Re: list of permissions created by allow2audit: what do i do now?

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Tue, May 18, 2004 at 10:40:28AM +0000, Luke Kenneth Casson Leighton wrote:

> help, help, i discovered the existence of allow2audit, and _finally_
> i now have a tool that i can use to understand avc messages in terms
> of audit permissions: hooray!
> 
> would someone mind advising me which of these is reasonable/safe
> to allow, or should i just bung them all in and see what happens?

well i tried the bung-it-in-and-see approach, and i got a build error
due to some global policy violations at make policy time because
of this (and one other):

> allow hotplug_t etc_runtime_t:file { relabelfrom relabelto };

... but what is even stranger is that even though i add in these
things into a new package (i called it domains/programs/localstuff.te)
the avc messages _still don't go away_.

i watched the make policy, it read the newly created file
(localstuff.te) and the stuff is in policy.conf.

what am i doing wrong?

l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.