r488 - community/trunk/SELinux_User_Guide/ru-RU
transif at fedoraproject.org
transif at fedoraproject.org
Sat Nov 20 08:42:31 UTC 2010
Author: transif
Date: 2010-11-20 08:42:31 +0000 (Sat, 20 Nov 2010)
New Revision: 488
Modified:
community/trunk/SELinux_User_Guide/ru-RU/Troubleshooting.po
Log:
l10n: Updates to Russian (ru) translation
Transmitted-via: Transifex (translate.fedoraproject.org)
Modified: community/trunk/SELinux_User_Guide/ru-RU/Troubleshooting.po
===================================================================
--- community/trunk/SELinux_User_Guide/ru-RU/Troubleshooting.po 2010-10-05 13:04:55 UTC (rev 487)
+++ community/trunk/SELinux_User_Guide/ru-RU/Troubleshooting.po 2010-11-20 08:42:31 UTC (rev 488)
@@ -1,1425 +1,903 @@
-# SOME DESCRIPTIVE TITLE.
-# FIRST AUTHOR <EMAIL at ADDRESS>, YEAR.
-#
-#, fuzzy
-msgid ""
-msgstr ""
-"Project-Id-Version: PACKAGE VERSION\n"
-"Report-Msgid-Bugs-To: http://bugs.kde.org\n"
-"POT-Creation-Date: 2010-04-15T00:19:32\n"
-"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
-"Last-Translator: FULL NAME <EMAIL at ADDRESS>\n"
-"Language-Team: LANGUAGE <kde-i18n-doc at kde.org>\n"
-"MIME-Version: 1.0\n"
-"Content-Type: application/x-xml2pot; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-
-#. Tag: title
-#, no-c-format
-msgid "Troubleshooting"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The following chapter describes what happens when SELinux denies access; the "
-"top three causes of problems; where to find information about correct "
-"labeling; analyzing SELinux denials; and creating custom policy modules with "
-"<command>audit2allow</command>."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "What Happens when Access is Denied"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"SELinux decisions, such as allowing or disallowing access, are cached. This "
-"cache is known as the Access Vector Cache (AVC). Denial messages are logged "
-"when SELinux denies access. These denials are also known as \"AVC denials\", "
-"and are logged to a different location, depending on which daemons are "
-"running:"
-msgstr ""
-
-#. Tag: segtitle
-#, no-c-format
-msgid "Daemon"
-msgstr ""
-
-#. Tag: segtitle
-#, no-c-format
-msgid "Log Location"
-msgstr ""
-
-#. Tag: seg
-#, no-c-format
-msgid "auditd on"
-msgstr ""
-
-#. Tag: seg
-#, no-c-format
-msgid "<filename>/var/log/audit/audit.log</filename>"
-msgstr ""
-
-#. Tag: seg
-#, no-c-format
-msgid "auditd off; rsyslogd on"
-msgstr ""
-
-#. Tag: seg
-#, no-c-format
-msgid "<filename>/var/log/messages</filename>"
-msgstr ""
-
-#. Tag: seg
-#, no-c-format
-msgid "setroubleshootd, rsyslogd, and auditd on"
-msgstr ""
-
-#. Tag: seg
-#, no-c-format
-msgid ""
-"<filename>/var/log/audit/audit.log</filename>. Easier-to-read denial "
-"messages also sent to <filename>/var/log/messages</filename>"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"If you are running the X Window System, have the <package>setroubleshoot</"
-"package> and <package>setroubleshoot-server</package> packages installed, "
-"and the <systemitem class=\"daemon\">setroubleshootd</systemitem> and "
-"<systemitem class=\"daemon\">auditd</systemitem> daemons are running, a "
-"warning is displayed when access is denied by SELinux:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Clicking on 'Show' presents a detailed analysis of why SELinux denied "
-"access, and a possible solution for allowing access. If you are not running "
-"the X Window System, it is less obvious when access is denied by SELinux. "
-"For example, users browsing your website may receive an error similar to the "
-"following:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"For these situations, if DAC rules (standard Linux permissions) allow "
-"access, check <filename>/var/log/messages</filename> and <filename>/var/log/"
-"audit/audit.log</filename> for <computeroutput>\"SELinux is preventing\"</"
-"computeroutput> and <computeroutput>\"denied\"</computeroutput> errors "
-"respectively. This can be done by running the following commands as the "
-"Linux root user:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "<command>grep \"SELinux is preventing\" /var/log/messages</command>"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "<command>grep \"denied\" /var/log/audit/audit.log</command>"
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "Top Three Causes of Problems"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The following sections describe the top three causes of problems: labeling "
-"problems, configuring Booleans and ports for services, and evolving SELinux "
-"rules."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "Labeling Problems"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"On systems running SELinux, all processes and files are labeled with a label "
-"that contains security-relevant information. This information is called the "
-"SELinux context. If these labels are wrong, access may be denied. If an "
-"application is labeled incorrectly, the process it transitions to may not "
-"have the correct label, possibly causing SELinux to deny access, and the "
-"process being able to create mislabeled files."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"A common cause of labeling problems is when a non-standard directory is used "
-"for a service. For example, instead of using <filename>/var/www/html/</"
-"filename> for a website, an administrator wants to use <filename>/srv/myweb/"
-"</filename>. On Fedora &PRODVER;, the <filename>/srv/</filename> "
-"directory is labeled with the <computeroutput>var_t</computeroutput> type. "
-"Files and directories created and <filename>/srv/</filename> inherit this "
-"type. Also, newly-created top-level directories (such as <filename>/myserver/"
-"</filename>) may be labeled with the <computeroutput>default_t</"
-"computeroutput> type. SELinux prevents the Apache HTTP Server (<systemitem "
-"class=\"daemon\">httpd</systemitem>) from accessing both of these types. To "
-"allow access, SELinux must know that the files in <filename>/srv/myweb/</"
-"filename> are to be accessible to <systemitem class=\"daemon\">httpd</"
-"systemitem>:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"This <command>semanage</command> command adds the context for the <filename>/"
-"srv/myweb/</filename> directory (and all files and directories under it) to "
-"the SELinux file-context configuration<footnote> <para> Files in <filename>/"
-"etc/selinux/targeted/contexts/files/</filename> define contexts for files "
-"and directories. Files in this directory are read by <command>restorecon</"
-"command> and <command>setfiles</command> to restore files and directories to "
-"their default contexts. </para> </footnote>. The <command>semanage</command> "
-"command does not change the context. As the Linux root user, run the "
-"<command>restorecon</command> command to apply the changes:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Refer to <xref linkend=\"sect-Security-Enhanced_Linux-"
-"SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext\" /> "
-"for further information about adding contexts to the file-context "
-"configuration."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "What is the Correct Context?"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The <command>matchpathcon</command> command checks the context of a file "
-"path and compares it to the default label for that path. The following "
-"example demonstrates using <command>matchpathcon</command> on a directory "
-"that contains incorrectly labeled files:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"In this example, the <filename>index.html</filename> and <filename>page1."
-"html</filename> files are labeled with the <computeroutput>user_home_t</"
-"computeroutput> type. This type is used for files in user home directories. "
-"Using the <command>mv</command> command to move files from your home "
-"directory may result in files being labeled with the "
-"<computeroutput>user_home_t</computeroutput> type. This type should not "
-"exist outside of home directories. Use the <command>restorecon</command> "
-"command to restore such files to their correct type:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"To restore the context for all files under a directory, use the <option>-R</"
-"option> option:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Refer to <xref linkend=\"sect-Security-Enhanced_Linux-"
-"Maintaining_SELinux_Labels_-Checking_the_Default_SELinux_Context\" /> for a "
-"more detailed example of <command>matchpathcon</command>."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "How are Confined Services Running?"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Services can be run in a variety of ways. To cater for this, you must tell "
-"SELinux how you are running services. This can be achieved via Booleans that "
-"allow parts of SELinux policy to be changed at runtime, without any "
-"knowledge of SELinux policy writing. This allows changes, such as allowing "
-"services access to NFS file systems, without reloading or recompiling "
-"SELinux policy. Also, running services on non-default port numbers requires "
-"policy configuration to be updated via the <command>semanage</command> "
-"command."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"For example, to allow the Apache HTTP Server to communicate with MySQL, turn "
-"the <computeroutput>httpd_can_network_connect_db</computeroutput> Boolean on:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"If access is denied for a particular service, use the <command>getsebool</"
-"command> and <command>grep</command> commands to see if any Booleans are "
-"available to allow access. For example, use the <command>getsebool -a | grep "
-"ftp</command> command to search for FTP related Booleans:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"For a list of Booleans and whether they are on or off, run the <command>/usr/"
-"sbin/getsebool -a</command> command. For a list of Booleans, an explanation "
-"of what each one is, and whether they are on or off, run the <command>/usr/"
-"sbin/semanage boolean -l</command> command as the Linux root user. Refer to "
-"<xref linkend=\"sect-Security-Enhanced_Linux-Working_with_SELinux-Booleans"
-"\" /> for information about listing and configuring Booleans."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "Port Numbers"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Depending on policy configuration, services may only be allowed to run on "
-"certain port numbers. Attempting to change the port a service runs on "
-"without changing policy may result in the service failing to start. For "
-"example, run the <command>semanage port -l | grep http</command> command as "
-"the Linux root user to list <systemitem class=\"daemon\">http</systemitem> "
-"related ports:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The <computeroutput>http_port_t</computeroutput> port type defines the ports "
-"Apache HTTP Server can listen on, which in this case, are TCP ports 80, 443, "
-"488, 8008, 8009, and 8443. If an administrator configures <filename>httpd."
