selinux December 2011

selinux@lists.fedoraproject.org

15 participants
14 discussions

[sandbox] modifying the Xephyr window title (patch)
by Christoph A. 25 Jun '12

25 Jun '12

Hi, If most of your windows are sandboxed applications, your bar looks like: [Sandbox sandbo..] [Sandbox sandbo..] [Sandbox sandbo..] and it is hard to find a specific application. example of a current Xephyr title: Sandbox sandbox_web_t:s0:c112,c991 -- /usr/bin/firefox with the modification in the attached patch titles will look like: /usr/bin/firefox (sandbox_web_t) and it should be easier to find a specific application. In addition to the type I would find it handy to also include the DISPLAY in the title (needed when using xsel for copy'n paste). The second patch only adds '-nolisten tcp' to Xephyr, but if there are use cases where one needs Xephyr to open a listener this patch will break thinks. regards, Christoph A. btw: secon's manpage doesn't contain the '-l' option.

2 10

Policy for CouchDB
by Michael Milverton 17 Mar '12

17 Mar '12

Hi, I'm in the process of writing a policy for couchdb (nosql database). I'm using the selinux-polgengui and eclipse slide tools to help. I've hit a road block because it won't start but I'm not getting any more AVC's. I'm wondering if anybody might be able to offer some clue about getting more AVC's from it because if it won't talk to me I can't get much further. The only entries in audit.log are: type=CRED_ACQ msg=audit(1309362790.614:1343): user pid=11935 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="couchdb" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success' type=USER_START msg=audit(1309362790.619:1344): user pid=11935 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="couchdb" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success' type=USER_END msg=audit(1309362790.640:1345): user pid=11935 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="couchdb" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success' type=CRED_DISP msg=audit(1309362790.641:1346): user pid=11935 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="couchdb" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success' type=SERVICE_START msg=audit(1309362790.676:1347): user pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="couchdb" exe=2F62696E2F73797374656D64202864656C6574656429 hostname=? addr=? terminal=? res=failed' Now, it will start fine (and run) when it is unlabeled (not what I want of course). Couchdb runs under the username/group couchdb but I haven't added any transition rules for this yet (any help on this would be appreciated). FC FILE: /usr/bin/couchdb -- gen_context(system_u:object_r:couchdb_exec_t,s0) /usr/bin/couchjs -- gen_context(system_u:object_r:couchdb_exec_t,s0) TE FILE: policy_module(couchdb,1.0.0) require { type bin_t; type fs_t; type proc_t; } type couchdb_t; domain_type(couchdb_t) permissive couchdb_t; # Access to shared libraries libs_use_ld_so(couchdb_t) libs_use_shared_libs(couchdb_t) miscfiles_read_localization(couchdb_t) dev_read_urand(couchdb_t) # Type for the daemon type couchdb_exec_t; files_type(couchdb_exec_t) domain_entry_file(couchdb_t, couchdb_exec_t) init_daemon_domain(couchdb_t, couchdb_exec_t) # Logging logging_send_syslog_msg(couchdb_t) logging_log_file(couchdb_t) # Temp files type couchdb_tmp_t; files_tmp_file(couchdb_tmp_t) manage_dirs_pattern(couchdb_t, couchdb_tmp_t, couchdb_tmp_t) manage_files_pattern(couchdb_t, couchdb_tmp_t, couchdb_tmp_t) files_tmp_filetrans(couchdb_t, couchdb_tmp_t, { dir file }) #type couchdb_config_t; files_read_etc_files(couchdb_t) # /bin/basename and some others allow couchdb_t bin_t:file { read getattr open execute execute_no_trans }; allow couchdb_t fs_t:filesystem getattr; allow couchdb_t proc_t:file { read getattr open }; allow couchdb_t self:fifo_file { read write getattr }; # Not sure about this auth_domtrans_chk_passwd(couchdb_t) # Not sure about this either. domain_use_interactive_fds(couchdb_t) Any clues, tips, advice would be most appreciated Thanks

