On 12/29/2009 01:52 PM, Klaus Lichtenwalder wrote:
Dominick,
Am Dienstag, den 29.12.2009, 13:02 +0100 schrieb Dominick Grift:
> Whoops i forgot some policy:
Ok, I was already wondering whether that could be it, trying to
understand :-)
>
> echo "policy_module(mygetty, 1.0.0)" > mygetty.te;
> echo "optional_policy(\`" >> mygetty.te;
> echo "gen_require(\`" >> mygetty.te;
> echo "type getty_t;" >> mygetty.te;
> echo "')" >> mygetty.te;
> echo "corecmd_exec_bin(getty_t)" >> mygetty.te;
> echo "corecmd_exec_shell(getty_t)" >> mygetty.te;
> echo "kernel_read_system_state(getty_t)" >> mygetty.te;
> echo "')" >> mygetty.te;
>
> make -f /usr/share/selinux/devel/Makefile mygetty.pp
> sudo semodule -i mygetty.pp
>
> As for system_mail_t:
>
> echo "policy_module(mymail, 1.0.0)" > mymail.te;
> echo "optional_policy(\`" >> mymail.te;
> echo "gen_require(\`" >> mymail.te;
> echo "type system_mail_t;" >> mymail.te;
> echo "')" >> mymail.te;
> echo "term_use_unallocated_ttys(system_mail_t)" >> mymail.te;
> echo "')" >> mymail.te;
>
> make -f /usr/share/selinux/devel/Makefile mymail.pp
> sudo semodule -i mymail.pp
>
> That should help.
This helps a lot, as fax receiving (and notifying) works without AVC
denials showing up. No I'm off trying to understand everything. With all
those makros, one get's a lot done with little code :-)
Well there was already policy for getty present but it seems to not be
sufficient for your configuration (or it may signal misconfiguration on
your part)
With regard to system_mail_t this is likely due to a bug. (known bug)
Where the tty device does not get properly labeled. My fix makes it work
but it is not a good fix ( user tty devices need to get labeled properly)
If you are certain that you are using getty properly then consider
reporting the AVC denials and my policy for getty_t to
bugzilla/selinux-policy so that getties policy can be extended to
support your configuration.
Thanks again
Klaus
--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list