From mboxrd@z Thu Jan 1 00:00:00 1970 Subject: Re: Possible bug with fd class? From: Stephen Smalley To: Jason Johnson Cc: KaiGai Kohei , SE-Linux In-Reply-To: References: <4A372B2F.9000804@ak.jp.nec.com> <1245182462.2512.58.camel@localhost.localdomain> <1245241613.29288.1.camel@localhost.localdomain> Content-Type: text/plain Date: Wed, 17 Jun 2009 15:13:32 -0400 Message-Id: <1245266012.3033.63.camel@localhost.localdomain> Mime-Version: 1.0 Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov On Wed, 2009-06-17 at 20:28 +0200, Jason Johnson wrote: > On Wed, Jun 17, 2009 at 2:26 PM, Stephen Smalley wrote: > >> > > > No, that would show up as a separate AVC, and would > > reference /selinux/null rather than /dev/null. > > > > Some entries in file_contexts are for other distributions and may not > > apply to your particular filesystem. That's ok - it doesn't do any > > harm. > > Oh, I knew that entry wouldn't do anything. I just meant that is the > closest connection I can see from syslog to logrotate. > > So is this entry a bug: > > kernel: [1298522.518701] type=1400 audit(1245126419.780:229): avc: > denied { use } for pid=29944 comm="syslog-ng" path="/dev/null" > dev=tmpfs ino=634 scontext=system_u:system_r:syslogd_t:s0 > tcontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tclass=fd > > ? This just means that logrotate invoked syslog-ng while holding open a descriptor to /dev/null. Nothing more. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.