A lot of AVC messages running "make install" from the kernel source dir.

[Aleksey Nogin]

If I install the kernel-source package and build a custom kernel, then
at "make install" I see:

rm: ??????? ??????? ??????????: Permission denied
rm: ??????? ??????? ??????????: Permission denied
rm: remove.c:378: AD_pop_and_chdir: Assertion `AD_stack_height (ds)' failed.
/sbin/mkinitrd: line 678: 11649 Aborted                 rm -rf $MNTIMAGE
$MNTPOINT $IMAGE
grubby: error moving /boot/grub/grub.conf- to /boot/grub/grub.conf:
Permission denied

And I see a huge number of AVC messages. Some of them are obviously a
bug (the grub.conf- should be created as bootloader_t, not as etc_t),
and for others I am not sure what would be the right thing to do.

audit(1081938574.814:0): avc:  denied  { search } for  pid=11483
exe=/bin/bash name=src dev=hda2 ino=4627617
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938574.816:0): avc:  denied  { search } for  pid=11484
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938575.176:0): avc:  denied  { search } for  pid=11487
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938575.397:0): avc:  denied  { search } for  pid=11491
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938575.398:0): avc:  denied  { search } for  pid=11492
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938576.040:0): avc:  denied  { search } for  pid=11492
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938576.040:0): avc:  denied  { search } for  pid=11492
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938576.400:0): avc:  denied  { search } for  pid=11495
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938576.402:0): avc:  denied  { search } for  pid=11496
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938576.403:0): avc:  denied  { search } for  pid=11497
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938576.405:0): avc:  denied  { search } for  pid=11497
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938576.406:0): avc:  denied  { search } for  pid=11497
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938576.406:0): avc:  denied  { search } for  pid=11494
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938576.779:0): avc:  denied  { search } for  pid=11500
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938576.782:0): avc:  denied  { search } for  pid=11503
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938576.786:0): avc:  denied  { search } for  pid=11505
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938576.844:0): avc:  denied  { search } for  pid=11506
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938576.847:0): avc:  denied  { search } for  pid=11506
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938576.847:0): avc:  denied  { search } for  pid=11506
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938576.966:0): avc:  denied  { search } for  pid=11511
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938576.966:0): avc:  denied  { search } for  pid=11511
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.352:0): avc:  denied  { search } for  pid=11516
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.352:0): avc:  denied  { search } for  pid=11516
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.375:0): avc:  denied  { search } for  pid=11521
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.375:0): avc:  denied  { search } for  pid=11521
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.540:0): avc:  denied  { search } for  pid=11523
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.543:0): avc:  denied  { search } for  pid=11523
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.543:0): avc:  denied  { search } for  pid=11523
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.544:0): avc:  denied  { search } for  pid=11524
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.549:0): avc:  denied  { search } for  pid=11525
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.551:0): avc:  denied  { search } for  pid=11525
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.551:0): avc:  denied  { search } for  pid=11525
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.643:0): avc:  denied  { search } for  pid=11527
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.646:0): avc:  denied  { search } for  pid=11528
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.652:0): avc:  denied  { search } for  pid=11530
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.654:0): avc:  denied  { search } for  pid=11531
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.658:0): avc:  denied  { search } for  pid=11532
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.660:0): avc:  denied  { search } for  pid=11532
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.660:0): avc:  denied  { search } for  pid=11532
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.663:0): avc:  denied  { search } for  pid=11533
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.665:0): avc:  denied  { search } for  pid=11533
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.665:0): avc:  denied  { search } for  pid=11533
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.669:0): avc:  denied  { search } for  pid=11536
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.674:0): avc:  denied  { search } for  pid=11539
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.679:0): avc:  denied  { search } for  pid=11541
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.683:0): avc:  denied  { search } for  pid=11542
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.686:0): avc:  denied  { search } for  pid=11542
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.687:0): avc:  denied  { search } for  pid=11542
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.733:0): avc:  denied  { search } for  pid=11545
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.737:0): avc:  denied  { search } for  pid=11547
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.741:0): avc:  denied  { search } for  pid=11548
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.743:0): avc:  denied  { search } for  pid=11548
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.744:0): avc:  denied  { search } for  pid=11548
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.792:0): avc:  denied  { search } for  pid=11553
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.793:0): avc:  denied  { search } for  pid=11553
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.828:0): avc:  denied  { search } for  pid=11557
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.828:0): avc:  denied  { search } for  pid=11557
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.850:0): avc:  denied  { search } for  pid=11561