-"conf</filename> so that <systemitem class=\"daemon\">httpd</systemitem> "
-"listens on port 9876 (<option>Listen 9876</option>), but policy is not "
-"updated to reflect this, the <command>service httpd start</command> command "
-"fails:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"An SELinux denial similar to the following is logged to <filename>/var/log/"
-"audit/audit.log</filename>:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"To allow <systemitem class=\"daemon\">httpd</systemitem> to listen on a port "
-"that is not listed for the <computeroutput>http_port_t</computeroutput> port "
-"type, run the <command>semanage port</command> command to add a port to "
-"policy configuration<footnote> <para> The <command>semanage port -a</"
-"command> command adds an entry to the <filename>/etc/selinux/targeted/"
-"modules/active/ports.local</filename> file. Note: by default, this file can "
-"only be viewed by the Linux root user. </para> </footnote>:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The <option>-a</option> option adds a new record; the <option>-t</option> "
-"option defines a type; and the <option>-p</option> option defines a "
-"protocol. The last argument is the port number to add."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "Evolving Rules and Broken Applications"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Applications may be broken, causing SELinux to deny access. Also, SELinux "
-"rules are evolving - SELinux may not have seen an application running in a "
-"certain way, possibly causing it to deny access, even though the application "
-"is working as expected. For example, if a new version of PostgreSQL is "
-"released, it may perform actions the current policy has not seen before, "
-"causing access to be denied, even though access should be allowed."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"For these situations, after access is denied, use <command>audit2allow</"
-"command> to create a custom policy module to allow access. Refer to <xref "
-"linkend=\"sect-Security-Enhanced_Linux-Fixing_Problems-"
-"Allowing_Access_audit2allow\" /> for information about using "
-"<command>audit2allow</command>."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "Fixing Problems"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The following sections help troubleshoot issues. They go over: checking "
-"Linux permissions, which are checked before SELinux rules; possible causes "
-"of SELinux denying access, but no denials being logged; manual pages for "
-"services, which contain information about labeling and Booleans; permissive "
-"domains, for allowing one process to run permissive, rather than the whole "
-"system; how to search for and view denial messages; analyzing denials; and "
-"creating custom policy modules with <command>audit2allow</command>."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "Linux Permissions"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"When access is denied, check standard Linux permissions. As mentioned in "
-"<xref linkend=\"chap-Security-Enhanced_Linux-Introduction\" />, most "
-"operating systems use a Discretionary Access Control (DAC) system to control "
-"access, allowing users to control the permissions of files that they own. "
-"SELinux policy rules are checked after DAC rules. SELinux policy rules are "
-"not used if DAC rules deny access first."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"If access is denied and no SELinux denials are logged, use the <command>ls -"
-"l</command> command to view the standard Linux permissions:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"In this example, <filename>index.html</filename> is owned by the root user "
-"and group. The root user has read and write permissions (<computeroutput>-"
-"rw</computeroutput>), and members of the root group have read permissions "
-"(<computeroutput>-r-</computeroutput>). Everyone else has no access "
-"(<computeroutput>---</computeroutput>). By default, such permissions do not "
-"allow <systemitem class=\"daemon\">httpd</systemitem> to read this file. To "
-"resolve this issue, use the <command>chown</command> command to change the "
-"owner and group. This command must be run as the Linux root user:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"This assumes the default configuration, in which <systemitem class=\"daemon"
-"\">httpd</systemitem> runs as the Linux apache user. If you run <systemitem "
-"class=\"daemon\">httpd</systemitem> with a different user, replace "
-"<computeroutput>apache:apache</computeroutput> with that user."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Refer to the <ulink url=\"http://fedoraproject.org/wiki/Docs/Drafts/"
-"AdministrationGuide/Permissions\">Fedora Documentation Project \"Permissions"
-"\"</ulink> draft for information about managing Linux permissions."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "Possible Causes of Silent Denials"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"In certain situations, AVC denials may not be logged when SELinux denies "
-"access. Applications and system library functions often probe for more "
-"access than required to perform their tasks. To maintain least privilege "
-"without filling audit logs with AVC denials for harmless application "
-"probing, the policy can silence AVC denials without allowing a permission by "
-"using <computeroutput>dontaudit</computeroutput> rules. These rules are "
-"common in standard policy. The downside of <computeroutput>dontaudit</"
-"computeroutput> is that, although SELinux denies access, denial messages are "
-"not logged, making troubleshooting hard."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"To temporarily disable <computeroutput>dontaudit</computeroutput> rules, "
-"allowing all denials to be logged, run the following command as the Linux "
-"root user:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "<command>/usr/sbin/semodule -DB</command>"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The <option>-D</option> option disables <computeroutput>dontaudit</"
-"computeroutput> rules; the <option>-B</option> option rebuilds policy. After "
-"running <command>semodule -DB</command>, try exercising the application that "
-"was encountering permission problems, and see if SELinux denials — "
-"relevant to the application — are now being logged. Take care in "
-"deciding which denials should be allowed, as some should be ignored and "
-"handled via <computeroutput>dontaudit</computeroutput> rules. If in doubt, "
-"or in search of guidance, contact other SELinux users and developers on an "
-"SELinux list, such as <ulink url=\"http://www.redhat.com/mailman/listinfo/"
-"fedora-selinux-list\">fedora-selinux-list</ulink>."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"To rebuild policy and enable <computeroutput>dontaudit</computeroutput> "
-"rules, run the following command as the Linux root user:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "<command>/usr/sbin/semodule -B</command>"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"This restores the policy to its original state. For a full list of "
-"<computeroutput>dontaudit</computeroutput> rules, run the <command>sesearch "
-"--dontaudit</command> command. Narrow down searches using the <option>-s "
-"<replaceable>domain</replaceable></option> option and the <command>grep</"
-"command> command. For example:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Refer to <xref linkend=\"sect-Security-Enhanced_Linux-Fixing_Problems-"
-"Raw_Audit_Messages\" /> and <xref linkend=\"sect-Security-Enhanced_Linux-"
-"Fixing_Problems-sealert_Messages\" /> for information about analyzing "
-"denials."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "Manual Pages for Services"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Manual pages for services contain valuable information, such as what file "
-"type to use for a given situation, and Booleans to change the access a "
-"service has (such as <systemitem class=\"daemon\">httpd</systemitem> "
-"accessing NFS file systems). This information may be in the standard manual "
-"page, or a manual page with <computeroutput>selinux</computeroutput> "
-"prepended or appended."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "For example, the"
-msgstr ""
-
-#. Tag: refentrytitle
-#, no-c-format
-msgid "httpd_selinux"
-msgstr ""
-
-#. Tag: citerefentry
-#, no-c-format
-msgid ""
-"manual page has information about what file type to use for a given "
-"situation, as well as Booleans to allow scripts, sharing files, accessing "
-"directories inside user home directories, and so on. Other manual pages with "
-"SELinux information for services include:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "Samba: the"
-msgstr ""
-
-#. Tag: refentrytitle
-#, no-c-format
-msgid "samba_selinux"
-msgstr ""
-
-#. Tag: citerefentry
-#, no-c-format
-msgid ""
-"manual page describes that files and directories to be exported via Samba "
-"must be labeled with the <computeroutput>samba_share_t</computeroutput> "
-"type, as well as Booleans to allow files labeled with types other than "
-"<computeroutput>samba_share_t</computeroutput> to be exported via Samba."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "NFS: the"
-msgstr ""
-
-#. Tag: refentrytitle
-#, no-c-format
-msgid "nfs_selinux"
-msgstr ""
-
-#. Tag: citerefentry
-#, no-c-format
-msgid ""
-"manual page describes that, by default, file systems can not be exported via "
-"NFS, and that to allow file systems to be exported, Booleans such as "
-"<computeroutput>nfs_export_all_ro</computeroutput> or "
-"<computeroutput>nfs_export_all_rw</computeroutput> must be turned on."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "Berkeley Internet Name Domain (BIND): the"
-msgstr ""
-
-#. Tag: refentrytitle
-#, no-c-format
-msgid "named"
-msgstr ""
-
-#. Tag: citerefentry
-#, no-c-format
-msgid ""
-"manual page describes what file type to use for a given situation (see the "
-"<computeroutput>Red Hat SELinux BIND Security Profile</computeroutput> "
-"section). The"
-msgstr ""
-
-#. Tag: refentrytitle
-#, no-c-format
-msgid "named_selinux"
-msgstr ""
-
-#. Tag: citerefentry
-#, no-c-format
-msgid ""
-"manual page describes that, by default, <systemitem class=\"daemon\">named</"
-"systemitem> can not write to master zone files, and to allow such access, "
-"the <computeroutput>named_write_master_zones</computeroutput> Boolean must "
-"be turned on."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The information in manual pages helps you configure the correct file types "
-"and Booleans, helping to prevent SELinux from denying access."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "Permissive Domains"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"When SELinux is running in permissive mode, SELinux does not deny access, "
-"but denials are logged for actions that would have been denied if running in "
-"enforcing mode. Previously, it was not possible to make a single domain "
-"permissive (remember: processes run in domains). In certain situations, this "
-"led to making the whole system permissive to troubleshoot issues."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Fedora &PRODVER; includes permissive domains, where an administrator "
-"can configure a single process (domain) to run permissive, rather than "
-"making the whole system permissive. SELinux checks are still performed for "
-"permissive domains; however, the kernel allows access and reports an AVC "
-"denial for situations where SELinux would have denied access. Permissive "
-"domains are also available in Fedora 9 (with the latest updates applied)."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"In Red Hat Enterprise Linux 4 and 5, <computeroutput><replaceable>domain</"
-"replaceable>_disable_trans</computeroutput> Booleans are available to "
-"prevent an application from transitioning to a confined domain, and "
-"therefore, the process runs in an unconfined domain, such as "
-"<computeroutput>initrc_t</computeroutput>. Turning such Booleans on can "
-"cause major problems. For example, if the "
-"<computeroutput>httpd_disable_trans</computeroutput> Boolean is turned on:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"<systemitem class=\"daemon\">httpd</systemitem> runs in the unconfined "
-"<computeroutput>initrc_t</computeroutput> domain. Files created by processes "
-"running in the <computeroutput>initrc_t</computeroutput> domain may not have "
-"the same labeling rules applied as files created by a process running in the "
-"<computeroutput>httpd_t</computeroutput> domain, potentially allowing "
-"processes to create mislabeled files. This causes access problems later on."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"confined domains that are allowed to communicate with "
-"<computeroutput>httpd_t</computeroutput> can not communicate with "
-"<computeroutput>initrc_t</computeroutput>, possibly causing additional "
-"failures."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The <computeroutput><replaceable>domain</replaceable>_disable_trans</"
-"computeroutput> Booleans were removed from Fedora 7, even though there was "
-"no replacement. Permissive domains solve the above issues: transition rules "
-"apply, and files are created with the correct labels."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "Permissive domains can be used for:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"making a single process (domain) run permissive to troubleshoot an issue, "
-"rather than putting the entire system at risk by making the entire system "
-"permissive."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"creating policies for new applications. Previously, it was recommended that "
-"a minimal policy be created, and then the entire machine put into permissive "
-"mode, so that the application could run, but SELinux denials still logged. "
-"<command>audit2allow</command> could then be used to help write the policy. "
-"This put the whole system at risk. With permissive domains, only the domain "
-"in the new policy can be marked permissive, without putting the whole system "
-"at risk."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "Making a Domain Permissive"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"To make a domain permissive, run the <command>semanage permissive -a "
-"<replaceable>domain</replaceable></command> command, where "
-"<replaceable>domain</replaceable> is the domain you want to make permissive. "
-"For example, run the following command as the Linux root user to make the "
-"<computeroutput>httpd_t</computeroutput> domain (the domain the Apache HTTP "
-"Server runs in) permissive:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "<command>/usr/sbin/semanage permissive -a httpd_t</command>"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"To view a list of domains you have made permissive, run the "
-"<command>semodule -l | grep permissive</command> command as the Linux root "
-"user. For example:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"If you no longer want a domain to be permissive, run the <command>semanage "
-"permissive -d <replaceable>domain</replaceable></command> command as the "
-"Linux root user. For example:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "<command>/usr/sbin/semanage permissive -d httpd_t</command>"
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "Denials for Permissive Domains"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The <computeroutput>SYSCALL</computeroutput> message is different for "
-"permissive domains. The following is an example AVC denial (and the "
-"associated system call) from the Apache HTTP Server:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"By default, the <computeroutput>httpd_t</computeroutput> domain is not "
-"permissive, and as such, the action is denied, and the "
-"<computeroutput>SYSCALL</computeroutput> message contains "
-"<computeroutput>success=no</computeroutput>. The following is an example AVC "
-"denial for the same situation, except the <command>semanage permissive -a "
-"httpd_t</command> command has been run to make the <computeroutput>httpd_t</"
-"computeroutput> domain permissive:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"In this case, although an AVC denial was logged, access was not denied, as "
-"shown by <computeroutput>success=yes</computeroutput> in the "
-"<computeroutput>SYSCALL</computeroutput> message."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Refer to Dan Walsh's <ulink url=\"http://danwalsh.livejournal.com/24537.html"
-"\">\"Permissive Domains\"</ulink> blog entry for further information about "
-"permissive domains."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "Searching For and Viewing Denials"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"This section assumes the <package>setroubleshoot</package>, "
-"<package>setroubleshoot-server</package>, <package>dbus</package> and "
-"<package>audit</package> packages are installed, and that the <systemitem "
-"class=\"daemon\">auditd</systemitem>, <systemitem class=\"daemon\">rsyslogd</"
-"systemitem>, and <systemitem class=\"daemon\">setroubleshootd</systemitem> "
-"daemons are running. Refer to <xref linkend=\"sect-Security-Enhanced_Linux-"
-"Working_with_SELinux-Which_Log_File_is_Used\" /> for information about "
-"starting these daemons. A number of tools are available for searching for "
-"and viewing SELinux denials, such as <command>ausearch</command>, "
-"<command>aureport</command>, and <command>sealert</command>."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "ausearch"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The <package>audit</package> package provides <command>ausearch</command>. "
-"From the"
-msgstr ""
-
-#. Tag: citerefentry
-#, no-c-format
-msgid ""
-"manual page: \"<command>ausearch</command> is a tool that can query the "
-"audit daemon logs based for events based on different search criteria"
-"\"<footnote> <para> From the <citerefentry><refentrytitle>ausearch</"
-"refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as "
-"shipped with the <package>audit</package> package in Fedora &PRODVER;. "
-"</para> </footnote>. The <command>ausearch</command> tool accesses "
-"<filename>/var/log/audit/audit.log</filename>, and as such, must be run as "
-"the Linux root user:"
-msgstr ""
-
-#. Tag: segtitle
-#, no-c-format
-msgid "Searching For"
-msgstr ""
-
-#. Tag: segtitle
-#, no-c-format
-msgid "Command"
-msgstr ""
-
-#. Tag: seg
-#, no-c-format
-msgid "all denials"
-msgstr ""
-
-#. Tag: seg
-#, no-c-format
-msgid "<command>/sbin/ausearch -m avc</command>"
-msgstr ""
-
-#. Tag: seg
-#, no-c-format
-msgid "denials for that today"
-msgstr ""
-
-#. Tag: seg
-#, no-c-format
-msgid "<command>/sbin/ausearch -m avc -ts today</command>"
-msgstr ""
-
-#. Tag: seg
-#, no-c-format
-msgid "denials from the last 10 minutes"
-msgstr ""
-
-#. Tag: seg
-#, no-c-format
-msgid "<command>/sbin/ausearch -m avc -ts recent</command>"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"To search for SELinux denials for a particular service, use the <option>-c "
-"<replaceable>comm-name</replaceable></option> option, where "
-"<replaceable>comm-name</replaceable> \"is the executable’s name\"<footnote> "
-"<para> From the <citerefentry><refentrytitle>ausearch</"
-"refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as "
-"shipped with the <package>audit</package> package in Fedora &PRODVER;. "
-"</para> </footnote>, for example, <systemitem class=\"daemon\">httpd</"
-"systemitem> for the Apache HTTP Server, and <systemitem class=\"daemon"
-"\">smbd</systemitem> for Samba:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "<command>/sbin/ausearch -m avc -c httpd</command>"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "<command>/sbin/ausearch -m avc -c smbd</command>"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "Refer to the"
-msgstr ""
-
-#. Tag: citerefentry
-#, no-c-format
-msgid "manual page for further <command>ausearch</command> options."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "aureport"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The <package>audit</package> package provides <command>aureport</command>. "
-"From the"
-msgstr ""
-
-#. Tag: citerefentry
-#, no-c-format
-msgid ""
-"manual page: \"<command>aureport</command> is a tool that produces summary "
-"reports of the audit system logs\"<footnote> <para> From the "
-"<citerefentry><refentrytitle>aureport</refentrytitle><manvolnum>8</"
-"manvolnum></citerefentry> manual page, as shipped with the <package>audit</"
-"package> package in Fedora &PRODVER;. </para> </footnote>. The "
-"<command>aureport</command> tool accesses <filename>/var/log/audit/audit."
