Running racoon from init_t?

[Paul Moore <paul.moore@hp.com>]

This is in regards to RHEL5 and the MLS policy.

I'm trying to run racoon at startup, from within the rc.local script, which 
means it is being run from init/init_t.  Whenever I try to do this I see the 
following AVC denials:

***
type=AVC msg=audit(1173457995.784:305): avc:  denied  { use } for  pid=2105 
comm="racoon" name="console" dev=tmpfs ino=725 
scontext=system_u:system_r:racoon_t:s0-s15:c0.c1023 
tcontext=system_u:system_r:init_t:s0-s15:c0.c1023 tclass=fd
type=AVC msg=audit(1173457995.784:305): avc:  denied  { use } for  pid=2105 
comm="racoon" name="console" dev=tmpfs ino=725 
scontext=system_u:system_r:racoon_t:s0-s15:c0.c1023 
tcontext=system_u:system_r:init_t:s0-s15:c0.c1023 tclass=fd
type=AVC msg=audit(1173457995.784:305): avc:  denied  { use } for  pid=2105 
comm="racoon" name="console" dev=tmpfs ino=725 
scontext=system_u:system_r:racoon_t:s0-s15:c0.c1023 
tcontext=system_u:system_r:init_t:s0-s15:c0.c1023 tclass=fd
***

I suspect this can fixed by adding the following to the policy, suggestions?

 init_use_fds(racoon_t)

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.