avc denied messages from microcode_ctl

[Richard Hally]

While booting the 427  kernel in enforcing mode with 
selinux-policy-strict-1.13.4-5,
the following avc denied messages occur:

Jun 13 21:04:03 new2 kernel: audit(1087175026.816:0): avc:  denied  { 
write } for  pid=1247 exe=/sbin/microcode_ctl name=microcode dev=hda2 
ino=1070659 scontext=system_u:system_r:cpucontrol_t 
tcontext=system_u:object_r:device_t tclass=chr_file

HTH
Richard Hally

[Russell Coker]

On Mon, 14 Jun 2004 15:31, Richard Hally <rhallyx(a)mindspring.com&gt; wrote:
>  While booting the 427  kernel in enforcing mode with
>  selinux-policy-strict-1.13.4-5,
>  the following avc denied messages occur:
>
>  Jun 13 21:04:03 new2 kernel: audit(1087175026.816:0): avc:  denied  {
>  write } for  pid=1247 exe=/sbin/microcode_ctl name=microcode dev=hda2
>  ino=1070659 scontext=system_u:system_r:cpucontrol_t
>  tcontext=system_u:object_r:device_t tclass=chr_file 
/u?dev/cpu/.*           -c      system_u:object_r:cpu_device_t

The above line in file_contexts/types.fc should cover /dev/cpu/microcode.  I 
think that the problem you are having is because for some (unknown) reason 
those device nodes were mis-labeled.  I don't know what might have caused 
this, I have not been able to reproduce it.

I suggest just using setfiles to relabel /dev/cpu.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[Richard Hally]

Russell Coker wrote:

> On Mon, 14 Jun 2004 15:31, Richard Hally
> <rhallyx(a)mindspring.com&gt; wrote:
>   
>
> >While booting the 427  kernel in enforcing mode with
> >selinux-policy-strict-1.13.4-5,
> >the following avc denied messages occur:
> >
> >Jun 13 21:04:03 new2 kernel: audit(1087175026.816:0): avc:  denied  {
> >write } for  pid=1247 exe=/sbin/microcode_ctl name=microcode dev=hda2
> >ino=1070659 scontext=system_u:system_r:cpucontrol_t
> >tcontext=system_u:object_r:device_t tclass=chr_file
> >    
> >
>
> /u?dev/cpu/.*           -c      system_u:object_r:cpu_device_t
>
> The above line in file_contexts/types.fc should cover /dev/cpu/microcode.  I 
> think that the problem you are having is because for some (unknown) reason 
> those device nodes were mis-labeled.  I don't know what might have caused 
> this, I have not been able to reproduce it.
>
> I suggest just using setfiles to relabel /dev/cpu.
>
>   
>  
There is no /udev/cpu.  There is a  /udev/microcode. It is labeled device_t.

Richard Hally

[Russell Coker]

On Tue, 15 Jun 2004 04:59, Richard Hally <rhallyx(a)mindspring.com&gt; wrote:
>  >I suggest just using setfiles to relabel /dev/cpu.
>
>  There is no /udev/cpu.  There is a  /udev/microcode. It is labeled
>  device_t. 
There is no /dev/microcode listed in Documentation/devices.txt in the kernel 
source tree from kernel.org.

Please show me the "ls -l /dev/microcode" output.  We'll have to add an
entry 
to file_contexts/types.fc for it.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page