After recent updates Mozilla web browser will not start while in enforcing mode. The troubling thing is that it does not produce any avc denied messages. Further, after switching to permissive mode, starting Mozilla web browser, exiting, generating allow rules from the avc denied messages, incorporating them into the policy, doing a 'make reload' and trying Mozilla again in enforcing mode it still will not start and does not produce and avc denied messages. Considering that the recommended method for generating policy is to "debug it into existence" i.e. run things and look at the avc denied messages, this lack of avc denied message indicates there is something fundamentally wrong here and indicates a mode of failure we may not have considered before. Or is it just a bug?
Thanks for any help, Richard Hally
kernel 2.6.7.-1.448 selinux-policy-strict-sources-1.13.8-1 sysklogd-1.4.1-20
Richard Hally wrote:
After recent updates Mozilla web browser will not start while in enforcing mode. The troubling thing is that it does not produce any avc denied messages. Further, after switching to permissive mode, starting Mozilla web browser, exiting, generating allow rules from the avc denied messages, incorporating them into the policy, doing a 'make reload' and trying Mozilla again in enforcing mode it still will not start and does not produce and avc denied messages. Considering that the recommended method for generating policy is to "debug it into existence" i.e. run things and look at the avc denied messages, this lack of avc denied message indicates there is something fundamentally wrong here and indicates a mode of failure we may not have considered before. Or is it just a bug?
Thanks for any help, Richard Hally
kernel 2.6.7.-1.448 selinux-policy-strict-sources-1.13.8-1 sysklogd-1.4.1-20
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com http://www.redhat.com/mailman/listinfo/fedora-selinux-list
Sorry for the reply to my own message. After remembering (and using) the 'enableaudit' option for making policy, the needed avc denied messages to generate the allow rules were produced. But this raises the larger question of how are we going to handle the dontaudit rules in the future? And how do we distinguish between those that are for "harmless" denials and those that are not? Richard Hally
On Fri, 25 Jun 2004 13:52, Richard Hally rhally@mindspring.com wrote:
Sorry for the reply to my own message. After remembering (and using) the 'enableaudit' option for making policy, the needed avc denied messages to generate the allow rules were produced. But this raises the larger question of how are we going to handle the dontaudit rules in the future? And how do we distinguish between those that are for "harmless" denials and those that are not?
Mozilla is a difficult program in this regard. In normal operation it will try to stat() many files and read many directories that you don't want it to so dontaudit rules are needed. Then when you get mis-labelled files and directories you don't see any AVC messages because of the dontaudit rules.
It's especially difficult because it's a program that users run. If the same problem occurs with a daemon then the person who runs it can just load a new policy to investigate it. The person who has a Mozilla program often does not have this option.
selinux@lists.fedoraproject.org