Hi Dan,
We added the domain_obj_id_change_exemption(pwrecoveryd_t) to our src
module but no luck.
And also our app does not do a setfscreatecon() call however from the
syslogs we found
Calls to setfscreate() by our app.
Is there a way to look at the constraints on a RHEL5 box using seinfo.
As indicated earlier in the email thread , the seinfo command on RHEL5
does not have the
"--constrain" option.
Thanks,
Anamitra
On 5/21/13 8:36 AM, "Anamitra Dutta Majumdar (anmajumd)"
<anmajumd(a)cisco.com> wrote:
Hi Dan,
Thanks for the pointer . Will give this a try.
-Anamitra
On 5/21/13 6:07 AM, "Daniel J Walsh" <dwalsh(a)redhat.com> wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>
>> 2. The AVC denial is type=AVC msg=audit(1369081665.408:8113): avc:
>>denied
>> { create } for pid=18379 comm="usermod" name="passwd+"
>> scontext=specialuser_u:system_r:pwrecoveryd_t:s0
>> tcontext=system_u:object_r:etc_t:s0 tclass=file
>
>The avc shows a process running as SELinux user is attempting to create a
>file
>labeled system_u:object_r:etc_t:s0. Since you are changing the SELinux
>user
>component you get an AVC. Does your app do a setfscreatecon() call?
>
>domain_obj_id_change_exemption(pwrecoveryd_t) is probably what you need.
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.4.13 (GNU/Linux)
>Comment: Using GnuPG with Thunderbird -
http://www.enigmail.net/
>
>iEYEARECAAYFAlGbcZkACgkQrlYvE4MpobMVegCfVG3yKECgQriAUxY8mxAA85cJ
>cP8AnisdaxW1NcIvuwMzRp65r+/KiEeV
>=R7ik
>-----END PGP SIGNATURE-----
--
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux