Aleksey Nogin wrote:
If I install the kernel-source package and build a custom kernel,
then
at "make install" I see:
rm: ??????? ??????? ??????????: Permission denied
rm: ??????? ??????? ??????????: Permission denied
rm: remove.c:378: AD_pop_and_chdir: Assertion `AD_stack_height (ds)'
failed.
/sbin/mkinitrd: line 678: 11649 Aborted rm -rf $MNTIMAGE
$MNTPOINT $IMAGE
grubby: error moving /boot/grub/grub.conf- to /boot/grub/grub.conf:
Permission denied
And I see a huge number of AVC messages. Some of them are obviously a
bug (the grub.conf- should be created as bootloader_t, not as etc_t),
and for others I am not sure what would be the right thing to do.
audit(1081938574.814:0): avc: denied { search } for pid=11483
exe=/bin/bash name=src dev=hda2 ino=4627617
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938574.816:0): avc: denied { search } for pid=11484
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
In certain cases it is helpful to just run these avc messages through
audit2allow
All these messages basically came down to a couple of rules that have
been added
to the laste policy.
A couple of tricks you might want to try
audit2allow -l -i /var/log/messages
Will output all rules for messages since the last time you ran a make load.
You can then take the output from this command and output it do the misc
subdirectory under policy
audit2allow -l -i /var/log/messages >
/etc/security/selinux/src/policy/domain/misc/later.te
Then do a make load to see if the policy compiles. If it does see if
this fixes you problem.
You have written your first policy.
In alot of cases the rules that are generated by audit2allow will be
disallowed do to the assert.te and
constraints.te. For example you will not be allowed to write files in
the /etc/ directory. You should
look at how other programs handle this, usually though
file_type_domain_trans.
Dan