lsm3 notes

["Ed Street" <blacknet@simplyaquatics.com>]

Hello,

Couple of things I noted about the new lsm3 

I keep seeing /dev/xconsole avc's. 

This is from startup
allow initrc_t device_t:fifo_file { setattr };
        #EXE=/bin/chmod  PATH=/dev/xconsole   :  setattr

startup as well
allow initrc_t resolv_conf_t:file { setattr };
        #EXE=/bin/chmod  PATH=/etc/resolv.conf   :  setattr


when I ssh into the box
allow sshd_t sysadm_home_t:dir { search };
        #EXE=/usr/sbin/sshd  PATH=/root   :  search

when sysklogd starts at boot
allow syslogd_t device_t:fifo_file { read write };
        #EXE=/sbin/syslogd  PATH=/dev/xconsole   :  read write

when I tried to tail syslog as user_r
allow user_t var_log_t:file { getattr read };
        #EXE=/bin/bash  PATH=/var/log/syslog   :  getattr
        #EXE=/usr/bin/tail  PATH=/var/log/syslog   :  read

Most notably problems with sysklogd, and it's not writing events to
/var/log/syslog

Ed


--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.