<br><font size=2><tt>>On Thu, 2005-08-11 at 13:47 +0800, Richard Pannell
wrote:<br>
>> <br>
>> I am having problems running squid authentication (ntlm_auth)
in FC4<br>
>> with selinux turned on. When I use setenforce 0 I have no problems.<br>
>> But with setenforce set to 1 it fails. So using "audit2allow
-l<br>
>> -i /var/log/message" I got the following result<br>
>> <br>
>> allow auditd_t initrc_t:unix_dgram_socket sendto;<br>
>> allow klogd_t device_t:sock_file write;<br>
>> allow klogd_t initrc_t:unix_dgram_socket sendto;<br>
>> allow rpcd_t etc_runtime_t:file read;<br>
>> allow rpcd_t proc_t:file read;<br>
>> allow rpcd_t samba_etc_t:dir search;<br>
>> allow rpcd_t samba_var_t:dir { getattr search };<br>
>> allow syslogd_t etc_runtime_t:file read;<br>
>> allow syslogd_t proc_t:file read; <br>
>> <br>
>> which I added<br>
>> to /etc/selinux/targeted/src/policy/domains/misc/local.te and
ran <br>
>> <br>
>> make -C /etc/selinux/targeted/src/policy clean<br>
>> make -C /etc/selinux/targeted/src/policy load <br>
><br>
>Do you get the same output from audit2allow after doing this?</tt></font>
<br><font size=2><tt>Yes I am.<br>
><br>
>Are you running auditd? If so, you should be looking<br>
>in /var/log/audit/audit.log rather than /var/log/messages for AVC<br>
>errors.</tt></font>
<br><font size=2><tt>Yes I am. So it was showing.</tt></font>
<br>
<br><font size=2><tt>allow apmd_t device_t:sock_file write;</tt></font>
<br><font size=2><tt>allow apmd_t devpts_t:chr_file { getattr ioctl };</tt></font>
<br><font size=2><tt>allow apmd_t devpts_t:dir search;</tt></font>
<br><font size=2><tt>allow apmd_t initrc_t:unix_dgram_socket sendto;</tt></font>
<br><font size=2><tt>allow apmd_t selinux_config_t:file read;</tt></font>
<br><font size=2><tt>allow auditd_t device_t:sock_file write;</tt></font>
<br><font size=2><tt>allow bluetooth_t device_t:sock_file write;</tt></font>
<br><font size=2><tt>allow httpd_t winbind_var_run_t:dir getattr;</tt></font>
<br><font size=2><tt>allow ntpd_t device_t:sock_file write;</tt></font>
<br><font size=2><tt>allow ntpd_t initrc_t:unix_dgram_socket sendto;</tt></font>
<br><font size=2><tt>allow system_dbusd_t device_t:sock_file write;</tt></font>
<br><font size=2><tt>allow system_dbusd_t initrc_t:unix_dgram_socket sendto;</tt></font>
<br><font size=2><tt>allow system_dbusd_t winbind_var_run_t:dir getattr;</tt></font>
<br><font size=2><tt>allow updfstab_t device_t:sock_file write;</tt></font>
<br><font size=2><tt>allow winbind_helper_t initrc_t:unix_stream_socket
connectto;</tt></font>
<br><font size=2><tt>allow winbind_helper_t samba_var_t:dir search;</tt></font>
<br>
<br><font size=2><tt>Added this to the local.te file which worked thanks
very much.<br>
><br>
>Paul.</tt></font>