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.850:0): avc:  denied  { search } for  pid=11561
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.853:0): avc:  denied  { search } for  pid=11565
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.868:0): avc:  denied  { search } for  pid=11570
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.868:0): avc:  denied  { search } for  pid=11570
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.888:0): avc:  denied  { search } for  pid=11575
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.888:0): avc:  denied  { search } for  pid=11575
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.910:0): avc:  denied  { search } for  pid=11580
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.910:0): avc:  denied  { search } for  pid=11580
exe=/bin/gawk name=sys dev= ino=4120 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:sysctl_t tclass=dir
audit(1081938579.924:0): avc:  denied  { search } for  pid=11582
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938579.930:0): avc:  denied  { search } for  pid=11583
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938580.116:0): avc:  denied  { search } for  pid=11584
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938580.142:0): avc:  denied  { search } for  pid=11585
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938580.144:0): avc:  denied  { search } for  pid=11483
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938580.458:0): avc:  denied  { search } for  pid=11483
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938581.734:0): avc:  denied  { search } for  pid=11593
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938582.096:0): avc:  denied  { search } for  pid=11593
exe=/sbin/mke2fs name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
sage repeated 3 times
audit(1081938582.184:0): avc:  denied  { search } for  pid=11593
exe=/sbin/mke2fs name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938582.184:0): avc:  denied  { search } for  pid=11593
exe=/sbin/mke2fs name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938582.185:0): avc:  denied  { search } for  pid=11593
exe=/sbin/mke2fs name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
sage repeated 4 times
audit(1081938582.189:0): avc:  denied  { search } for  pid=11483
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938582.364:0): avc:  denied  { search } for  pid=11594
exe=/sbin/tune2fs name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
sage repeated 10 times
audit(1081938582.366:0): avc:  denied  { search } for  pid=11483
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938582.487:0): avc:  denied  { search } for  pid=11483
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
SELinux: initialized (dev loop0, type ext2), uses xattr
audit(1081938582.685:0): avc:  denied  { search } for  pid=11598
exe=/bin/mkdir name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938582.687:0): avc:  denied  { search } for  pid=11599
exe=/bin/mkdir name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938582.690:0): avc:  denied  { search } for  pid=11600
exe=/bin/mkdir name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938582.693:0): avc:  denied  { search } for  pid=11601
exe=/bin/mkdir name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938582.695:0): avc:  denied  { search } for  pid=11602
exe=/bin/mkdir name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938582.698:0): avc:  denied  { search } for  pid=11603
exe=/bin/mkdir name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938582.700:0): avc:  denied  { search } for  pid=11604
exe=/bin/mkdir name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938582.703:0): avc:  denied  { search } for  pid=11605
exe=/bin/mkdir name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938582.703:0): avc:  denied  { search } for  pid=11483
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938582.847:0): avc:  denied  { search } for  pid=11483
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938582.864:0): avc:  denied  { search } for  pid=11607
exe=/bin/rm name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938582.969:0): avc:  denied  { search } for  pid=11483
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938584.003:0): avc:  denied  { search } for  pid=11611
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938585.075:0): avc:  denied  { search } for  pid=11613
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938585.372:0): avc:  denied  { search } for  pid=11483
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938585.591:0): avc:  denied  { search } for  pid=11625
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938585.591:0): avc:  denied  { search } for  pid=11626
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938585.687:0): avc:  denied  { search } for  pid=11629
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938585.691:0): avc:  denied  { search } for  pid=11630
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938585.699:0): avc:  denied  { search } for  pid=11634
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938585.701:0): avc:  denied  { search } for  pid=11635
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938585.706:0): avc:  denied  { search } for  pid=11638
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938585.711:0): avc:  denied  { search } for  pid=11639
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938585.716:0): avc:  denied  { search } for  pid=11483
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938585.788:0): avc:  denied  { search } for  pid=11641
exe=/bin/chmod name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938586.514:0): avc:  denied  { search } for  pid=11483
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938586.766:0): avc:  denied  { search } for  pid=11483
exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938587.469:0): avc:  denied  { search } for  pid=11649
exe=/bin/rm name=linux-2.6.5-1.319 dev=hda2 ino=4627658
scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
tclass=dir
audit(1081938587.987:0): avc:  denied  { unlink } for  pid=11664
exe=/sbin/grubby name=grub.conf dev=hda1 ino=4031
scontext=root:sysadm_r:bootloader_t tcontext=aleksey:object_r:etc_t
tclass=file
audit(1081938587.988:0): avc:  denied  { unlink } for  pid=11664
exe=/sbin/grubby name=grub.conf dev=hda1 ino=4031
scontext=root:sysadm_r:bootloader_t tcontext=aleksey:object_r:etc_t
tclass=file


-- 
Aleksey Nogin

Home Page: http://nogin.org/
E-Mail: nogin(a)cs.caltech.edu (office), aleksey(a)nogin.org (personal)
Office: Jorgensen 70, tel: [phone]

[Daniel J Walsh]

Aleksey Nogin wrote:

