Re: ssh policy hassles

[Dale Amon <amon@vnl.com>]

On Wed, Sep 24, 2003 at 11:11:57PM +0100, Dale Amon wrote:
> I'll have to go to the ssh.te now and figure out why it
> isn't there already. Seems strange that it isn't if it
> is commonly accessed.

I've added this:

# DMA20030924 Added search /var/lib 
allow $1 var_lib_t:dir search;

to ssh.te and it gets rid of that avc. I wonder if this
is needed in the master policy? Up to Steve I guess.

Okay, now I've still one more, and this one is really
confusing because ino=48726022 seems not to exist:

	48726022        <inode not found>

I half wonder if I've got a bad link somewhere. It would
be easy enough to add an allow for this, but I'd like
to figure out why rather than blindly add things.

avc:  denied  { read } for  pid=743 exe=/usr/sbin/sshd dev= ino=48726022 scontext=system_u:system_r:sshd_t tcontext=system_u:system_r:sshd_t tclass=lnk_file

-- 
------------------------------------------------------
       IN MY NAME:            Dale Amon, CEO/MD
  No Mushroom clouds over     Islandone Society
    London and New York.      www.islandone.org
------------------------------------------------------

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.