Hi, I'm using Fedora Core 2 with SELinux, and I was wondering if there is an official place to submit (possible) policy changes. I have run across a couple things that might need to be changed, and I would like to submit them for the next versions of the policy packages. I can do bugzilla if thats the right place for these things.
The main things I'm looking at right now are for dm-crypt. It seems that there might not be correct labeling to support device mapper.
hda6 is the / partition, where the loopback file is (I'm using losetup to setup the loop, and dm-crypt to encrypt, which is then mounted as a user home directory)
audit(1086192065.154:0): avc: denied { read } for pid=2844 exe=/sbin/ldconfig name=libdevmapper.so.1.00 dev=hda6 ino=278879 scontext=root:sysadm_r:ldconfig_t tcontext=system_u:object_r:usr_t tclass=file audit(1086192065.179:0): avc: denied { read } for pid=2844 exe=/sbin/ldconfig name=libdevmapper.so dev=hda6 ino=278880 scontext=root:sysadm_r:ldconfig_t tcontext=system_u:object_r:usr_t tclass=lnk_file
On Thu, 3 Jun 2004 02:29, Chris Grier grier@uiuc.edu wrote:
Hi, I'm using Fedora Core 2 with SELinux, and I was wondering if there is an official place to submit (possible) policy changes. I have run
Here is the best place.
hda6 is the / partition, where the loopback file is (I'm using losetup to setup the loop, and dm-crypt to encrypt, which is then mounted as a user home directory)
audit(1086192065.154:0): avc: denied { read } for pid=2844 exe=/sbin/ldconfig name=libdevmapper.so.1.00 dev=hda6 ino=278879 scontext=root:sysadm_r:ldconfig_t tcontext=system_u:object_r:usr_t tclass=file
What directory is libdevmapper.so.1.00 in?
On Thu, Jun 03, 2004 at 01:59:16PM +1000, Russell Coker wrote:
On Thu, 3 Jun 2004 02:29, Chris Grier grier@uiuc.edu wrote:
Hi, I'm using Fedora Core 2 with SELinux, and I was wondering if there is an official place to submit (possible) policy changes. I have run
Here is the best place.
hda6 is the / partition, where the loopback file is (I'm using losetup to setup the loop, and dm-crypt to encrypt, which is then mounted as a user home directory)
audit(1086192065.154:0): avc: denied { read } for pid=2844 exe=/sbin/ldconfig name=libdevmapper.so.1.00 dev=hda6 ino=278879 scontext=root:sysadm_r:ldconfig_t tcontext=system_u:object_r:usr_t tclass=file
What directory is libdevmapper.so.1.00 in?
Symlinked into /usr/local/lib from /usr/local/encap/device-mapper-1.00.17/lib
[chris@localhost chris]$ ls -laZd /usr/local/lib drwxr-xr-x+ root root system_u:object_r:lib_t /usr/local/lib
So my next guess is that /usr/local/encap/* is not labeled correctly, and this is generating the audits (it IS not labled correctly). I didn't think about this since /usr/local/lib is labeled correctly, athough the files that encap links in are not. Simple to add this to the file contexts though. Thanks.
On Fri, 4 Jun 2004 13:29, Chris Grier grier@uiuc.edu wrote:
What directory is libdevmapper.so.1.00 in?
Symlinked into /usr/local/lib from /usr/local/encap/device-mapper-1.00.17/lib
[chris@localhost chris]$ ls -laZd /usr/local/lib drwxr-xr-x+ root root system_u:object_r:lib_t /usr/local/lib
So my next guess is that /usr/local/encap/* is not labeled correctly, and this is generating the audits (it IS not labled correctly). I didn't think about this since /usr/local/lib is labeled correctly, athough the files that encap links in are not. Simple to add this to the file contexts though. Thanks.
/usr/local is for non-package stuff. We have a few common directories from /usr/local in the standard file contexts files for convenience. But if you do anything serious under /usr/local you have to write your own .fc entries.
selinux@lists.fedoraproject.org
-
Chris Grier -
Russell Coker