Problem: myscript, crontab and policy rules for this

[Tanel Kokk <tanel.kokk@eyp.ee>]

I have Fedora Core 2 with SElinux. I added a script into the crontab 
/etc/cron.d/myscript (it includes a line:
0 * * * *		/usr/local/bin/myscript > /dev/null 2>&1)

selinux logs following audit message:
avc:  denied  { transition } for  pid=17845 exe=/usr/sbin/crond 
path=/bin/bash dev=dm-0 ino=2850852 scontext=root:system_r:crond_t 
tcontext=user_u:sysadm_r:sysadm_t tclass=process

I use program audit2allow to generate correct rule to policy:
allow crond_t sysadm_t:process { transition };

I put it into the file domains/misc/local.te and 'make load'

Unfortunately it won't help because same audit log message will appear, 
when cron will try execute myscript.

What I have to do? Why audit2allow won't generate correct rules?

Tanel


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.