5 20

selinux denial not appearing in logs
by Edward Harvey 02 Jan '12

02 Jan '12

How can this happen? It's getting denied, but not appearing in either the audit log or the messages file. Running Centos 6 fully updated, php (drupal) inside of httpd tries to send mail via postfix (postdrop). When I have setenforce 0, the mail goes through. No errors in any logs (audit.log, error_log, messages) When I have setenforce 1, the mail gets blocked. I get this message in httpd error_log: sendmail: fatal: execvp /usr/sbin/postdrop: Permission denied sendmail: warning: command "/usr/sbin/postdrop -r" exited with status 1 sendmail: fatal: email(a)example.com(48): unable to execute /usr/sbin/postdrop -r: Success I have auditd running. In fact, I regularly use audit2allow to create allow policies on this machine. So I can confidently say normally my selinux denials get logged in the audit.log. I am at a loss to think of any reason this particular failure is not getting logged the same way my other error messages usually get logged. I believe I can write a custom allow script by hand, but I believe I probably shouldn't, or if I try, it will fail for some reason. Thanks for your help...

4 5

selinux denial not appearing in logs
by Edward Harvey 28 Dec '11

28 Dec '11

1 0

NetworkManager / OpenVPN Certificates
by Jeroen van Meeuwen 28 Dec '11

28 Dec '11

Hi there, I wanted to ask what the proper location is to store client OpenVPN certificates, if any exists. With SELinux enforcing the targeted policy, the following occurs on attempting to connect to a VPN: type=AVC msg=audit(1324632910.570:383): avc: denied { read } for pid=4098 comm="openvpn" name="vanmeeuwen.crt" dev=dm-3 ino=3933169 scontext=system_u:system_r:openvpn_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=SYSCALL msg=audit(1324632910.570:383): arch=c000003e syscall=2 success=no exit=-13 a0=7fff58e16ec9 a1=0 a2=1b6 a3=238 items=0 ppid=4095 pid=4098 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="openvpn" exe="/usr/sbin/openvpn" subj=system_u:system_r:openvpn_t:s0 key=(null) When I setenforce 0, the following happens: type=MAC_STATUS msg=audit(1324633028.994:384): enforcing=0 old_enforcing=1 auid=1000 ses=2 type=SYSCALL msg=audit(1324633028.994:384): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fffda4ea5f0 a2=1 a3=0 items=0 ppid=4032 pid=4145 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=2 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1324633034.039:385): avc: denied { read } for pid=4149 comm="openvpn" name="vanmeeuwen.crt" dev=dm-3 ino=3933169 scontext=system_u:system_r:openvpn_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1324633034.039:385): avc: denied { open } for pid=4149 comm="openvpn" name="vanmeeuwen.crt" dev=dm-3 ino=3933169 scontext=system_u:system_r:openvpn_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=SYSCALL msg=audit(1324633034.039:385): arch=c000003e syscall=2 success=yes exit=5 a0=7fff96303ec9 a1=0 a2=1b6 a3=238 items=0 ppid=4146 pid=4149 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="openvpn" exe="/usr/sbin/openvpn" subj=system_u:system_r:openvpn_t:s0 key=(null) For the vanmeeuwen.crt client certificate, there's also a vanmeeuwen.key and a ca.crt, BTW, but the latter two never trigger an audit trail (though have the same selinux context). I have stored the certificates in a directory tree in ~/.openvpn, with one directory per VPN connection, BTW, for which I recognize there is no separate custom context definition in /etc/selinux/targeted/contexts/files/. Kind regards, Jeroen van Meeuwen -- Senior Engineer, Kolab Systems AG e: vanmeeuwen at kolabsys.com t: +44 144 340 9500 m: +44 74 2516 3817 w: http://www.kolabsys.com pgp: 9342 BF08

3 3

Custom SNMP scripts
by Frederick William New 20 Dec '11

20 Dec '11

Hi, Is there recommended way of setting up custom SNMP (net-snmp) scripts used for monitoring the status of software or hardware RAID, Web site hits, etc.? I created a special directory for them - /usr/local/snmp/bin/, and then let sealert and audit2allow tell me what to do. My snmpScripts.te on a server with software RAID looks like this: module snmpScripts 1.0; require { type snmpd_t; type proc_mdstat_t; type usr_t; class file { ioctl execute read open getattr execute_no_trans }; } #============= snmpd_t ============== Is there a better or more secure way of doing this? Fred New Systems administrator Elion Ettevõtted AS Tallinn, Estonia

