Re: type class key

[Daniel J Walsh <dwalsh@redhat.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stefan Schulze Frielinghaus wrote:
> Every time I log into my system via ssh an audit is generated:
> 
> audit(1194529539.754:7803673): avc:  denied  { link } for  pid=9526
> comm="sshd" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:dovecot_t:s0 tclass=key
> 
> and after logout the following:
> 
> audit(1194529580.969:7803674): avc:  denied  { search } for  pid=9526
> comm="sshd" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:dovecot_t:s0 tclass=key
> 
> Quite frankly I even do not know what a type class "key" is. Can someone
> explain to me what a type class "key" is? And maybe any suggestions why
> ssh tries to access dovecot's key (which is an imap server).
> 
> cheers,
> Stefan
> 
> PS: I'm running CentOS 5 with the latest updates and strict policy.
> 
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
key is the SELinux mapping of the kernel keyring.  No app currently uses
the kernel keyring, to the best of my knowledge.  And the pam
configurations up to now are setup incorrectly.

When any confined app runs it gets handed a keyring and does a search
access on the app that created the key ring.

The avc's you are reporting above are very strange.  They look like
dovecot created a keyring, probably though pam_keyinit.  And now sshd is
trying to access it.  I think you are running in permissive mode and
your context is messed up.

When you login are you getting user_t or staff_t?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFHM20yrlYvE4MpobMRAoY/AJ43FAim2WQEt1yrpHMsWMjKnpJoWQCfSemn
ihtmBI+3TyCb09sQIX+ssnU=
=/Ad8
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.