Re: general selinux questions

[antoine <antoine@nagafix.co.uk>]

> > > I have absolutely no idea where to go from here...
> > 
> > Tried audit2why?  Could be constraints or RBAC denial.

Oh well, I thought it was working but that was before I restarted
postfix. When I do, I get (audit2why):

audit(1119536844.319:0): avc:  denied  { transition } for  pid=11754
exe=/bin/bash path=/usr/sbin/postfix dev=md3 ino=783515
scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:postfix_master_t tclass=process
        Was caused by:
                Constraint violation.
                Check policy/constraints.
                Typically, you just need to add a type attribute to the
domain to satisfy the constraint.

But I've got:
domain_auto_trans(initrc_t, postfix_master_exec_t, postfix_master_t)
allow initrc_t postfix_master_t:process { noatsecure siginh rlimitinh };
role_transition system_r postfix_master_exec_t object_r;
role system_r types postfix_master_t;
(may be redundant but does not help)

system_u:object_r:postfix_master_exec_t /usr/lib/postfix/master
system_u:object_r:postfix_pipe_exec_t /usr/lib/postfix/pipe

Which type attribute could it be?
Any ideas?

Thanks
Antoine


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.