-"log</filename>, and as such, must be run as the Linux root user. To view a "
-"list of SELinux denials and how often each one occurred, run the "
-"<command>aureport -a</command> command. The following is example output that "
-"includes two denials:"
-msgstr ""
-
-#. Tag: citerefentry
-#, no-c-format
-msgid "manual page for further <command>aureport</command> options."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "sealert"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The <package>setroubleshoot-server</package> package provides "
-"<command>sealert</command>, which reads denial messages translated by "
-"<package>setroubleshoot-server</package>. Denials are assigned IDs, as seen "
-"in <filename>/var/log/messages</filename>. The following is an example "
-"denial from <filename>messages</filename>:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"In this example, the denial ID is <computeroutput>84e0b04d-d0ad-4347-8317-"
-"22e74f6cd020</computeroutput>. The <option>-l</option> option takes an ID as "
-"an argument. Running the <command>sealert -l 84e0b04d-d0ad-4347-8317-"
-"22e74f6cd020</command> command presents a detailed analysis of why SELinux "
-"denied access, and a possible solution for allowing access."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"If you are running the X Window System, have the <package>setroubleshoot</"
-"package> and <package>setroubleshoot-server</package> packages installed, "
-"and the <systemitem class=\"daemon\">setroubleshootd</systemitem>, "
-"<systemitem class=\"daemon\">dbus</systemitem> and <systemitem class=\"daemon"
-"\">auditd</systemitem> daemons are running, a warning is displayed when "
-"access is denied by SELinux. Clicking on 'Show' launches the "
-"<command>sealert</command> GUI, and displays denials in HTML output:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Run the <command>sealert -b</command> command to launch the "
-"<command>sealert</command> GUI."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Run the <command>sealert -l \\*</command> command to view a detailed "
-"analysis of all denials."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"As the Linux root user, run the <command>sealert -a /var/log/audit/audit.log "
-"-H > audit.html</command> command to create a HTML version of the "
-"<command>sealert</command> analysis, as seen with the <command>sealert</"
-"command> GUI."
-msgstr ""
-
-#. Tag: citerefentry
-#, no-c-format
-msgid "manual page for further <command>sealert</command> options."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "Raw Audit Messages"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Raw audit messages are logged to <filename>/var/log/audit/audit.log</"
-"filename>. The following is an example AVC denial (and the associated system "
-"call) that occurred when the Apache HTTP Server (running in the "
-"<computeroutput>httpd_t</computeroutput> domain) attempted to access the "
-"<filename>/var/www/html/file1</filename> file (labeled with the "
-"<computeroutput>samba_share_t</computeroutput> type):"
-msgstr ""
-
-#. Tag: term
-#, no-c-format
-msgid "<replaceable>{ getattr }</replaceable>"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The item in braces indicates the permission that was denied. "
-"<computeroutput>getattr</computeroutput> indicates the source process was "
-"trying to read the target file's status information. This occurs before "
-"reading files. This action is denied due to the file being accessed having "
-"the wrong label. Commonly seen permissions include <computeroutput>getattr</"
-"computeroutput>, <computeroutput>read</computeroutput>, and "
-"<computeroutput>write</computeroutput>."
-msgstr ""
-
-#. Tag: term
-#, no-c-format
-msgid "comm=\"<replaceable>httpd</replaceable>\""
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The executable that launched the process. The full path of the executable is "
-"found in the <computeroutput>exe=</computeroutput> section of the system "
-"call (<computeroutput>SYSCALL</computeroutput>) message, which in this case, "
-"is <computeroutput>exe=\"/usr/sbin/httpd\"</computeroutput>."
-msgstr ""
-
-#. Tag: term
-#, no-c-format
-msgid "path=\"<replaceable>/var/www/html/file1</replaceable>\""
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "The path to the object (target) the process attempted to access."
-msgstr ""
-
-#. Tag: term
-#, no-c-format
-msgid ""
-"scontext=\"<replaceable>unconfined_u:system_r:httpd_t:s0</replaceable>\""
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The SELinux context of the process that attempted the denied action. In this "
-"case, it is the SELinux context of the Apache HTTP Server, which is running "
-"in the <computeroutput>httpd_t</computeroutput> domain."
-msgstr ""
-
-#. Tag: term
-#, no-c-format
-msgid ""
-"tcontext=\"<replaceable>unconfined_u:object_r:samba_share_t:s0</replaceable>"
-"\""
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The SELinux context of the object (target) the process attempted to access. "
-"In this case, it is the SELinux context of <filename>file1</filename>. Note: "
-"the <computeroutput>samba_share_t</computeroutput> type is not accessible to "
-"processes running in the <computeroutput>httpd_t</computeroutput> domain."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"In certain situations, the <computeroutput>tcontext</computeroutput> may "
-"match the <computeroutput>scontext</computeroutput>, for example, when a "
-"process attempts to execute a system service that will change "
-"characteristics of that running process, such as the user ID. Also, the "
-"<computeroutput>tcontext</computeroutput> may match the "
-"<computeroutput>scontext</computeroutput> when a process tries to use more "
-"resources (such as memory) than normal limits allow, resulting in a security "
-"check to see if that process is allowed to break those limits."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"From the system call (<computeroutput>SYSCALL</computeroutput>) message, two "
-"items are of interest:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"<computeroutput>success=<replaceable>no</replaceable></computeroutput>: "
-"indicates whether the denial (AVC) was enforced or not. "
-"<computeroutput>success=no</computeroutput> indicates the system call was "
-"not successful (SELinux denied access). <computeroutput>success=yes</"
-"computeroutput> indicates the system call was successful - this can be seen "
-"for permissive domains or unconfined domains, such as "
-"<computeroutput>initrc_t</computeroutput> and <computeroutput>kernel_t</"
-"computeroutput>."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"<computeroutput>exe=\"<replaceable>/usr/sbin/httpd</replaceable>\"</"
-"computeroutput>: the full path to the executable that launched the process, "
-"which in this case, is <computeroutput>exe=\"/usr/sbin/httpd\"</"
-"computeroutput>."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"An incorrect file type is a common cause for SELinux denying access. To "
-"start troubleshooting, compare the source context (<computeroutput>scontext</"
-"computeroutput>) with the target context (<computeroutput>tcontext</"
-"computeroutput>). Should the process (<computeroutput>scontext</"
-"computeroutput>) be accessing such an object (<computeroutput>tcontext</"
-"computeroutput>)? For example, the Apache HTTP Server "
-"(<computeroutput>httpd_t</computeroutput>) should only be accessing types "
-"specified in the"
-msgstr ""
-
-#. Tag: citerefentry
-#, no-c-format
-msgid ""
-"manual page, such as <computeroutput>httpd_sys_content_t</computeroutput>, "
-"<computeroutput>public_content_t</computeroutput>, and so on, unless "
-"configured otherwise."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "sealert Messages"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Denials are assigned IDs, as seen in <filename>/var/log/messages</filename>. "
-"The following is an example AVC denial (logged to <filename>messages</"
-"filename>) that occurred when the Apache HTTP Server (running in the "
-"<computeroutput>httpd_t</computeroutput> domain) attempted to access the "
-"<filename>/var/www/html/file1</filename> file (labeled with the "
-"<computeroutput>samba_share_t</computeroutput> type):"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"As suggested, run the <command>sealert -l 84e0b04d-d0ad-4347-8317-"
-"22e74f6cd020</command> command to view the complete message. This command "
-"only works on the local machine, and presents the same information as the "
-"<command>sealert</command> GUI:"
-msgstr ""
-
-#. Tag: term
-#, no-c-format
-msgid "Summary"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"A brief summary of the denied action. This is the same as the denial in "
-"<filename>/var/log/messages</filename>. In this example, the <systemitem "
-"class=\"daemon\">httpd</systemitem> process was denied access to a file "
-"(<filename>file1</filename>), which is labeled with the "
-"<computeroutput>samba_share_t</computeroutput> type."
-msgstr ""
-
-#. Tag: term
-#, no-c-format
-msgid "Detailed Description"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"A more verbose description. In this example, <filename>file1</filename> is "
-"labeled with the <computeroutput>samba_share_t</computeroutput> type. This "
-"type is used for files and directories that you want to export via Samba. "
-"The description suggests changing the type to a type that can be accessed by "
-"the Apache HTTP Server and Samba, if such access is desired."