>  If I install the kernel-source package and build a custom kernel,
> then
>  at "make install" I see:
>
>  rm: ??????? ??????? ??????????: Permission denied
>  rm: ??????? ??????? ??????????: Permission denied
>  rm: remove.c:378: AD_pop_and_chdir: Assertion `AD_stack_height (ds)' 
>  failed.
>  /sbin/mkinitrd: line 678: 11649 Aborted                 rm -rf $MNTIMAGE
>  $MNTPOINT $IMAGE
>  grubby: error moving /boot/grub/grub.conf- to /boot/grub/grub.conf:
>  Permission denied
>
>  And I see a huge number of AVC messages. Some of them are obviously a
>  bug (the grub.conf- should be created as bootloader_t, not as etc_t),
>  and for others I am not sure what would be the right thing to do.
>
>  audit(1081938574.814:0): avc:  denied  { search } for  pid=11483
>  exe=/bin/bash name=src dev=hda2 ino=4627617
>  scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
>  tclass=dir
>  audit(1081938574.816:0): avc:  denied  { search } for  pid=11484
>  exe=/bin/bash name=linux-2.6.5-1.319 dev=hda2 ino=4627658
>  scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:src_t
>  tclass=dir 
In certain cases it is helpful to just run these avc messages through 
audit2allow
All these messages basically came down to a couple of rules that have 
been added
to the laste policy.

A couple of tricks you might want to try

audit2allow -l -i /var/log/messages 

Will output all rules for messages since the last time you ran a make load.

You can then take the output from this command and output it do the misc
subdirectory under policy
audit2allow -l -i /var/log/messages > 
/etc/security/selinux/src/policy/domain/misc/later.te

Then do a make load to see if the policy compiles.  If it does see if 
this fixes you problem.
You have written your first policy.

In alot of cases the rules that are generated by audit2allow will be 
disallowed do to the assert.te and
constraints.te.  For example you will not be allowed to write files in 
the /etc/ directory.  You should
look at how other programs handle this, usually though 
file_type_domain_trans.

Dan

[Aleksey Nogin]

On 14.04.2004 18:16, Daniel J Walsh wrote:

>  In certain cases it is helpful to just run these avc messages through
>
>  audit2allow 
I guess so, although for many of these things, the right solution is not 
to allow the access, but change something else (e.g. grub- should be 
marked correctly).

>  All these messages basically came down to a couple of rules that have
>
>  been added to the laste policy. 
Thanks!

>  A couple of tricks you might want to try
>  
>  audit2allow -l -i /var/log/messages
>  Will output all rules for messages since the last time you ran a make load. 
Ah, that's very useful, thanks, I did not know about these audit2allow 
options.

>  You have written your first policy. 
Far from the first one ;-)

BTW, do you think any of the following is worth adding to the default 
policy (or is already there)?

--- My local te ---

# Allow hotplug (including /sbin/ifup-local) to start/stop services and 
# run sendmail -q
domain_auto_trans(hotplug_t, initrc_exec_t, initrc_t)
domain_auto_trans(hotplug_t, sendmail_exec_t, system_mail_t)

# Same for apm/acpid scripts
domain_auto_trans(apmd_t, initrc_exec_t, initrc_t)
domain_auto_trans(apmd_t, sendmail_exec_t, system_mail_t)

# Allow syslog to a terminal
allow syslogd_t tty_device_t:chr_file { getattr write ioctl append };

# Allow staff to mess with removable devices
allow staff_t removable_device_t:blk_file { getattr read ioctl lock };

# Allow utemper to write to /tmp/.xses-*
allow utempter_t staff_tmp_t:file { getattr write };

# VNC v4 module in X server
type vnc_port_t, port_type;
allow xdm_xserver_t vnc_port_t:tcp_socket name_bind;
# For some reason, putting portcon here is a syntax error and it has to
# go into net_contexts :-(
# portcon tcp 5900  system_u:object_r:vnc_port_t

# Allow strace debugging for staff
allow staff_t {staff_mozilla_t staff_xauth_t}:process { ptrace };

--- My local fc ---

# Workaround for bug 117685
/home/nogin         -l      aleksey:object_r:staff_home_t

# /dev/cdrom is a removable device. Is there a better way to say this?
/dev/hdc             -b     system_u:object_r:removable_device_t

/home/aleksey/\.gnupg/idea   aleksey:object_r:shlib_t

# The hibernation script (downloaded from
# http://prdownloads.sourceforge.net/swsusp/suspend.sh?download )
/usr/local/sbin/hibernate  system_u:object_r:initrc_exec_t

# This is where my Java installation lives
/usr/local/j2re.*/bin(/.*)?              system_u:object_r:bin_t
/usr/local/j2re.*/lib(64)?/i386(/.*)?        system_u:object_r:lib_t

# Is there a better way to say that random users should be able
# to dump files here?
/opt/downloads              system_u:object_r:tmp_t

