Re: More patches

[Daniel J Walsh <dwalsh@redhat.com>]

Ivan Gyurdiev wrote:

>> allow hald_t bin_t:file getattr;
>>-allow hald_t self:netlink_socket create_socket_perms;
>> allow hald_t self:netlink_kobject_uevent_socket create_socket_perms;
>> allow hald_t self:netlink_route_socket r_netlink_socket_perms;
>> allow hald_t self:capability { net_admin sys_admin dac_override dac_read_search mknod };
>>    
>>
>
>Now I get one of these...
>
>audit(1112809767.410:0): avc:  denied  { create } for  pid=7363
>exe=/usr/sbin/hald scontext=root:system_r:hald_t
>tcontext=root:system_r:hald_t tclass=netlink_socket
>
>...and the console is flooded with those:
>
>audit(1112809741.307:0): avc:  denied  { read } for  pid=2525
>exe=/usr/sbin/hald scontext=system_u:system_r:hald_t
>tcontext=system_u:system_r:hald_t tclass=netlink_socket
>
>Was this removed because of the kobject_uevent rule below it?
>I can't remember if that rule was there to begin with, or if it 
>was put in to address what I was debugging w/ Protocol 15 (?) being
>denied. 
>
>  
>
My understanding was that

 netlink_kobject_uevent_socket was added so that we would not need the netlink_socket rule.

Either I am wrong or you might need an updated kernel.

Dan

-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.