Re: list of permissions created by allow2audit: what do i do now?

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Wed, May 19, 2004 at 06:48:52AM +1000, Russell Coker wrote:
> On Wed, 19 May 2004 04:51, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> > > checkpolicy takes the union of all such allow rules, so you end up with
> > > both read and getattr.  You can check at runtime via compute_av.
> >
> >  ah ha.  man compute_av equals undocumented oops okay, let's see
> 
> I'll start work on man pages for that program and the others that go with it.  
> I think that help2man is the correct solution.
> 
> >  May 18 14:35:43 tv kernel: avc:  denied  { destroy } for  pid=1522
> >  exe=/usr/X11R6/bin/wdmLogin key=0 scontext=system_u:system_r:initrc_t
> >  tcontext=system_u:syste
> >  m_r:initrc_t tclass=shm
> >
> >  try:
> >
> > 	tv:/etc/selinux# compute_av system_u:system_r:xdm_xserver_t
> > 								system_u:system_r:initrc_t shm
> > 	allowed= null
> >
> >  uhn???
> 
> If you want to match the AVC message then try the following:
> compute_av system_u:system_r:initrc_t system_u:system_r:initrc_t shm

allowed= { create destroy read write unix_read unix_write }

> >  okay, let's try this:
> >
> > 	tv:/etc/selinux# compute_av lkcl:sysadm_r:sysadm_t
> >                             system_u:object_r:xserver_exec_t file
> >
> > 	allowed= { ioctl read write create getattr setattr lock relabelfrom
> > 	relabelto append unlink link rename execute execute_no_trans entrypoint
> > 	}
> >
> >  hm, so there is light, but what colour.
> >
> >  so lkcl as a sysadm can run the xserver, but the xserver being run
> >  from xdm as system, at initialisation time, is banned???
> 
> The tests you have done show that when sysadm_t runs xserver_exec_t it may be 
> an entrypoint into another domain, also that xdm_xserver_t has no access to 
> shared memory regions created by initrc_t.  Not that it matters as your real 
> problem seems to be having a wdm executable labeled with the wrong type such 
> that it doesn't transition into xdm_t when it is run from initrc_t.

 i don't pretend to understand everything yet in order to appreciate
 what you say, however i successfully built a debian selinux 2.6.6
 kernel (faked up a debian/rules etc in order to convince make-kpkg to run)
 and installed it on both the build and target system: suddenly
 things have got a lot better...


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.