2 2

procmail prevented from delivering mail
by Lester M Petrie 15 Dec '11

15 Dec '11

Hi When I try to have procmail deliver my email, I get the following avc messages: type=AVC msg=audit(1323699624.572:2022): avc: denied { write } for pid=18801 comm="procmail" name="local-mail" dev=sdd10 ino=7471567 scontext=system_u:system_r:procmail_t:s0 tcontext=unconfined_u:object_r:data_home_t:s0 tclass=dir type=SYSCALL msg=audit(1323699624.572:2022): arch=c000003e syscall=2 success=no exit=-13 a0=cba680 a1=441 a2=1b7 a3=1 items=0 ppid=18799 pid=18801 auid=4294967295 uid=14060 gid=100 euid=14060 suid=14060 fsuid=14060 egid=100 sgid=100 fsgid=100 tty=(none) ses=4294967295 comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null) type=AVC msg=audit(1323699624.572:2023): avc: denied { write } for pid=18801 comm="procmail" name="inbox" dev=sdd10 ino=12714135 scontext=system_u:system_r:procmail_t:s0 tcontext=unconfined_u:object_r:data_home_t:s0 tclass=dir type=SYSCALL msg=audit(1323699624.572:2023): arch=c000003e syscall=2 success=no exit=-13 a0=cb7b50 a1=c1 a2=1b7 a3=65642d6e697373 items=0 ppid=18799 pid=18801 auid=4294967295 uid=14060 gid=100 euid=14060 suid=14060 fsuid=14060 egid=100 sgid=100 fsgid=100 tty=(none) ses=4294967295 comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null) I am running Fedora 15 with a KDE 4.7.4 desktop, and am using kmail2. When I try to create and install a local policy to allow this access, a .pp file is created, but installing fails with the following messages. libsepol.print_missing_requirements: procmail's global requirements were not met: type/attribute procmail_t (No such file or directory). libsemanage.semanage_link_sandbox: Link packages failed (No such file or directory). semodule: Failed! The .pp file is module procmail 1.0; require { type data_home_t; type procmail_t; class dir write; class file append; } #============= procmail_t ============== #!!!! The source type 'procmail_t' can write to a 'dir' of the following types: # user_home_t, var_log_t, procmail_log_t, user_home_dir_t, tmp_t, mail_spool_t, nfs_t allow procmail_t data_home_t:dir write; allow procmail_t data_home_t:file append; I can relabel the mail directory as user_home_t, and procmail works, but I haven't found how to make the relabel survive a general machine relabel. Any help would be appreciated. -- Lester M Petrie 865-574-5259 petrielmjr(a)ornl.gov

2 1

Looking for directory paths...
by Arthur Dent 13 Dec '11

13 Dec '11

Hello all, When I get a SEL alert it refers only to to the actual directory and not the full pathname. For example: SELinux is preventing /usr/sbin/smbd from create access on the directory 05. The advice for fixing this alert is probably useful but without knowing the full path is actually completely useless: If you want to allow smbd to have create access on the 05 directory Then you need to change the label on '05' Do # semanage fcontext -a -t samba_share_t '05' # restorecon -v '05' The problem is - I don't know where directory "05" is. It's probably some temporary cache file or some such and trying to even find its parent directory with a name like "05" makes using 'locate' or 'find' really quite hard work. In this case the alert(s) (there were several - each with a different numerical directory name) were actually caused when I tried to sync my iPhone using iTunes installed on a Windows XP virtual machine running under VirtualBox on this Fedora 16 host, accessing the music library via a Samba share on a separate partition on the Fedora 16 box.... Yeah... I know.... But anyway - if I could find the full path of the directory in question I *might* be able to take a closer look at where the problem lies... Thanks in advance for any help or suggestions. Mark

5 8

RE: Looking for directory paths...
by Arthur Dent 12 Dec '11

12 Dec '11

>> From: Arthur Dent >> Sent: 11 December 2011 13:49 >> >> Hello all, >> >> When I get a SEL alert it refers only to to the actual directory and >> not the full pathname. For example: >> >> SELinux is preventing /usr/sbin/smbd from create access on the >> directory 05. >> >> The advice for fixing this alert is probably useful but without knowing >> the full path is actually completely useless: >> >> If you want to allow smbd to have create access on the 05 directory >> Then you need to change the label on '05' >> Do >> # semanage fcontext -a -t samba_share_t '05' >> # restorecon -v '05' >> >> The problem is - I don't know where directory "05" is. It's probably >> some temporary cache file or some such and trying to even find its >> parent directory with a name like "05" makes using 'locate' or 'find' >> really quite hard work. >> >> In this case the alert(s) (there were several - each with a different >> numerical directory name) were actually caused when I tried to sync my >> iPhone using iTunes installed on a Windows XP virtual machine running >> under VirtualBox on this Fedora 16 host, accessing the music library >> via a Samba share on a separate partition on the Fedora 16 box.... >> Yeah... I know.... >> >> But anyway - if I could find the full path of the directory in question >> I *might* be able to take a closer look at where the problem lies... >> >> Thanks in advance for any help or suggestions. >> >> Mark > > If you get the device and inode from the the AVC message you can use > find's -inum option to look for the inode number on the device's > filesystem rather than -name. > Ha! That looks useful. I can't try it at the moment because, although I can ssh into that machine from work - I can't reproduce the event from the command line. I will try as soon as I can... Thanks again... Mark

