Re: booting in enforcing mode

[Russell Coker <russell@coker.com.au>]

On Sat, 10 Apr 2004 17:10, Rogelio Serrano <rogelio@smsglobal.net> wrote:
> I can boot in enforcing mode now but there seem to be too many
> denials in my log. Which denials can be considered harmless? i
> can see a lot of ioctl, sys_tty_config and getattr.

Show us a sample of the messages.

When determining whether the denials are harmless it's usually a matter of the 
scontext and tcontext.

As for sys_tty_config, in the transition to kernel 2.6.x the handling of this 
changed and lots of applications need it.  I've considered having the 
daemon_base_domain() macro allow or dontaudit it.  Most applications that 
request it don't seem to really need it (they work fine without it).

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.