf.
allow unconfined_t default_t:file execmod; allow unconfined_t tmp_t:file execmod; allow unconfined_t user_home_t:file execmod; allow unconfined_t usr_t:file execmod;
( these were determined by running allow2audit against the audit.log and taking only the ones which affected the oracle processes from starting.)
Did a make and make load.
I can now start the oracle processes with selinux set to enforce. This may have broken some security that should be in place so if anybody has any further info please correct my habits before they become engrained for life.
Alan
On Mon, 2005-03-28 at 22:41 -0500, Alan J. Gagne wrote:
Not sure this was the best approach. but it's working !
Downloaded the selinux-policy-targeted-sources and added the following to the policy.conf.
allow unconfined_t default_t:file execmod; allow unconfined_t tmp_t:file execmod; allow unconfined_t user_home_t:file execmod; allow unconfined_t usr_t:file execmod;
What are the avc denials listed in the log?
On Mon, 2005-03-28 at 22:41 -0500, Alan J. Gagne wrote:
allow unconfined_t default_t:file execmod; allow unconfined_t tmp_t:file execmod; allow unconfined_t user_home_t:file execmod; allow unconfined_t usr_t:file execmod;
I can now start the oracle processes with selinux set to enforce. This may have broken some security that should be in place so if anybody has any further info please correct my habits before they become engrained for life.
Yikes. unconfined_t is used for unconfined apps for the targeted policy (i.e., almost no limits). Best to change the file contexts of the Oracle application and add properly refined rules.
-
Alan J. Gagne -
Ignacio Vazquez-Abrams -
Ivan Gyurdiev