1 0

IPTables labeling and user roles
by Konstantin Ryabitsev 07 Dec '11

07 Dec '11

Hi, all: Here's an interesting idea I had. Let's say my users have two ways of logging in to the systems -- one via a VPN that requires 2-factor authentication, and another directly via ssh using their public key. Is there a way to use pam in conjunction with iptables packet labeling to make sure that if the users logged in via VPN, they get user_u, but if they went directly, they only get guest_u? Or, simiarly, if a sysadmin logs in via the VPN that required 2-factor authn, they get sysadm_u, and if directly, then just user_u? I think that would be kinda neat, but I'm not sure it Works That Way (TM). Best regards, -- Konstantin Ryabitsev Systems Administrator Linux Foundation, kernel.org Montréal, Québec

1 0

Long Boot times
by Arthur Dent 06 Dec '11

06 Dec '11

Hello all, I have just upgraded my F14 desktop system to F16 (fresh install with /home partition maintained from previous Fedora install and some config files copied across). Now about 50% of boot times are acceptable (sub 1 minute even with a 5s grub delay) and others take around 2 minutes with a rather alarming black screen for much of that time. I have no idea if this is caused by SEL, but when i look at dmesg for the "slow" boots it shows this at the very end: ===============8<==================================== [root@localhost ~]# dmesg [ snip ] [ 32.248789] e1000e 0000:00:19.0: em1: 10/100 speed: disabling TSO [ 32.248955] ADDRCONF(NETDEV_CHANGE): em1: link becomes ready [ 42.354015] em1: no IPv6 routers present [ 90.858903] SELinux: initialized (dev 0:21, type nfs4), uses genfs_contexts [ 90.863622] SELinux: initialized (dev 0:22, type nfs4), uses genfs_contexts [ 90.867429] SELinux: initialized (dev 0:23, type nfs4), uses genfs_contexts [ 90.868787] SELinux: initialized (dev 0:24, type nfs4), uses genfs_contexts [ 90.872920] SELinux: initialized (dev 0:22, type nfs4), uses genfs_contexts [ 90.877188] SELinux: initialized (dev 0:25, type nfs4), uses genfs_contexts [ 90.878883] mount[998]: mount.nfs: /mnt/NFSmark is busy or already mounted [ 90.887451] SELinux: initialized (dev 0:22, type nfs4), uses genfs_contexts [ 90.927896] SELinux: initialized (dev 0:21, type nfs4), uses genfs_contexts [ 90.932400] SELinux: initialized (dev 0:22, type nfs4), uses genfs_contexts [ 92.714872] [drm:drm_debugfs_create_files] *ERROR* Cannot create /sys/kernel/debug/dri/channel\xfffffff0i\xffffff80]\xffffffc0\x03/3 [ 95.940096] [drm:drm_debugfs_create_files] *ERROR* Cannot create /sys/kernel/debug/dri/channel\xffffffe9i\xffffff80]\xffffffc0\x03/3 [root@localhost ~]# ===============8<==================================== On the successful boots dmesg ends with the "no IPv6 routers present" line at around 44s. Is this even anything to do with SEL? Even if it isn't, can any of the gurus here suggest how to proceed towards fixing it? I originally thought that this was a NFS mounting problem and posted a thread in the Fedora Users list as can be seen here: http://lists.fedoraproject.org/pipermail/users/2011-December/409137.html but I now think that that was a red-herring. Thanks in advance for any help or suggestions... Mark

