Re: list of permissions created by allow2audit: what do i do now?

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Tue, May 18, 2004 at 09:14:39AM -0400, Stephen Smalley wrote:
> On Tue, 2004-05-18 at 08:56, Luke Kenneth Casson Leighton wrote:
> > well i tried the bung-it-in-and-see approach, and i got a build error
> > due to some global policy violations at make policy time because
> > of this (and one other):
> > 
> > > allow hotplug_t etc_runtime_t:file { relabelfrom relabelto };
> > 
> > ... but what is even stranger is that even though i add in these
> > things into a new package (i called it domains/programs/localstuff.te)
> > the avc messages _still don't go away_.
> > 
> > i watched the make policy, it read the newly created file
> > (localstuff.te) and the stuff is in policy.conf.
> > 
> > what am i doing wrong?
> 
> Did you successfully perform a make load with the new policy?

 yes.

> To do that, you obviously would have to address the assertion failures;
> otherwise, checkpolicy won't compile policy.conf to a binary policy that
> can be loaded.

 yes, i did address the assertions by removing things from
 localstuff.te, in the hope that i can address them later or
 perhaps investigate them.

> Also, denials can occur for reasons other than missing TE allow rules,
> as noted in the Configuring the SELinux policy report, e.g.:
> - violation of a constraint from policy/constraints
> - type not authorized for role
> - role not authorized for user
> - role transition not authorized
 
 hm: this is system context (boot time), and i have a bog-standard
 debian / unstable install, so i don't believe i have done anything
 to cause, say XFree86 to continue to not play ball.

 i _have_ noticed that /var/lib/wdm/authfiles is accessed and have
 changed file_contexts/program/xserver.fc the line that mentions
 /var/lib(64)?/kdm to /var/lib(64)?/[kw]dm.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.