-msgstr ""
-
-#. Tag: term
-#, no-c-format
-msgid "Allowing Access"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"A suggestion for how to allow access. This may be relabeling files, turning "
-"a Boolean on, or making a local policy module. In this case, the suggestion "
-"is to label the file with a type accessible to both the Apache HTTP Server "
-"and Samba."
-msgstr ""
-
-#. Tag: term
-#, no-c-format
-msgid "Fix Command"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"A suggested command to allow access and resolve the denial. In this example, "
-"it gives the command to change the <filename>file1</filename> type to "
-"<computeroutput>public_content_t</computeroutput>, which is accessible to "
-"the Apache HTTP Server and Samba."
-msgstr ""
-
-#. Tag: term
-#, no-c-format
-msgid "Additional Information"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Information that is useful in bug reports, such as the policy package name "
-"and version (<computeroutput>selinux-policy-3.5.13-11.fc12</"
-"computeroutput>), but may not help towards solving why the denial occurred."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The raw audit messages from <filename>/var/log/audit/audit.log</filename> "
-"that are associated with the denial. Refer to <xref linkend=\"sect-Security-"
-"Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages\" /> for information about "
-"each item in the AVC denial."
-msgstr ""
-
-#. Tag: title
-#, no-c-format
-msgid "Allowing Access: audit2allow"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Do not use the example in this section in production. It is used only to "
-"demonstrate the use of <command>audit2allow</command>."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "From the"
-msgstr ""
-
-#. Tag: refentrytitle
-#, no-c-format
-msgid "audit2allow"
-msgstr ""
-
-#. Tag: citerefentry
-#, no-c-format
-msgid ""
-"manual page: \"<command>audit2allow</command> - generate SELinux policy "
-"allow rules from logs of denied operations\"<footnote> <para> From the "
-"<citerefentry><refentrytitle>audit2allow</refentrytitle><manvolnum>1</"
-"manvolnum></citerefentry> manual page, as shipped with the "
-"<package>policycoreutils</package> package in Fedora &PRODVER;. </para> "
-"</footnote>. After analyzing denials as per <xref linkend=\"sect-Security-"
-"Enhanced_Linux-Fixing_Problems-sealert_Messages\" />, and if no label "
-"changes or Booleans allowed access, use <command>audit2allow</command> to "
-"create a local policy module. After access is denied by SELinux, running the "
-"<command>audit2allow</command> command presents Type Enforcement rules that "
-"allow the previously denied access."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"The following example demonstrates using <command>audit2allow</command> to "
-"create a policy module:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"A denial and the associated system call are logged to <filename>/var/log/"
-"audit/audit.log</filename>:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"In this example, <application>certwatch</application> (<computeroutput>comm="
-"\"certwatch\"</computeroutput>) was denied write access (<computeroutput>"
-"{ write }</computeroutput>) to a directory labeled with the "
-"<computeroutput>var_t</computeroutput> type "
-"(<computeroutput>tcontext=system_u:object_r:var_t:s0</computeroutput>). "
-"Analyze the denial as per <xref linkend=\"sect-Security-Enhanced_Linux-"
-"Fixing_Problems-sealert_Messages\" />. If no label changes or Booleans "
-"allowed access, use <command>audit2allow</command> to create a local policy "
-"module."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"With a denial logged, such as the <computeroutput>certwatch</computeroutput> "
-"denial in step 1, run the <command>audit2allow -w -a</command> command to "
-"produce a human-readable description of why access was denied. The <option>-"
-"a</option> option causes all audit logs to be read. The <option>-w</option> "
-"option produces the human-readable description. The <command>audit2allow</"
-"command> tool accesses <filename>/var/log/audit/audit.log</filename>, and as "
-"such, must be run as the Linux root user:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid "As shown, access was denied due to a missing Type Enforcement rule."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Run the <command>audit2allow -a</command> command to view the Type "
-"Enforcement rule that allows the denied access:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Missing Type Enforcement rules are usually caused by bugs in SELinux policy, "
-"and should be reported in <ulink url=\"https://bugzilla.redhat.com/\">Red "
-"Hat Bugzilla</ulink>. For Fedora, create bugs against the "
-"<computeroutput>Fedora</computeroutput> product, and select the "
-"<computeroutput>selinux-policy</computeroutput> component. Include the "
-"output of the <command>audit2allow -w -a</command> and <command>audit2allow -"
-"a</command> commands in such bug reports."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"To use the rule displayed by <command>audit2allow -a</command>, run the "
-"<command>audit2allow -a -M <replaceable>mycertwatch</replaceable></command> "
-"command as the Linux root user to create custom module. The <option>-M</"
-"option> option creates a Type Enforcement file (<filename>.te</filename>) "
-"with the name specified with <option>-M</option>, in your current working "
-"directory:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Also, <command>audit2allow</command> compiles the Type Enforcement rule into "
-"a policy package (<filename>.pp</filename>). To install the module, run the "
-"<command>/usr/sbin/semodule -i <replaceable>mycertwatch.pp</replaceable></"
-"command> command as the Linux root user."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Modules created with <command>audit2allow</command> may allow more access "
-"than required. It is recommended that policy created with "
-"<command>audit2allow</command> be posted to an SELinux list, such as <ulink "
-"url=\"http://www.redhat.com/mailman/listinfo/fedora-selinux-list\">fedora-"
-"selinux-list</ulink>, for review. If you believe their is a bug in policy, "
-"create a bug in <ulink url=\"https://bugzilla.redhat.com/\">Red Hat "
-"Bugzilla</ulink>."
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"If you have multiple denials from multiple processes, but only want to "
-"create a custom policy for a single process, use the <command>grep</command> "
-"command to narrow down the input for <command>audit2allow</command>. The "
-"following example demonstrates using <command>grep</command> to only send "
-"denials related to <command>certwatch</command> through "
-"<command>audit2allow</command>:"
-msgstr ""
-
-#. Tag: para
-#, no-c-format
-msgid ""
-"Refer to Dan Walsh's <ulink url=\"http://danwalsh.livejournal.com/24750.html"
-"\">\"Using audit2allow to build policy modules. Revisited.\"</ulink> blog "
-"entry for further information about using <command>audit2allow</command> to "
-"build policy modules."
-msgstr ""
+# SOME DESCRIPTIVE TITLE.
+# FIRST AUTHOR <EMAIL at ADDRESS>, YEAR.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: SELinux User Guide\n"
+"Report-Msgid-Bugs-To: http://bugs.kde.org\n"
+"POT-Creation-Date: 2010-04-15T00:19:32\n"
+"PO-Revision-Date: 2010-11-20 13:29+0500\n"
+"Last-Translator: Alexey Cicin <daydrim at gmail.com>\n"
+"Language-Team: trans-ru <trans-ru at lists.fedoraproject.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Poedit-Language: Russian\n"
+"X-Poedit-Country: RUSSIAN FEDERATION\n"
+"X-Poedit-SourceCharset: utf-8\n"
+
+#. Tag: title
+#, no-c-format
+msgid "Troubleshooting"
+msgstr "ПоиÑк и уÑтранение неиÑправноÑтей"
+
+#. Tag: para
+#, no-c-format
+msgid "The following chapter describes what happens when SELinux denies access; the top three causes of problems; where to find information about correct labeling; analyzing SELinux denials; and creating custom policy modules with <command>audit2allow</command>."
+msgstr "Ð’ Ñледующей главе опиÑываетÑÑ, что проиÑходит, когда SELinux блокирует доÑтуп: проблемы в решении вызывают три оÑновных причины; где найти информацию о правильных метках; анализ отказов доÑтупа SELinux; и Ñоздание ÑпецифичеÑки наÑтроенных модулей Ñ Ð¿Ð¾Ð¼Ð¾Ñ‰ÑŒÑŽ <command>audit2allow</command>."
+
+#. Tag: title
+#, no-c-format
+msgid "What Happens when Access is Denied"
+msgstr "Что проиÑходит, когда блокируетÑÑ Ð´Ð¾Ñтуп"
+
+#. Tag: para
+#, no-c-format
+msgid "SELinux decisions, such as allowing or disallowing access, are cached. This cache is known as the Access Vector Cache (AVC). Denial messages are logged when SELinux denies access. These denials are also known as \"AVC denials\", and are logged to a different location, depending on which daemons are running:"
+msgstr "Ð ÐµÑˆÐµÐ½Ð¸Ñ SELinux, такие как предоÑтавление или блокирование доÑтупа, кÑшируютÑÑ. Ðтот кÑш называетÑÑ Access Vector Cache (AVC) или кÑш вектора доÑтупа. Ð¡Ð¾Ð¾Ð±Ñ‰ÐµÐ½Ð¸Ñ Ð¾ блокировании доÑтупа, журналируютÑÑ, когда SELinux блокирует доÑтуп. Ðти отказы называютÑÑ \"Блокировками AVC\" или \"AVC denials\" и журналируетÑÑ Ð² различные файлы, в завиÑимоÑти от того, какой демон запущен:"
+
+#. Tag: segtitle
+#, no-c-format
+msgid "Daemon"
+msgstr "Демон"
+
+#. Tag: segtitle
+#, no-c-format
+msgid "Log Location"
+msgstr "РаÑположение файлов Ñ Ð¶ÑƒÑ€Ð½Ð°Ð»Ð°Ð¼Ð¸ Ñобытий"
+
+#. Tag: seg
+#, no-c-format
+msgid "auditd on"
+msgstr "auditd on"
+
+#. Tag: seg
+#, no-c-format
+msgid "<filename>/var/log/audit/audit.log</filename>"
+msgstr "<filename>/var/log/audit/audit.log</filename>"
+
+#. Tag: seg
+#, no-c-format
+msgid "auditd off; rsyslogd on"
+msgstr "auditd off; rsyslogd on"
+
+#. Tag: seg
+#, no-c-format
+msgid "<filename>/var/log/messages</filename>"
+msgstr "<filename>/var/log/messages</filename>"
+
+#. Tag: seg
+#, no-c-format
+msgid "setroubleshootd, rsyslogd, and auditd on"
+msgstr "setroubleshootd, rsyslogd, and auditd on"
+
+#. Tag: seg
+#, no-c-format
+msgid "<filename>/var/log/audit/audit.log</filename>. Easier-to-read denial messages also sent to <filename>/var/log/messages</filename>"
+msgstr "<filename>/var/log/audit/audit.log</filename>. Проще читать ÑÐ¾Ð¾Ð±Ñ‰ÐµÐ½Ð¸Ñ Ð¾ блокировках, дублируемые в <filename>/var/log/messages</filename>"
+
+#. Tag: para
+#, no-c-format
+msgid "If you are running the X Window System, have the <package>setroubleshoot</package> and <package>setroubleshoot-server</package> packages installed, and the <systemitem class=\"daemon\">setroubleshootd</systemitem> and <systemitem class=\"daemon\">auditd</systemitem> daemons are running, a warning is displayed when access is denied by SELinux:"
+msgstr "ЕÑли запущена X Window System, а также уÑтановлены пакеты <package>setroubleshoot</package> и <package>setroubleshoot-server</package>, и демоны <systemitem class=\"daemon\">setroubleshootd</systemitem> и <systemitem class=\"daemon\">auditd</systemitem> запущены, то, когда SELinux блокирует доÑтуп, отображаетÑÑ Ð¿Ñ€ÐµÐ´ÑƒÐ¿Ñ€ÐµÐ¶Ð´ÐµÐ½Ð¸Ðµ:"
+
+#. Tag: para
+#, no-c-format
+msgid "Clicking on 'Show' presents a detailed analysis of why SELinux denied access, and a possible solution for allowing access. If you are not running the X Window System, it is less obvious when access is denied by SELinux. For example, users browsing your website may receive an error similar to the following:"
+msgstr "Ðажатие на 'Show' показывает детальный анализ причин, почему SELinux блокировал доÑтуп, и возможное решение Ð´Ð»Ñ Ð¾Ñ‚ÐºÑ€Ñ‹Ñ‚Ð¸Ñ Ð´Ð¾Ñтупа. ЕÑли ÑиÑтема X Window System не запущена, Ñобытие блокировки доÑтупа менее очевидно. Ðапример, пользователи проÑматривающие веб-Ñайт могут получить ошибку похожую, на показанную ниже:"
+
+#. Tag: para
+#, no-c-format
+msgid "For these situations, if DAC rules (standard Linux permissions) allow access, check <filename>/var/log/messages</filename> and <filename>/var/log/audit/audit.log</filename> for <computeroutput>\"SELinux is preventing\"</computeroutput> and <computeroutput>\"denied\"</computeroutput> errors respectively. This can be done by running the following commands as the Linux root user:"
+msgstr "Ð’ таких ÑитуациÑÑ…, еÑли правила DAC (Ñтандартные Ñ€Ð°Ð·Ñ€ÐµÑˆÐµÐ½Ð¸Ñ Linux) разрешают доÑтуп, проверьте файлы <filename>/var/log/messages</filename> и <filename>/var/log/audit/audit.log</filename> на ÑÐ¾Ð±Ñ‹Ñ‚Ð¸Ñ <computeroutput>\"SELinux is preventing\"</computeroutput> и <computeroutput>\"denied\"</computeroutput>. Ðто можно выполнить, выполнив Ñледующие команды от имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root:"
+
+#. Tag: para
+#, no-c-format
+msgid "<command>grep \"SELinux is preventing\" /var/log/messages</command>"
+msgstr "<command>grep \"SELinux is preventing\" /var/log/messages</command>"
+
+#. Tag: para
+#, no-c-format
+msgid "<command>grep \"denied\" /var/log/audit/audit.log</command>"
+msgstr "<command>grep \"denied\" /var/log/audit/audit.log</command>"
+
+#. Tag: title
+#, no-c-format
+msgid "Top Three Causes of Problems"
+msgstr "Три оÑновные причины Ð²Ð¾Ð·Ð½Ð¸ÐºÐ½Ð¾Ð²ÐµÐ½Ð¸Ñ Ð¿Ñ€Ð¾Ð±Ð»ÐµÐ¼"
+
+#. Tag: para
+#, no-c-format
+msgid "The following sections describe the top three causes of problems: labeling problems, configuring Booleans and ports for services, and evolving SELinux rules."
+msgstr "Ð’ Ñледующих разделах опиÑываютÑÑ Ñ‚Ñ€Ð¸ оÑновные причины Ð²Ð¾Ð·Ð½Ð¸ÐºÐ½Ð¾Ð²ÐµÐ½Ð¸Ñ Ð¿Ñ€Ð¾Ð±Ð»ÐµÐ¼: проблема меток, конфигурирование Булевых значений и портов Ð´Ð»Ñ Ñлужб; и отÑлеживание правил SELinux."
+
+#. Tag: title
+#, no-c-format
+msgid "Labeling Problems"
+msgstr "Проблема Меток (проблема маркированиÑ)"
+
+#. Tag: para
+#, no-c-format
+msgid "On systems running SELinux, all processes and files are labeled with a label that contains security-relevant information. This information is called the SELinux context. If these labels are wrong, access may be denied. If an application is labeled incorrectly, the process it transitions to may not have the correct label, possibly causing SELinux to deny access, and the process being able to create mislabeled files."
+msgstr "Ð’ ÑиÑтемах Ñ Ð·Ð°Ð¿ÑƒÑ‰ÐµÐ½Ð½Ñ‹Ð¼ SELinux, вÑе процеÑÑÑ‹ и файлы маркированы метками, которые Ñодержат информацию контекÑта безопаÑноÑти. Ðта Ð¸Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ Ð½Ð°Ð·Ñ‹Ð²Ð°ÐµÑ‚ÑÑ ÐºÐ¾Ð½Ñ‚ÐµÐºÑтом SELinux. ЕÑли Ñти метки некорректны, доÑтуп может блокироватьÑÑ. ЕÑли приложение маркировано некорректно, процеÑÑ Ð² который оно переходит может иметь некорректные метки, что возможно приведет к блокированию доÑтупа SELinux, и такой процеÑÑ Ð¼Ð¾Ð¶ÐµÑ‚ Ñоздать некорректно маркированные файлы."
+
+#. Tag: para
+#, no-c-format
+msgid "A common cause of labeling problems is when a non-standard directory is used for a service. For example, instead of using <filename>/var/www/html/</filename> for a website, an administrator wants to use <filename>/srv/myweb/</filename>. On Fedora &PRODVER;, the <filename>/srv/</filename> directory is labeled with the <computeroutput>var_t</computeroutput> type. Files and directories created and <filename>/srv/</filename> inherit this type. Also, newly-created top-level directories (such as <filename>/myserver/</filename>) may be labeled with the <computeroutput>default_t</computeroutput> type. SELinux prevents the Apache HTTP Server (<systemitem class=\"daemon\">httpd</systemitem>) from accessing both of these types. To allow access, SELinux must know that the files in <filename>/srv/myweb/</filename> are to be accessible to <systemitem class=\"daemon\">httpd</systemitem>:"
+msgstr "ОÑÐ½Ð¾Ð²Ð½Ð°Ñ Ð¿Ñ€Ð¸Ñ‡Ð¸Ð½Ð° проблем Ñ Ð¼Ð°Ñ€ÐºÐ¸Ñ€Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ - Ñто иÑпользование неÑтандартных каталогов Ð´Ð»Ñ Ñлужб. Ðапример, вмеÑто иÑÐ¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ <filename>/var/www/html/</filename> Ð´Ð»Ñ Ð²ÐµÐ±Ñайта, админиÑтратор может иÑпользовать <filename>/srv/myweb/</filename> Ð’ Fedora &PRODVER;, каталог <filename>/srv/</filename> помечен типом <computeroutput>var_t</computeroutput>. Файлы и каталоги Ñоздаваемые в <filename>/srv/</filename> наÑледуют Ñтот тип. Также вновь Ñозданные каталоги корневого уровнÑ, такие как <filename>/myserver/</filename>, могут быть помечены типом <computeroutput>default_t</computeroutput>. SELinux предотвращает Apache HTTP Server (<systemitem class=\"daemon\">httpd</systemit
em>) от Ð¿Ð¾Ð»ÑƒÑ‡ÐµÐ½Ð¸Ñ Ð´Ð¾Ñтупа к Ñтим типам. Ð”Ð»Ñ Ð¿Ñ€ÐµÐ´Ð¾ÑÑ‚Ð°Ð²Ð»ÐµÐ½Ð¸Ñ Ð´Ð¾Ñтупа, SELinux должен знать о том, что файлы в <filename>/srv/myweb/</filename> доÑтупны <systemitem class=\"daemon\">httpd</systemitem>:"
+
+#. Tag: para
+#, no-c-format
+msgid "This <command>semanage</command> command adds the context for the <filename>/srv/myweb/</filename> directory (and all files and directories under it) to the SELinux file-context configuration<footnote> <para> Files in <filename>/etc/selinux/targeted/contexts/files/</filename> define contexts for files and directories. Files in this directory are read by <command>restorecon</command> and <command>setfiles</command> to restore files and directories to their default contexts. </para> </footnote>. The <command>semanage</command> command does not change the context. As the Linux root user, run the <command>restorecon</command> command to apply the changes:"
+msgstr "Команда <command>semanage</command> добавлÑет контекÑÑ‚ к каталогу <filename>/srv/myweb/</filename> (и вÑем файлам и каталогам в нём) к конфигурации контекÑта SELinux<footnote> <para> Файлы в <filename>/etc/selinux/targeted/contexts/files/</filename> определÑÑŽÑ‚ контекÑÑ‚Ñ‹ Ð´Ð»Ñ Ñ„Ð°Ð¹Ð»Ð¾Ð² и каталогов. Файлы в Ñтом каталоге ÑчитываютÑÑ <command>restorecon</command> и <command>setfiles</command> Ð´Ð»Ñ Ð²Ð¾ÑÑÑ‚Ð°Ð½Ð¾Ð²Ð»ÐµÐ½Ð¸Ñ ÐºÐ¾Ð½Ñ‚ÐµÐºÑтов к их значениÑм по-умочанию. </para> </footnote>. Команда <command>semanage</command> не изменÑет контекÑта. От имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root, выполните команду <command>restorecon</command> Ð´Ð»Ñ Ð¿Ñ€Ð¸Ð¼ÐµÐ½ÐµÐ½Ð¸Ñ Ð¸Ð·Ð¼ÐµÐ½ÐµÐ½Ð¸Ð¹:"
+
+#. Tag: para
+#, no-c-format
+msgid "Refer to <xref linkend=\"sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext\" /> for further information about adding contexts to the file-context configuration."
+msgstr "Ð”Ð¾Ð¿Ð¾Ð»Ð½Ð¸Ñ‚ÐµÐ»ÑŒÐ½Ð°Ñ Ð¸Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸ о добавлении контекÑтов к конфигурации доÑтупна в разделе <xref linkend=\"sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext\" />."
+
+#. Tag: title
+#, no-c-format
+msgid "What is the Correct Context?"
+msgstr "Как определить правильный контекÑÑ‚?"
+
+#. Tag: para
+#, no-c-format
+msgid "The <command>matchpathcon</command> command checks the context of a file path and compares it to the default label for that path. The following example demonstrates using <command>matchpathcon</command> on a directory that contains incorrectly labeled files:"
+msgstr "Команда <command>matchpathcon</command> проверÑет контекÑÑ‚ Ð´Ð»Ñ Ñ„Ð°Ð¹Ð»Ð° и ÑверÑет Ñ ÐµÐ³Ð¾ контекÑтом по умолчанию. Ð’ Ñледующем примере демонÑтрируетÑÑ Ð¸Ñпользование <command>matchpathcon</command> Ð´Ð»Ñ ÐºÐ°Ñ‚Ð°Ð»Ð¾Ð³Ð°, который Ñодержит некорректно маркированные файлы:"
+
+#. Tag: para
+#, no-c-format
+msgid "In this example, the <filename>index.html</filename> and <filename>page1.html</filename> files are labeled with the <computeroutput>user_home_t</computeroutput> type. This type is used for files in user home directories. Using the <command>mv</command> command to move files from your home directory may result in files being labeled with the <computeroutput>user_home_t</computeroutput> type. This type should not exist outside of home directories. Use the <command>restorecon</command> command to restore such files to their correct type:"
+msgstr "Ð’ Ñтом примере файлы <filename>index.html</filename> и <filename>page1.html</filename> помечены типом <computeroutput>user_home_t</computeroutput>. Ðтот тип иÑпользуетÑÑ Ð´Ð»Ñ Ñ„Ð°Ð¹Ð»Ð¾Ð² в домашних каталогах пользователей. ИÑÐ¿Ð¾Ð»ÑŒÐ·ÑƒÑ ÐºÐ¾Ð¼Ð°Ð½Ð´Ñƒ <command>mv</command> Ð´Ð»Ñ Ð¿ÐµÑ€ÐµÐ¼ÐµÑ‰ÐµÐ½Ð¸Ñ Ñ„Ð°Ð¹Ð»Ð¾Ð² из вашего домашнего каталога может привеÑти к тому, что файлы будут маркированы типом <computeroutput>user_home_t</computeroutput>. Ðтот тип не должен ÑущеÑтвовать вне домашних каталогов. ИÑпользуйте команду <command>restorecon</command> Ð´Ð»Ñ Ð²Ð¾ÑÑÑ‚Ð°Ð½Ð¾Ð²Ð»ÐµÐ½Ð¸Ñ ÐºÐ¾Ñ€Ñ€ÐµÐºÑ‚Ð½Ð¾Ð³Ð¾ типа таких файлов:"
+
+#. Tag: para
+#, no-c-format
+msgid "To restore the context for all files under a directory, use the <option>-R</option> option:"
+msgstr "Ð”Ð»Ñ Ð²Ð¾ÑÑÑ‚Ð°Ð½Ð¾Ð²Ð»ÐµÐ½Ð¸Ñ ÐºÐ¾Ð½Ñ‚ÐµÐºÑта вÑех файлов в каталоге иÑпользуйте опцию <option>-R</option>:"
+
+#. Tag: para
+#, no-c-format
+msgid "Refer to <xref linkend=\"sect-Security-Enhanced_Linux-Maintaining_SELinux_Labels_-Checking_the_Default_SELinux_Context\" /> for a more detailed example of <command>matchpathcon</command>."
+msgstr "Дополнительные примеры иÑÐ¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ <command>matchpathcon</command> доÑтупны по ÑÑылке: <xref linkend=\"sect-Security-Enhanced_Linux-Maintaining_SELinux_Labels_-Checking_the_Default_SELinux_Context\" />."
+
+#. Tag: title
+#, no-c-format
+msgid "How are Confined Services Running?"
+msgstr "Как работают ограниченные Ñлужбы?"
+
+#. Tag: para
+#, no-c-format
+msgid "Services can be run in a variety of ways. To cater for this, you must tell SELinux how you are running services. This can be achieved via Booleans that allow parts of SELinux policy to be changed at runtime, without any knowledge of SELinux policy writing. This allows changes, such as allowing services access to NFS file systems, without reloading or recompiling SELinux policy. Also, running services on non-default port numbers requires policy configuration to be updated via the <command>semanage</command> command."
+msgstr "Службы могут работать в неÑкольких режимах. Ð”Ð»Ñ Ñ‚Ð¾Ð³Ð¾, чтобы обеÑпечить режимы, необходимо Ñообщить SELinux как необходимо запуÑкать Ñлужбы. Ðто может быть доÑтигнуто через Булевы переменные, которые позволÑÑŽÑ‚ чаÑÑ‚Ñм политики SELinux изменÑÑ‚ÑŒÑÑ Ð² рабочем режиме, без Ð¿Ð¾Ð½Ð¸Ð¼Ð°Ð½Ð¸Ñ Ð½Ð°Ð¿Ð¸ÑÐ°Ð½Ð¸Ñ Ð¿Ð¾Ð»Ð¸Ñ‚Ð¸ÐºÐ¸ SELinux. Ðто позволÑет вноÑить изменениÑ, такие, как доÑтуп к файловым ÑиÑтемам NFS, без перегрузки или рекомпилÑции политики SELinux. Также запуÑк Ñлужб на неÑтандартном порту требует Ð¸Ð·Ð¼ÐµÐ½ÐµÐ½Ð¸Ñ Ð¿Ð¾Ð»Ð¸Ñ‚Ð¸ÐºÐ¸ Ñ Ð¿Ð¾Ð¼Ð¾Ñ‰ÑŒÑŽ команды <command>semanage</command>."
+
+#. Tag: para
+#, no-c-format
+msgid "For example, to allow the Apache HTTP Server to communicate with MySQL, turn the <computeroutput>httpd_can_network_connect_db</computeroutput> Boolean on:"
+msgstr "Ðапример Ð´Ð»Ñ Ñ€Ð°Ð·Ñ€ÐµÑˆÐµÐ½Ð¸Ñ Apache HTTP Server ÑвÑзыватьÑÑ Ñ MySQL, переключите Булево значение <computeroutput>httpd_can_network_connect_db</computeroutput> в ÑоÑтоÑние включено (on):"
+
+#. Tag: para
+#, no-c-format
+msgid "If access is denied for a particular service, use the <command>getsebool</command> and <command>grep</command> commands to see if any Booleans are available to allow access. For example, use the <command>getsebool -a | grep ftp</command> command to search for FTP related Booleans:"
+msgstr "ЕÑли доÑтуп заблокирован Ð´Ð»Ñ Ð¾Ð¿Ñ€ÐµÐ´ÐµÐ»ÐµÐ½Ð½Ð¾Ð¹ Ñлужбы, иÑпользуйте команды <command>getsebool</command> и <command>grep</command>, Ð´Ð»Ñ Ð¿Ñ€Ð¾Ñмотра еÑÑ‚ÑŒ ли Булевы переменные Ð´Ð»Ñ Ð¿Ñ€ÐµÐ´Ð¾ÑÑ‚Ð°Ð²Ð»ÐµÐ½Ð¸Ñ Ð´Ð¾Ñтупа. Ðапример, иÑпользуйте команду <command>getsebool -a | grep ftp</command> Ð´Ð»Ñ Ð¿Ð¾Ð¸Ñка ÑоответÑтвующих Булевых значений Ð´Ð»Ñ FTP:"
+
+#. Tag: para
+#, no-c-format
+msgid "For a list of Booleans and whether they are on or off, run the <command>/usr/sbin/getsebool -a</command> command. For a list of Booleans, an explanation of what each one is, and whether they are on or off, run the <command>/usr/sbin/semanage boolean -l</command> command as the Linux root user. Refer to <xref linkend=\"sect-Security-Enhanced_Linux-Working_with_SELinux-Booleans\" /> for information about listing and configuring Booleans."
+msgstr "Ð”Ð»Ñ Ð¿Ñ€Ð¾Ñмотра Булевых значений и Ð¾Ð¿Ñ€ÐµÐ´ÐµÐ»ÐµÐ½Ð¸Ñ Ð²ÐºÐ»ÑŽÑ‡ÐµÐ½Ñ‹ они или выключены, выполните команду <command>/usr/sbin/getsebool -a</command>. Ð”Ð»Ñ Ð¿Ñ€Ð¾Ñмотра ÑпиÑка Булевых значений и Ð¾Ð¿Ñ€ÐµÐ´ÐµÐ»ÐµÐ½Ð¸Ñ Ð¸Ñ… назначениÑ, а также их ÑоÑтоÑниÑ, выполните команду <command>/usr/sbin/semanage boolean -l</command> от имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root. Ð”Ð¾Ð¿Ð¾Ð»Ð½Ð¸Ñ‚ÐµÐ»ÑŒÐ½Ð°Ñ Ð¸Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ Ð¾ ÑпиÑках и конфигурировании Булевых значений доÑтупна в разделе: <xref linkend=\"sect-Security-Enhanced_Linux-Working_with_SELinux-Booleans\" />"
+
+#. Tag: title
+#, no-c-format
+msgid "Port Numbers"
+msgstr "Ðомера портов"
+
+#. Tag: para
+#, no-c-format
+msgid "Depending on policy configuration, services may only be allowed to run on certain port numbers. Attempting to change the port a service runs on without changing policy may result in the service failing to start. For example, run the <command>semanage port -l | grep http</command> command as the Linux root user to list <systemitem class=\"daemon\">http</systemitem> related ports:"
+msgstr "Ð’ завиÑимоÑти от конфигурации политики, Ñлужбам может быть разрешено работать только на определенном диапазоне портов. Попытка изменить порт Ñлужбы без Ð¸Ð·Ð¼ÐµÐ½ÐµÐ½Ð¸Ñ Ð¿Ð¾Ð»Ð¸Ñ‚Ð¸ÐºÐ¸, может привеÑти к невозможноÑти запуÑка Ñлужбы. Ðапример, выполните команду <command>semanage port -l | grep http</command> от имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root Ð´Ð»Ñ Ð¿Ñ€Ð¾Ñмотра разрешенных портов отноÑÑщихÑÑ Ðº <systemitem class=\"daemon\">http</systemitem>:"
+
+#. Tag: para
+#, no-c-format
+msgid "The <computeroutput>http_port_t</computeroutput> port type defines the ports Apache HTTP Server can listen on, which in this case, are TCP ports 80, 443, 488, 8008, 8009, and 8443. If an administrator configures <filename>httpd.conf</filename> so that <systemitem class=\"daemon\">httpd</systemitem> listens on port 9876 (<option>Listen 9876</option>), but policy is not updated to reflect this, the <command>service httpd start</command> command fails:"
+msgstr "Тип порта <computeroutput>http_port_t</computeroutput> определÑет порт, который Apache HTTP Server может Ñлушать, которые, в нашем Ñлучае, TCP 80, 443,488, 8008, 8009 и 8443. ЕÑли админиÑтратор Ñконфигурировал <filename>httpd.conf</filename> так, что <systemitem class=\"daemon\">httpd</systemitem> Ñлушает порт 9876 (<option>Listen 9876</option>), но политика не обновлена в ÑоответÑтвии Ñ Ñтим изменением, то команда <command>service httpd start</command> завершитÑÑ Ñ Ð¾ÑˆÐ¸Ð±ÐºÐ¾Ð¹:"
+
+#. Tag: para
+#, no-c-format
+msgid "An SELinux denial similar to the following is logged to <filename>/var/log/audit/audit.log</filename>:"
+msgstr "Отказ в доÑтупе SELinux будет Ñхож Ñо Ñледующим Ñобытием, запиÑанным в <filename>/var/log/audit/audit.log</filename>:"
+
+#. Tag: para
+#, no-c-format
+msgid "To allow <systemitem class=\"daemon\">httpd</systemitem> to listen on a port that is not listed for the <computeroutput>http_port_t</computeroutput> port type, run the <command>semanage port</command> command to add a port to policy configuration<footnote> <para> The <command>semanage port -a</command> command adds an entry to the <filename>/etc/selinux/targeted/modules/active/ports.local</filename> file. Note: by default, this file can only be viewed by the Linux root user. </para> </footnote>:"
+msgstr "Ð”Ð»Ñ Ñ€Ð°Ð·Ñ€ÐµÑˆÐµÐ½Ð¸Ñ <systemitem class=\"daemon\">httpd</systemitem> Ñлушать порт, который не перечиÑлен в типе <computeroutput>http_port_t</computeroutput>, выполните команду <command>semanage port</command> Ð´Ð»Ñ Ð´Ð¾Ð±Ð°Ð²Ð»ÐµÐ½Ð¸Ñ Ð¿Ð¾Ñ€Ñ‚Ð° в политику<footnote> <para> Команда <command>semanage port -a</command> добавлÑет запиÑÑŒ в файл <filename>/etc/selinux/targeted/modules/active/ports.local</filename>. Примечание: по умолчанию, Ñтот файл может быть проÑмотрен только пользователем root. </para> </footnote>:"
+
+#. Tag: para
+#, no-c-format
+msgid "The <option>-a</option> option adds a new record; the <option>-t</option> option defines a type; and the <option>-p</option> option defines a protocol. The last argument is the port number to add."
+msgstr "ÐžÐ¿Ñ†Ð¸Ñ <option>-a</option> добавлÑет новую запиÑÑŒ; Ð¾Ð¿Ñ†Ð¸Ñ <option>-t</option> определÑет тип, а Ð¾Ð¿Ñ†Ð¸Ñ <option>-p</option> определÑет протокол. ПоÑледний аргумент - Ñто номер добавлÑемого порта."
+
+#. Tag: title
+#, no-c-format
+msgid "Evolving Rules and Broken Applications"
+msgstr "Разбор правил и Ð½Ð°Ñ€ÑƒÑˆÐµÐ½Ð½Ð°Ñ Ñ€Ð°Ð±Ð¾Ñ‚Ð° приложений"
+
+#. Tag: para
+#, no-c-format
+msgid "Applications may be broken, causing SELinux to deny access. Also, SELinux rules are evolving - SELinux may not have seen an application running in a certain way, possibly causing it to deny access, even though the application is working as expected. For example, if a new version of PostgreSQL is released, it may perform actions the current policy has not seen before, causing access to be denied, even though access should be allowed."
+msgstr "Работа Ð¿Ñ€Ð¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ñ Ð¼Ð¾Ð¶ÐµÑ‚ быть нарушена, по причине блокировок доÑтупа SELinux. Такие правила SELinux необходимо разбирать детально - SELinux может не определÑÑ‚ÑŒ приложение работающее по Ñвоим правилам, даже еÑли приложение работает в штатном режиме. Ðапример, еÑли выпущена Ð½Ð¾Ð²Ð°Ñ Ð²ÐµÑ€ÑÐ¸Ñ PostgreSQL, она может выполнÑÑ‚ÑŒ дейÑтвиÑ, о которых Ñ‚ÐµÐºÑƒÑ‰Ð°Ñ Ð¿Ð¾Ð»Ð¸Ñ‚Ð¸ÐºÐ° SELinux не знает, Ð¿Ñ€Ð¸Ð²Ð¾Ð´Ñ Ðº отказу в доÑтупе, даже еÑли доÑтуп должен быть предоÑтавлен."
+
+#. Tag: para
+#, no-c-format
+msgid "For these situations, after access is denied, use <command>audit2allow</command> to create a custom policy module to allow access. Refer to <xref linkend=\"sect-Security-Enhanced_Linux-Fixing_Problems-Allowing_Access_audit2allow\" /> for information about using <command>audit2allow</command>."
+msgstr "Ð”Ð»Ñ Ñ‚Ð°ÐºÐ¸Ñ… Ñитуаций, еÑли доÑтуп блокирован, иÑпользуйте <command>audit2allow</command> Ð´Ð»Ñ ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ Ñпецифичного Ð¼Ð¾Ð´ÑƒÐ»Ñ Ð¿Ð¾Ð»Ð¸Ñ‚Ð¸ÐºÐ¸ Ð´Ð»Ñ Ð¿Ñ€ÐµÐ´Ð¾ÑÑ‚Ð°Ð²Ð»ÐµÐ½Ð¸Ñ Ð´Ð¾Ñтупа. Ð”Ð¾Ð¿Ð¾Ð»Ð½Ð¸Ñ‚ÐµÐ»ÑŒÐ½Ð°Ñ Ð¸Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ Ð¾Ð± иÑпользовании <command>audit2allow</command> доÑтупна в разделе <xref linkend=\"sect-Security-Enhanced_Linux-Fixing_Problems-Allowing_Access_audit2allow\" />."
+
+#. Tag: title
+#, no-c-format
+msgid "Fixing Problems"
+msgstr "УÑтранение проблем"
+
+#. Tag: para
+#, no-c-format
+msgid "The following sections help troubleshoot issues. They go over: checking Linux permissions, which are checked before SELinux rules; possible causes of SELinux denying access, but no denials being logged; manual pages for services, which contain information about labeling and Booleans; permissive domains, for allowing one process to run permissive, rather than the whole system; how to search for and view denial messages; analyzing denials; and creating custom policy modules with <command>audit2allow</command>."
+msgstr "Ð’ Ñледующих разделах раÑÑматриваютÑÑ Ð²Ð¾Ð¿Ñ€Ð¾ÑÑ‹ поиÑка и уÑÑ‚Ñ€Ð°Ð½ÐµÐ½Ð¸Ñ Ð½ÐµÐ¸ÑправноÑтей и проблем. Ð’ них раÑÑматриваетÑÑ: проверка разрешений Linux, что должно проверÑÑ‚ÑŒÑÑ Ð¿ÐµÑ€ÐµÐ´ правилами SELinux; возможные причины блокировки доÑтупа SELinux, Ñ ÑƒÑловием отÑутÑÑ‚Ð²Ð¸Ñ Ñообщений в лог-файлах; Ñтраницы руководÑтва (manual pages) Ð´Ð»Ñ Ñлужб, которые Ñодержат информацию о метках и Булевых значениÑÑ…; разрешенные (permissive) домены, Ð´Ð»Ñ Ñ€Ð°Ð·Ñ€ÐµÑˆÐµÐ½Ð¸Ñ Ð¾Ð´Ð½Ð¾Ð¼Ñƒ процеÑÑу работать в разрешительном режиме, а не только вÑей ÑиÑтеме телеком; ÑпоÑобы поиÑка и проÑмотра Ñообщени
й об отказах в доÑтупе; анализ отказов в доÑтупе; и Ñоздание индивидуальных модулей политики Ñ Ð¿Ð¾Ð¼Ð¾Ñ‰ÑŒÑŽ <command>audit2allow</command>."
+
+#. Tag: title
+#, no-c-format
+msgid "Linux Permissions"
+msgstr "Ð Ð°Ð·Ñ€ÐµÑˆÐµÐ½Ð¸Ñ Linux"
+
+#. Tag: para
+#, no-c-format
+msgid "When access is denied, check standard Linux permissions. As mentioned in <xref linkend=\"chap-Security-Enhanced_Linux-Introduction\" />, most operating systems use a Discretionary Access Control (DAC) system to control access, allowing users to control the permissions of files that they own. SELinux policy rules are checked after DAC rules. SELinux policy rules are not used if DAC rules deny access first."
+msgstr "ЕÑли доÑтуп блокируетÑÑ, проверьте Ñтандартные Ñ€Ð°Ð·Ñ€ÐµÑˆÐµÐ½Ð¸Ñ Linux. Как упоминаетÑÑ Ð² <xref linkend=\"chap-Security-Enhanced_Linux-Introduction\" />, большинÑтво операционных ÑиÑтем иÑпользует ДиÑкреционный Контроль ДоÑтупа Discretionary Access Control (DAC) Ð´Ð»Ñ ÑƒÐ¿Ñ€Ð°Ð²Ð»ÐµÐ½Ð¸Ñ Ð´Ð¾Ñтупом, позволÑÑ Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñм контролировать Ñ€Ð°Ð·Ñ€ÐµÑˆÐµÐ½Ð¸Ñ Ð½Ð°Ð´ файлами, которыми они владеют. Правила политики SELinux проверÑÑŽÑ‚ÑÑ Ð¿Ð¾Ñле правил DAC. Правила политики SELinux не иÑпользуютÑÑ, еÑли правила DAC блокировали доÑтуп первыми."
+
+#. Tag: para
+#, no-c-format
+msgid "If access is denied and no SELinux denials are logged, use the <command>ls -l</command> command to view the standard Linux permissions:"
+msgstr "ЕÑли доÑтуп блокирован и нет никаких Ñообщений о блокировках SELinux, иÑпользуйте команду <command>ls -l</command> Ð´Ð»Ñ Ð¿Ñ€Ð¾Ñмотра Ñтандартных разрешений Linux:"
+
+#. Tag: para
+#, no-c-format
+msgid "In this example, <filename>index.html</filename> is owned by the root user and group. The root user has read and write permissions (<computeroutput>-rw</computeroutput>), and members of the root group have read permissions (<computeroutput>-r-</computeroutput>). Everyone else has no access (<computeroutput>---</computeroutput>). By default, such permissions do not allow <systemitem class=\"daemon\">httpd</systemitem> to read this file. To resolve this issue, use the <command>chown</command> command to change the owner and group. This command must be run as the Linux root user:"
+msgstr "Ð’ Ñтом примере, владельцем файла <filename>index.html</filename> ÑвлÑетÑÑ Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»ÑŒ и группа root. У Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root еÑÑ‚ÑŒ права на чтение и запиÑÑŒ (<computeroutput>-rw</computeroutput>), и у членов группы root еÑÑ‚ÑŒ разрешение на чтение (<computeroutput>-r-</computeroutput>). У группы Everyone нет доÑтупа (<computeroutput>---</computeroutput>). По умолчанию, такие Ñ€Ð°Ð·Ñ€ÐµÑˆÐµÐ½Ð¸Ñ Ð½Ðµ разрешают <systemitem class=\"daemon\">httpd</systemitem> читать Ñтот файл. Ð”Ð»Ñ Ñ€ÐµÑˆÐµÐ½Ð¸Ñ Ñтой проблемы, иÑпользуйте команду <command>chown</command> Ð´Ð»Ñ Ñмены владельца и группы. Ðта команда должна быть выполнена от имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root:"
+
+#. Tag: para
+#, no-c-format
+msgid "This assumes the default configuration, in which <systemitem class=\"daemon\">httpd</systemitem> runs as the Linux apache user. If you run <systemitem class=\"daemon\">httpd</systemitem> with a different user, replace <computeroutput>apache:apache</computeroutput> with that user."
+msgstr "Данные дейÑÑ‚Ð²Ð¸Ñ Ð¿Ð¾Ð´Ñ€Ð°Ð·ÑƒÐ¼ÐµÐ²Ð°ÑŽÑ‚ конфигурацию по умолчанию, в которой <systemitem class=\"daemon\">httpd</systemitem> работает от имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ apache. ЕÑли <systemitem class=\"daemon\">httpd</systemitem> запуÑкаетÑÑ Ð¾Ñ‚ имени другого пользователÑ, замените <computeroutput>apache:apache</computeroutput> на Ñтого пользователÑ."
+
+#. Tag: para
+#, no-c-format
+msgid "Refer to the <ulink url=\"http://fedoraproject.org/wiki/Docs/Drafts/AdministrationGuide/Permissions\">Fedora Documentation Project \"Permissions\"</ulink> draft for information about managing Linux permissions."
+msgstr "Ð”Ð¾Ð¿Ð¾Ð»Ð½Ð¸Ñ‚ÐµÐ»ÑŒÐ½Ð°Ñ Ð¸Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ Ð¾Ð± управлении разрешениÑми Linux доÑтупна по ÑÑылке <ulink url=\"http://fedoraproject.org/wiki/Docs/Drafts/AdministrationGuide/Permissions\">Fedora Documentation Project \"Permissions\"</ulink>."
+
+#. Tag: title
+#, no-c-format
+msgid "Possible Causes of Silent Denials"
+msgstr "Возможные причины блокировок без оповещениÑ"
+
+#. Tag: para
+#, no-c-format
+msgid "In certain situations, AVC denials may not be logged when SELinux denies access. Applications and system library functions often probe for more access than required to perform their tasks. To maintain least privilege without filling audit logs with AVC denials for harmless application probing, the policy can silence AVC denials without allowing a permission by using <computeroutput>dontaudit</computeroutput> rules. These rules are common in standard policy. The downside of <computeroutput>dontaudit</computeroutput> is that, although SELinux denies access, denial messages are not logged, making troubleshooting hard."
+msgstr "Ð’ некоторых ÑитуациÑÑ…, блокировки AVC могут не журналироватьÑÑ, когда SELinux блокирует доÑтуп. ÐŸÑ€Ð¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ñ Ð¸ функции ÑиÑтемных библиотек чаÑто требуют большего доÑтупа, чем нужно, Ð´Ð»Ñ Ð²Ñ‹Ð¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ Ñвоих задач. Ð”Ð»Ñ Ð¿Ð¾Ð´Ð´ÐµÑ€Ð¶ÐºÐ¸ минимальных доÑтупов без Ð·Ð°Ð¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ Ð¶ÑƒÑ€Ð½Ð°Ð»Ð¾Ð² аудита, блокировками AVC о безвредных запроÑах приложений, политика может выполнÑÑ‚ÑŒ блокировки AVC без Ñообщений, не Ñ€Ð°Ð·Ñ€ÐµÑˆÐ°Ñ Ð´Ð¾Ñтуп, иÑÐ¿Ð¾Ð»ÑŒÐ·ÑƒÑ Ð¿Ñ€Ð°Ð²Ð¸Ð»Ð° <computeroutput>dontaudit</computeroutput>. Ðти правила общие в Ñтандартной политике. ÐŸÐ»Ð¾Ñ…Ð°Ñ Ñторона <computeroutput>dontaudit</computeroutput> заключаетÑÑ Ð² Ñ‚Ð
¾Ð¼, что, Ñ…Ð¾Ñ‚Ñ SELinux блокирует доÑтуп, ÑÐ¾Ð¾Ð±Ñ‰ÐµÐ½Ð¸Ñ Ð¾ блокировке не журналируютÑÑ, таким образом, Ð´ÐµÐ»Ð°Ñ Ñ€Ð°Ð·Ð±Ð¾Ñ€ и уÑтранение ошибок Ñложным."