3 2

F16/proftpd/systemd
by Paul Howarth 05 Dec '11

05 Dec '11

I have these AVCs when logging in to proftpd on F16 using PAM/sssd with an LDAP backend: type=AVC msg=audit(1323102469.514:6174): avc: denied { search } for pid=30199 comm="systemd-logind" name="3503" dev=proc ino=80549480 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=dir type=AVC msg=audit(1323102469.514:6174): avc: denied { read } for pid=30199 comm="systemd-logind" name="sessionid" dev=proc ino=80550003 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=file type=AVC msg=audit(1323102469.514:6174): avc: denied { open } for pid=30199 comm="systemd-logind" name="sessionid" dev=proc ino=80550003 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=file type=SYSCALL msg=audit(1323102469.514:6174): arch=c000003e syscall=2 success=yes exit=11 a0=15d3f00 a1=80000 a2=1b6 a3=39 items=0 ppid=1 pid=30199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-logind" exe=2F6C69622F73797374656D642F73797374656D642D6C6F67696E64202864656C6574656429 subj=system_u:system_r:systemd_logind_t:s0 key=(null) type=AVC msg=audit(1323102469.515:6175): avc: denied { getattr } for pid=30199 comm="systemd-logind" path="/proc/3503/sessionid" dev=proc ino=80550003 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=file type=SYSCALL msg=audit(1323102469.515:6175): arch=c000003e syscall=5 success=yes exit=0 a0=b a1=7fffe3b39190 a2=7fffe3b39190 a3=39 items=0 ppid=1 pid=30199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-logind" exe=2F6C69622F73797374656D642F73797374656D642D6C6F67696E64202864656C6574656429 subj=system_u:system_r:systemd_logind_t:s0 key=(null) type=AVC msg=audit(1323102564.051:6184): avc: denied { search } for pid=30199 comm="systemd-logind" name="3630" dev=proc ino=80551904 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=dir type=AVC msg=audit(1323102564.051:6184): avc: denied { read } for pid=30199 comm="systemd-logind" name="sessionid" dev=proc ino=80551906 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=file type=AVC msg=audit(1323102564.051:6184): avc: denied { open } for pid=30199 comm="systemd-logind" name="sessionid" dev=proc ino=80551906 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=file type=SYSCALL msg=audit(1323102564.051:6184): arch=c000003e syscall=2 success=yes exit=11 a0=15d3fd0 a1=80000 a2=1b6 a3=39 items=0 ppid=1 pid=30199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-logind" exe=2F6C69622F73797374656D642F73797374656D642D6C6F67696E64202864656C6574656429 subj=system_u:system_r:systemd_logind_t:s0 key=(null) type=AVC msg=audit(1323102564.051:6185): avc: denied { getattr } for pid=30199 comm="systemd-logind" path="/proc/3630/sessionid" dev=proc ino=80551906 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=file type=SYSCALL msg=audit(1323102564.051:6185): arch=c000003e syscall=5 success=yes exit=0 a0=b a1=7fffe3b39190 a2=7fffe3b39190 a3=39 items=0 ppid=1 pid=30199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-logind" exe=2F6C69622F73797374656D642F73797374656D642D6C6F67696E64202864656C6574656429 subj=system_u:system_r:systemd_logind_t:s0 key=(null) audit2allow -R suggests: ftp_systemctl(systemd_logind_t) Does that look reasonable? I looked at the interface in git but the comment text appears to have been copy-and-pasted from another interface without being edited. Paul.

2 1

Boolean to permit guest_u access
by Konstantin Ryabitsev 01 Dec '11

01 Dec '11

Hi, all: I have the following in my .te file: optional_policy(` gen_require(` type guest_t; role guest_r; ') my_app_run(guest_t, guest_r) ') But really, I'd like to make it a boolean that an admin can toggle -- I'm not really keen on allowing guest_u to use this application by default. Something like: tunable_policy(`allow_guest_myapp_exec'); How would I combine tunable_policy with optional_policy? Best, -- Konstantin Ryabitsev Systems Administrator The Linux Foundation Montréal, Québec

3 2

SELinux policy for both Enterprise Linux 5 and 6
by Brian Ginn 01 Dec '11

01 Dec '11

I have SELinux policy that is compiled on Red Hat Enterprise Linux 5. This policy fails to install on Red Hat Enterprise Linux 6 with the following message: libsepol.print_missing_requirements: pbrun's global requirements were not met: type/attribute system_chkpwd_t (No such file or directory). Is there a way to write SELinux policy so that It can be compiled on v 5.x and will run on 6.x ? Thanks, Brian

3 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux December 2011