From: Eamon Walsh <ewalsh@tycho.nsa.gov>
To: "Christopher J. PeBenito" <cpebenito@tresys.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>,
SELinux List <selinux@tycho.nsa.gov>
Subject: Xorg modprobe denials
Date: Mon, 17 Dec 2007 22:14:26 -0500 [thread overview]
Message-ID: <47673B12.6040205@tycho.nsa.gov> (raw)
[-- Attachment #1: Type: text/plain, Size: 521 bytes --]
Attached are some denials that modprobe is encountering while loading
Xorg DRI kernel modules while X server is starting up. tty7 is the
terminal where the X server is being launched (Ctrl-Alt-F7). I'm aware
that the Xorg.0.log file is supposed to be labeled xserver_log_t, but my
guess is that would be denied as well. Think this may be log messages
except for the renicing stuff.
This is xselinux branch of refpolicy running in enforcing mode.
--
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency
[-- Attachment #2: audit_x.txt --]
[-- Type: text/plain, Size: 1794 bytes --]
Dec 17 21:25:34 moss-charon kernel: audit(1197944734.892:71): avc: denied { read write } for pid=2220 comm="modprobe" name="tty7" dev=tmpfs ino=240 scontext=system_u:system_r:insmod_t:s0-s0:c0.c255 tcontext=system_u:object_r:tty_device_t:s0 tclass=chr_file
Dec 17 21:25:34 moss-charon kernel: audit(1197944734.893:72): avc: denied { write } for pid=2220 comm="modprobe" path="/usr/local/var/log/Xorg.0.log" dev=dm-0 ino=5701638 scontext=system_u:system_r:insmod_t:s0-s0:c0.c255 tcontext=system_u:object_r:usr_t:s0 tclass=file
Dec 17 21:25:34 moss-charon kernel: audit(1197944734.893:73): avc: denied { read write } for pid=2220 comm="modprobe" path="/dev/tty7" dev=tmpfs ino=240 scontext=system_u:system_r:insmod_t:s0-s0:c0.c255 tcontext=system_u:object_r:tty_device_t:s0 tclass=chr_file
Dec 17 21:25:34 moss-charon kernel: audit(1197944734.926:74): avc: denied { sys_nice } for pid=2220 comm="modprobe" capability=23 scontext=system_u:system_r:insmod_t:s0-s0:c0.c255 tcontext=system_u:system_r:insmod_t:s0-s0:c0.c255 tclass=capability
Dec 17 21:25:34 moss-charon kernel: [drm] Initialized drm 1.1.0 20060810
Dec 17 21:25:34 moss-charon kernel: audit(1197944734.932:75): avc: denied { sys_nice } for pid=2220 comm="modprobe" capability=23 scontext=system_u:system_r:insmod_t:s0-s0:c0.c255 tcontext=system_u:system_r:insmod_t:s0-s0:c0.c255 tclass=capability
Dec 17 21:25:34 moss-charon kernel: ACPI: PCI Interrupt 0000:00:02.0[A] -> GSI 16 (level, low) -> IRQ 16
Dec 17 21:25:34 moss-charon kernel: [drm] Initialized i915 1.11.0 20071122 on minor 0
Dec 17 21:25:34 moss-charon kernel: mtrr: type mismatch for c0000000,10000000 old: write-back new: write-combining
Dec 17 21:25:40 moss-charon kernel: mtrr: type mismatch for c0000000,10000000 old: write-back new: write-combining
next reply other threads:[~2007-12-18 3:14 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-12-18 3:14 Eamon Walsh [this message]
2007-12-18 3:47 ` Xorg modprobe denials Chris PeBenito
2007-12-18 13:34 ` Stephen Smalley
2007-12-18 13:57 ` Stephen Smalley
2007-12-19 21:11 ` Martin Orr
2008-01-03 15:30 ` Christopher J. PeBenito
2008-01-03 17:25 ` Martin Orr
2008-05-22 12:29 ` refpolicy: syscall init_module needs sys_nice & setsched Václav Ovsík
2008-05-22 18:29 ` Christopher J. PeBenito
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=47673B12.6040205@tycho.nsa.gov \
--to=ewalsh@tycho.nsa.gov \
--cc=cpebenito@tresys.com \
--cc=sds@tycho.nsa.gov \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.