Re: can't start X window in enforce mode

[Michael Reilly <michaelr@cisco.com>]

I agree :-)


I did find the problem - the X server needed DAC_OVERRIDE.  This was logged
as soon as I removed the dontaudit's

michael
On 14 Oct 2003 11:00:47 -0400
Stephen Smalley <sds@epoch.ncsc.mil> wrote:

> On Mon, 2003-10-13 at 03:52, Russell Coker wrote:
> > On Mon, 13 Oct 2003 09:15, Michael Reilly wrote:
> > > I had both problems.  I added the dontaudit memory devices
> > > as mentioned in the file macros/program/xserver_macros.te.
> > >
> > > I have the second problem and have not yet solved it.  Nothing is
> > > logged and I cannot figure out what is wrong.
> > 
> > Try doing
> > grep -v dontaudit policy.conf > new-policy
> > mv new-policy policy.conf
> > 
> > Then load the policy and see what happens.
> 
> There should likely be a policy Makefile target to generate and load
> a policy that does not suppress any auditing.
> 
> -- 
> Stephen Smalley <sds@epoch.ncsc.mil>
> National Security Agency


-- 
---- ---- ----
Michael Reilly    michaelr@cisco.com
    Cisco Systems, Santa Cruz, CA

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.