From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from jazzswing.ncsc.mil (jazzswing.ncsc.mil [144.51.68.65]) by tycho.ncsc.mil (8.12.8/8.12.8) with ESMTP id i3AErWRb000691 for ; Sat, 10 Apr 2004 10:53:33 -0400 (EDT) Received: from jazzswing.ncsc.mil (localhost [127.0.0.1]) by jazzswing.ncsc.mil with ESMTP id i3AEpVUZ016400 for ; Sat, 10 Apr 2004 14:51:31 GMT Received: from omta10.mta.everyone.net (sitemail2.everyone.net [216.200.145.36]) by jazzswing.ncsc.mil with ESMTP id i3AEpVmT016397 for ; Sat, 10 Apr 2004 14:51:31 GMT Date: Sat, 10 Apr 2004 22:53:17 +0800 Subject: Re: booting in enforcing mode Message-ID: MIME-Version: 1.0 (Generated by Pantomime 1.1.2) From: Rogelio Serrano To: russell@coker.com.au Cc: selinux@tycho.nsa.gov In-Reply-To: <200404110022.59557.russell@coker.com.au> Content-Type: text/plain; charset="us-ascii"; format="flowed" Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov On 2004-04-10 22:22:59 +0800 Russell Coker wrote: > On Sat, 10 Apr 2004 17:10, Rogelio Serrano > wrote: >> I can boot in enforcing mode now but there seem to be too many >> denials in my log. Which denials can be considered harmless? i >> can see a lot of ioctl, sys_tty_config and getattr. > > Show us a sample of the messages. > > When determining whether the denials are harmless it's usually > a matter of > the scontext and tcontext. > > As for sys_tty_config, in the transition to kernel 2.6.x the > handling of this > changed and lots of applications need it. I've considered > having the > daemon_base_domain() macro allow or dontaudit it. Most > applications that > request it don't seem to really need it (they work fine > without it). > I see. I think i have to remove some of those that i added. the hotplug scripts are the noisiest. i will fix /bin/login first. its the login fom util-linux 2.12 and im not using PAM. i need to label the tty properly. i can login but not into /User/Admin. login drops me into / then i can just "cd" and im in sysadm_home_dir. all home directories are in /Users and admins home dir is /Users/Admin alongside the other users. The context for /Users is system_u:object_r:file_t. Is that ok? Shouldnt it be root_t? Or should i create a totally new type. -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.