Re: refpolicy: patch for ldconfig from glibc 2.7

["Christopher J. PeBenito" <cpebenito@tresys.com>]

On Tue, 2008-08-12 at 17:30 +0200, Václav Ovsík wrote:
> Hi,
> there is a message with a patch
> http://marc.info/?l=selinux&m=120369420620609&w=2
> in February 2008.

Merged.

> On Fri, Feb 22, 2008 at 01:05:39PM -0500, Christopher J. PeBenito wrote:
> > On Fri, 2008-02-22 at 16:27 +0100, Václav Ovsík wrote:
> > > Hi,
> > > I had some denials for ldconfig on Debian Sid. I took changes from
> > > Fedora policy package - a patch attached. I grabed only things needed
> > > to suppress denials below from Fedora.
> > > 
> > > audit(1203580520.435:11): avc:  denied  { read } for  pid=3985 comm="ldconfig" name="aux-cache" dev=sda1 ino=294984 scontext=system_u:system_r:ldconfig_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
> > > audit(1203580520.435:12): avc:  denied  { getattr } for  pid=3985 comm="ldconfig" name="aux-cache" dev=sda1 ino=294984 scontext=system_u:system_r:ldconfig_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
> > > audit(1203580520.907:13): avc:  denied  { write } for  pid=3985 comm="ldconfig" name="ldconfig" dev=sda1 ino=294986 scontext=system_u:system_r:ldconfig_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir
> > > audit(1203580520.907:14): avc:  denied  { add_name } for  pid=3985 comm="ldconfig" name="aux-cache~" scontext=system_u:system_r:ldconfig_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir
> > > audit(1203580520.907:15): avc:  denied  { create } for  pid=3985 comm="ldconfig" name="aux-cache~" scontext=system_u:system_r:ldconfig_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
> > 
> > This is the right fix, and basically the same fix is queued up for
> > merging as part of Dan's patch set.
> 
> Can be this patch merged as-is?
> (Attached again.)
-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.