Re: More fixes for nscd in targeted policy

[Russell Coker <russell@coker.com.au>]

On Thu, 16 Sep 2004 00:09, Daniel J Walsh <dwalsh@redhat.com> wrote:
> >>+#
> >>+# Handle winbind for samba, Might only be needed for targeted policy
> >>+#
> >>+dontaudit nscd_t var_run_t:sock_file rw_file_perms;
> >
> >This doesn't make sense; nscd_t has these permissions as a consequence
> >of having nscd_client_domain attribute in the policy (since it is used
> >for both the client and the daemon).
>
> I don't believ nscd_t has access to var_run_t.  It can do this to
> nscd_var_run_t.   It is
> trying to communicate with a socket created by winbind.

Any reference to var_run_t:sock_file should have ifdef(`targetted' around it.

In strict policy there will be no var_run_t:sock_file.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.