constraint violation problem

[Dominick Grift]

On Sun, 2013-05-19 at 14:15 +0300, Thorsten Scherf wrote:
> Following setup:
> 
> iucv instance is started via upstart to make iucv connections available
> in a z/VM environment:
> 
> # cat /etc/init/iucv.conf 
> start on runlevel [2345]
> stop on runlevel [01]
> respawn
> exec /usr/bin/iucvtty lnxterm
> 
> iucvtty is running in init_t:
> 
> # ps -efZ|grep iucv
> system_u:system_r:init_t:s0     root      1788     1  0 13:56 ? 00:00:00 /usr/bin/iucvtty lnxterm
> 
> Using ts-shell to connect from a central server to this system produces
> the following AVC:
> 
> type=AVC msg=audit(1368960989.210:22183): avc:  denied  { transition }
> for  pid=1761 comm="login" path="/bin/bash" dev=dasda3 ino=379
> scontext=system_u:system_r:local_login_t:s0
> tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> tclass=process
> type=SYSCALL msg=audit(1368960989.210:22183): arch=80000016 syscall=11
> per=400000 success=yes exit=11 a0=b6070570 a1=3fffffbd920 a2=b6083870
> a3=4a42fac3a0 items=0 ppid=1756 pid=1761 auid=500 uid=500 gid=500
> euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=3
> comm="bash" exe="/bin/bash"
> subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
> 
> This is the output from audit2allow:
> 
> #!!!! This avc is a constraint violation.  You will need to add an
> attribute to either the source or target type to make it work.
> #Contraint rule: 
> allow local_login_t unconfined_t:process transition;
> 
> What is the recommended way to avoid this AVC?
> 

i think this is a mcs constraint issue:

cat > mytest.te <<EOF
policy_module(mytest, 1.0.0)
gen_require(` type local_login_t; ')
mcs_process_set_categories(local_login_t)
EOF

make -f /usr/share/selinux/devel/Makefile mytest.pp
sudo semodule -i mytest.pp


> Cheers,
> Thorsten
> 
> --
> selinux mailing list
> selinux at lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux