Re: AVC: IPv6 problems

[Paul Moore <paul.moore@hp.com>]

On Thursday, May 24 2007 1:04:09 am Stefan Schulze Frielinghaus wrote:
> On 23.05.2007, at 15:27, Paul Moore wrote:
> > On Wednesday, May 23 2007 8:21:27 am Stefan Schulze Frielinghaus
> >
> > wrote:
> >> On 22.05.2007, at 21:24, Paul Moore wrote:
> >>> On Tuesday, May 22 2007 2:22:09 pm Stefan Schulze Frielinghaus
> >>>
> >>> wrote:
> >>>> periodically I receive the following AVC denial:
> >>>>
> >>>> audit(1179815459.477:213): avc:  denied  { rawip_send } for
> >>>> saddr=fe80:0000:0000:0000:0211:d8ff:feea:XXXX
> >>>> daddr=fe80:0000:0000:0000:0211:24ff:fee1:YYYY netif=eth0
> >>>> scontext=system_u:system_r:kernel_t:s15:c0.c255
> >>>> tcontext=system_u:object_r:link_local_node_t:s0 tclass=node
> >>>
> >>> It's hard to say what the solution is because it most likely
> >>> depends on what
> >>> you are trying to do.  You might want to share your goals with the
> >>> list and
> >>> perhaps we can help, otherwise I would recommend you look at the MLS
> >>> reference policy interfaces.

Assuming you are not trying to enforce MLS access controls across the network 
using link_local_node_t you could always make it a trusted object:

 # this interface is defined in the mls.if file in reference policy
 mls_trusted_object(link_local_node_t)

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.