-- 
Aleksey Nogin

Home Page: http://nogin.org/
E-Mail: nogin(a)cs.caltech.edu (office), aleksey(a)nogin.org (personal)
Office: Jorgensen 70, tel: [phone]

[Daniel J Walsh]

Aleksey Nogin wrote:

>  On 14.04.2004 18:16, Daniel J Walsh wrote:
>
> > In certain cases it is helpful to just run these avc messages through 
> > audit2allow
>
>
>  I guess so, although for many of these things, the right solution is 
>  not to allow the access, but change something else (e.g. grub- should 
>  be marked correctly).
>
> > All these messages basically came down to a couple of rules that have 
> > been added to the laste policy.
>
>
>  Thanks!
>
> > A couple of tricks you might want to try
> >
> > audit2allow -l -i /var/log/messages
> > Will output all rules for messages since the last time you ran a make 
> > load.
>
>
>  Ah, that's very useful, thanks, I did not know about these audit2allow 
>  options.
>
> > You have written your first policy.
>
>
>  Far from the first one ;-)
>  
Not really meant at you,  It was more meant at anyone else that wants to 
try their hand at writing policy.

>  BTW, do you think any of the following is worth adding to the default
>
>  policy (or is already there)?
>
>  --- My local te ---
>
>  # Allow hotplug (including /sbin/ifup-local) to start/stop services 
>  and # run sendmail -q
>  domain_auto_trans(hotplug_t, initrc_exec_t, initrc_t)
>  domain_auto_trans(hotplug_t, sendmail_exec_t, system_mail_t)
>  
Added

>  # Same for apm/acpid scripts
>  domain_auto_trans(apmd_t, initrc_exec_t, initrc_t)
>  domain_auto_trans(apmd_t, sendmail_exec_t, system_mail_t)
>  
Added

>  # Allow syslog to a terminal
>  allow syslogd_t tty_device_t:chr_file { getattr write ioctl append };
>  
I will add this and see what security people say.

>  # Allow staff to mess with removable devices
>  allow staff_t removable_device_t:blk_file { getattr read ioctl lock };
>  
This is already in there for handling floppies.

>  # Allow utemper to write to /tmp/.xses-*
>  allow utempter_t staff_tmp_t:file { getattr write };
>  
Added

>  # VNC v4 module in X server
>  type vnc_port_t, port_type;
>  allow xdm_xserver_t vnc_port_t:tcp_socket name_bind;
>  # For some reason, putting portcon here is a syntax error and it has to
>  # go into net_contexts :-(
>  # portcon tcp 5900  system_u:object_r:vnc_port_t
>  
Added

>  # Allow strace debugging for staff
>  allow staff_t {staff_mozilla_t staff_xauth_t}:process { ptrace };
>
>  --- My local fc ---
>
>  # Workaround for bug 117685
>  /home/nogin         -l      aleksey:object_r:staff_home_t
>
>  # /dev/cdrom is a removable device. Is there a better way to say this?
>  /dev/hdc             -b     system_u:object_r:removable_device_t
>  
I don't know.  We have though about this, but what happens when you have 
more then one cdrom?

>  /home/aleksey/\.gnupg/idea   aleksey:object_r:shlib_t
>
>  # The hibernation script (downloaded from
>  # http://prdownloads.sourceforge.net/swsusp/suspend.sh?download )
>  /usr/local/sbin/hibernate  system_u:object_r:initrc_exec_t
>
>  # This is where my Java installation lives
>  /usr/local/j2re.*/bin(/.*)?              system_u:object_r:bin_t
>  /usr/local/j2re.*/lib(64)?/i386(/.*)?        system_u:object_r:lib_t
>
>  # Is there a better way to say that random users should be able
>  # to dump files here?
>  /opt/downloads              system_u:object_r:tmp_t
>  
That is the way I do it.

[Aleksey Nogin]

On 14.04.2004 20:00, Daniel J Walsh wrote:

> > # /dev/cdrom is a removable device. Is there a better way to say
> this?
> > /dev/hdc             -b     system_u:object_r:removable_device_t
> >
>  I don't know.  We have though about this, but what happens when you have 
>  more then one cdrom? 
Well, kudzu already creates /dev/cdrom, /dev/cdrom1, etc symlinks, may 
be it should be augmented to also relabel the targets of those links as 
removable_device_t? Alternatively, is there a way to talk about a target 
of a symlink in file_contexts?

-- 
Aleksey Nogin

Home Page: http://nogin.org/
E-Mail: nogin(a)cs.caltech.edu (office), aleksey(a)nogin.org (personal)
Office: Jorgensen 70, tel: [phone]

[Stephen Smalley]

On Thu, 2004-04-15 at 02:58, Aleksey Nogin wrote:
>  Alternatively, is there a way to talk about a target 
>  of a symlink in file_contexts? 
Not presently.

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency