From: mgrepl@redhat.com (Miroslav Grepl)
To: refpolicy@oss.tresys.com
Subject: [refpolicy] systemd slice systemd-logind : tclass=system perm=start
Date: Tue, 28 Jan 2014 11:05:05 +0100 [thread overview]
Message-ID: <52E780D1.5000706@redhat.com> (raw)
In-Reply-To: <52E264E7.6060405@altlinux.org>
On 01/24/2014 02:04 PM, Andrew V. Stepanov wrote:
> Hello.
>
> Could you help me?
>
> Let's see logs from FC20:
>
> [ 14.778999] systemd[1]: Got D-Bus request:
> org.freedesktop.systemd1.Manager.StartUnit() on /org/freedesktop/systemd1
> [ 14.781936] systemd[1]: SELinux access check
> scon=system_u:system_r:systemd_logind_t:s0
> tcon=system_u:system_r:init_t:s0 tclass=system perm=start path=(null)
> cmdline=(null): 0
> [ 14.781944] systemd[1]: Trying to enqueue job user-994.slice/start/fail
> [ 14.781970] systemd[1]: Installed new job user-994.slice/start as 424
> [ 14.781974] systemd[1]: Enqueued job user-994.slice/start as 424
> [ 14.782023] systemd[1]: Starting user-994.slice.
> [ 14.782189] systemd[1]: user-994.slice changed dead -> active
> [ 14.782194] systemd[1]: Job user-994.slice/start finished, result=done
> [ 14.782293] systemd[1]: Created slice user-994.slice.
>
> Please!!! Give me some idea why next rule is allowed:
>
> [ 14.781936] systemd[1]: SELinux access check
> scon=system_u:system_r:systemd_logind_t:s0
> tcon=system_u:system_r:init_t:s0 tclass=system perm=start path=(null)
> cmdline=(null): 0
>
> Please! Please! Please!
>
> class "system" doesn't have permission "start":
>
> [root at localhost ~]# seinfo -csystem -x
> system
> status
> module_request
> reboot
> disable
> enable
> undefined
> ipc_info
> syslog_read
> halt
> reload
> syslog_console
> syslog_mod
>
> # cat /etc/redhat-release
> Fedora release 20 (Heisenbug)
>
> Why does it return 0 ? (ALLOW) ?
>
> I am stucked with it in my distro. Because my distro denies this action.
>
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
There is a bug for this issue.
Regards,
Miroslav
prev parent reply other threads:[~2014-01-28 10:05 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <52E2642E.2080906@altlinux.org>
2014-01-24 13:04 ` [refpolicy] systemd slice systemd-logind : tclass=system perm=start Andrew V. Stepanov
2014-01-28 10:05 ` Miroslav Grepl [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=52E780D1.5000706@redhat.com \
--to=mgrepl@redhat.com \
--cc=refpolicy@oss.tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.