From: Stephen Smalley <sds@tycho.nsa.gov>
To: Laurent Bigonville <bigon@debian.org>
Cc: Paul Moore <paul@paul-moore.com>, Selinux@tycho.nsa.gov
Subject: Re: (Userspace) AVC denial generated even if allowed by the policy?
Date: Mon, 23 Nov 2015 15:31:48 -0500 [thread overview]
Message-ID: <565377B4.9060303@tycho.nsa.gov> (raw)
In-Reply-To: <565363AF.9030607@debian.org>
On 11/23/2015 02:06 PM, Laurent Bigonville wrote:
> Le 23/11/15 19:44, Stephen Smalley a écrit :
>> On 11/23/2015 12:25 PM, Laurent Bigonville wrote:
>>> As you can see the results are different... So this seems to be
>>> regression at the kernel level.
>>
>> Well, that depends - are you loading the same policy into both? What
>> do you have in /etc/selinux/targeted/policy? A policy.29 and a
>> policy.30? What does your libsepol/checkpolicy support?
>>
>> Or, alternatively, are you toggling cron_userdomain_transition and
>> thereby changing the result?
>
> It's the same policy loaded, for both kernel version (I'm just choosing
> an other kernel in grub), I only have one policy file.
>
> # ls /etc/selinux/refpolicy/policy/
> policy.29
>
> I've the latest released userspace (2.4), policydb.h shows max version
> being 29.
>
> The policyvers utility shows: 30 with 4.3 and 29 with 4.2
You are correct - this is a kernel bug. Hidden on Fedora because these
rules are unconditional there...
prev parent reply other threads:[~2015-11-23 20:31 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-11-23 0:53 (Userspace) AVC denial generated even if allowed by the policy? Laurent Bigonville
2015-11-23 8:08 ` Dominick Grift
2015-11-23 9:43 ` Laurent Bigonville
2015-11-23 15:34 ` Laurent Bigonville
2015-11-23 15:36 ` Laurent Bigonville
2015-11-23 16:21 ` Stephen Smalley
2015-11-23 17:25 ` Laurent Bigonville
2015-11-23 18:44 ` Stephen Smalley
2015-11-23 19:06 ` Laurent Bigonville
2015-11-23 20:31 ` Stephen Smalley [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=565377B4.9060303@tycho.nsa.gov \
--to=sds@tycho.nsa.gov \
--cc=Selinux@tycho.nsa.gov \
--cc=bigon@debian.org \
--cc=paul@paul-moore.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.