+
+#. Tag: para
+#, no-c-format
+msgid "To temporarily disable <computeroutput>dontaudit</computeroutput> rules, allowing all denials to be logged, run the following command as the Linux root user:"
+msgstr "Ð”Ð»Ñ Ð²Ñ€ÐµÐ¼ÐµÐ½Ð½Ð¾Ð³Ð¾ Ð¾Ñ‚ÐºÐ»ÑŽÑ‡ÐµÐ½Ð¸Ñ Ð¿Ñ€Ð°Ð²Ð¸Ð» <computeroutput>dontaudit</computeroutput>, позволÑющим вÑем блокировкам журналироватьÑÑ, выполните Ñледующую команду от имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root:"
+
+#. Tag: para
+#, no-c-format
+msgid "<command>/usr/sbin/semodule -DB</command>"
+msgstr "<command>/usr/sbin/semodule -DB</command>"
+
+#. Tag: para
+#, no-c-format
+msgid "The <option>-D</option> option disables <computeroutput>dontaudit</computeroutput> rules; the <option>-B</option> option rebuilds policy. After running <command>semodule -DB</command>, try exercising the application that was encountering permission problems, and see if SELinux denials — relevant to the application — are now being logged. Take care in deciding which denials should be allowed, as some should be ignored and handled via <computeroutput>dontaudit</computeroutput> rules. If in doubt, or in search of guidance, contact other SELinux users and developers on an SELinux list, such as <ulink url=\"http://www.redhat.com/mailman/listinfo/fedora-selinux-list\">fedora-selinux-list</ulink>."
+msgstr "ÐžÐ¿Ñ†Ð¸Ñ <option>-D</option> отключает правила <computeroutput>dontaudit</computeroutput>; Ð¾Ð¿Ñ†Ð¸Ñ <option>-B</option> переÑтраивает политику. ПоÑле Ð²Ñ‹Ð¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ ÐºÐ¾Ð¼Ð°Ð½Ð´Ñ‹ <command>semodule -DB</command>, попробуйте изучить приложение, вÑтречающее проблемы в разрешениÑÑ… и проÑмотрите блокировки SELinux — отноÑÑщиеÑÑ Ðº приложению —, которые теперь ÑодержатÑÑ Ð² лог-файлах. ПозаботьтеÑÑŒ о принÑтии решений, какие правила разрешить, а какие проигнорировать через правила <computeroutput>dontaudit</computeroutput>. ЕÑли еÑÑ‚ÑŒ ÑÐ¾Ð¼Ð½ÐµÐ½Ð¸Ñ Ð¸Ð»Ð¸ требуетÑÑ Ñовет, ÑвÑжитеÑÑŒ Ñ Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñми и разработчиками SELinux: <ulink url=\"
http://www.redhat.com/mailman/listinfo/fedora-selinux-list\">fedora-selinux-list</ulink>."
+
+#. Tag: para
+#, no-c-format
+msgid "To rebuild policy and enable <computeroutput>dontaudit</computeroutput> rules, run the following command as the Linux root user:"
+msgstr "Ð”Ð»Ñ Ð¿ÐµÑ€ÐµÑтройки политики и Ð²ÐºÐ»ÑŽÑ‡ÐµÐ½Ð¸Ñ Ð¿Ñ€Ð°Ð²Ð¸Ð» <computeroutput>dontaudit</computeroutput>, выполните команду от имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root:"
+
+#. Tag: para
+#, no-c-format
+msgid "<command>/usr/sbin/semodule -B</command>"
+msgstr "<command>/usr/sbin/semodule -B</command>"
+
+#. Tag: para
+#, no-c-format
+msgid "This restores the policy to its original state. For a full list of <computeroutput>dontaudit</computeroutput> rules, run the <command>sesearch --dontaudit</command> command. Narrow down searches using the <option>-s <replaceable>domain</replaceable></option> option and the <command>grep</command> command. For example:"
+msgstr "Ð”Ð°Ð½Ð½Ð°Ñ ÐºÐ¾Ð¼Ð°Ð½Ð´Ð° воÑÑтанавливает политику к её иÑходному ÑоÑтоÑнию. Ð”Ð»Ñ Ð²Ñ‹Ð²Ð¾Ð´Ð° вÑех правил <computeroutput>dontaudit</computeroutput>, выполните команду <command>sesearch --dontaudit</command>. Сузить поиÑк можно Ñ Ð¸Ñпользованием опции <option>-s <replaceable>domain</replaceable></option> и команды <command>grep</command>. Ðапример:"
+
+#. Tag: para
+#, no-c-format
+msgid "Refer to <xref linkend=\"sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages\" /> and <xref linkend=\"sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages\" /> for information about analyzing denials."
+msgstr "Ð˜Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ Ð¾Ð± анализе блокировок доÑтупна в разделах: <xref linkend=\"sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages\" /> and <xref linkend=\"sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages\" />."
+
+#. Tag: title
+#, no-c-format
+msgid "Manual Pages for Services"
+msgstr "Cтраницы руководÑтва (manual pages) Ð´Ð»Ñ Ñлужб"
+
+#. Tag: para
+#, no-c-format
+msgid "Manual pages for services contain valuable information, such as what file type to use for a given situation, and Booleans to change the access a service has (such as <systemitem class=\"daemon\">httpd</systemitem> accessing NFS file systems). This information may be in the standard manual page, or a manual page with <computeroutput>selinux</computeroutput> prepended or appended."
+msgstr "Страницы руководÑтва Ð´Ð»Ñ Ñлужб Ñодержат важную информацию, такую как, какой тип файла иÑпользуетÑÑ Ð² определенной Ñитуации, и какие Булевы переменные необходимо изменить Ð´Ð»Ñ Ð¿Ñ€ÐµÐ´Ð¾ÑÑ‚Ð°Ð²Ð»ÐµÐ½Ð¸Ñ Ð´Ð¾Ñтупа Ñлужбе (такой как <systemitem class=\"daemon\">httpd</systemitem>, получающей доÑтуп к файловым ÑиÑтемам NFS). Ð˜Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ Ð¼Ð¾Ð¶ÐµÑ‚ быть в Ñтандартной Ñтранице руководÑтва или Ñтранице руководÑтва Ñ Ð´Ð¾Ð±Ð°Ð²Ð»ÐµÐ½Ð½Ñ‹Ð¼ разделом <computeroutput>selinux</computeroutput>."
+
+#. Tag: para
+#, no-c-format
+msgid "For example, the"
+msgstr "Ðапример, Ñтраница руководÑтва"
+
+#. Tag: refentrytitle
+#, no-c-format
+msgid "httpd_selinux"
+msgstr "httpd_selinux"
+
+#. Tag: citerefentry
+#, no-c-format
+msgid "manual page has information about what file type to use for a given situation, as well as Booleans to allow scripts, sharing files, accessing directories inside user home directories, and so on. Other manual pages with SELinux information for services include:"
+msgstr "Ñодержит информацию о том, какой тип файла иÑпользуетÑÑ, какие Булевы переменные разрешают Ñкрипты, публикацию файлов, доÑтуп к каталогам внутри домашних каталогов и так далее. Другие Ñтраницы руководÑтва Ñ Ð¸Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸ÐµÐ¹ о SELinux Ð´Ð»Ñ Ñлужб включают:"
+
+#. Tag: para
+#, no-c-format
+msgid "Samba: the"
+msgstr "Samba: Ñтраница руководÑтва"
+
+#. Tag: refentrytitle
+#, no-c-format
+msgid "samba_selinux"
+msgstr "samba_selinux"
+
+#. Tag: citerefentry
+#, no-c-format
+msgid "manual page describes that files and directories to be exported via Samba must be labeled with the <computeroutput>samba_share_t</computeroutput> type, as well as Booleans to allow files labeled with types other than <computeroutput>samba_share_t</computeroutput> to be exported via Samba."
+msgstr "Ñодержит информацию о файлах и каталогах, которые могут быть ÑкÑпортированы через Ñамбу, помеченные типом <computeroutput>samba_share_t</computeroutput>, а также о Булевых переменных, разрешающих ÑкÑпортировать через Samba файлы помеченные типом отличным от <computeroutput>samba_share_t</computeroutput>."
+
+#. Tag: para
+#, no-c-format
+msgid "NFS: the"
+msgstr "NFS: Ñтраница руководÑтва"
+
+#. Tag: refentrytitle
+#, no-c-format
+msgid "nfs_selinux"
+msgstr "nfs_selinux"
+
+#. Tag: citerefentry
+#, no-c-format
+msgid "manual page describes that, by default, file systems can not be exported via NFS, and that to allow file systems to be exported, Booleans such as <computeroutput>nfs_export_all_ro</computeroutput> or <computeroutput>nfs_export_all_rw</computeroutput> must be turned on."
+msgstr "Ñодержит информацию о том, что по умолчанию файловые ÑиÑтемы не могут быть ÑкÑпортированы через NFS; и Ð´Ð»Ñ Ñ€Ð°Ð·Ñ€ÐµÑˆÐµÐ½Ð¸Ñ ÑкÑпорта файловых ÑиÑтем, Булевы переменные, такие как <computeroutput>nfs_export_all_ro</computeroutput> или <computeroutput>nfs_export_all_rw</computeroutput> должны быть включены."
+
+#. Tag: para
+#, no-c-format
+msgid "Berkeley Internet Name Domain (BIND): the"
+msgstr "Berkeley Internet Name Domain (BIND): Ñтраница руководÑтва"
+
+#. Tag: refentrytitle
+#, no-c-format
+msgid "named"
+msgstr "named"
+
+#. Tag: citerefentry
+#, no-c-format
+msgid "manual page describes what file type to use for a given situation (see the <computeroutput>Red Hat SELinux BIND Security Profile</computeroutput> section). The"
+msgstr "Ñодержит информацию о том, какой тип файла иÑпользуетÑÑ Ð² данной Ñитуации (раздел <computeroutput>Red Hat SELinux BIND Security Profile</computeroutput> section). Страница руководÑтва"
+
+#. Tag: refentrytitle
+#, no-c-format
+msgid "named_selinux"
+msgstr "named_selinux"
+
+#. Tag: citerefentry
+#, no-c-format
+msgid "manual page describes that, by default, <systemitem class=\"daemon\">named</systemitem> can not write to master zone files, and to allow such access, the <computeroutput>named_write_master_zones</computeroutput> Boolean must be turned on."
+msgstr "Ñодержит информацию о том, что по умолчанию, <systemitem class=\"daemon\">named</systemitem> не может оÑущеÑтвлÑÑ‚ÑŒ запиÑÑŒ в файлы зон, и Ð´Ð»Ñ Ñ€Ð°Ð·Ñ€ÐµÑˆÐµÐ½Ð¸Ñ Ñ‚Ð°ÐºÐ¾Ð³Ð¾ доÑтупа Булева Ð¿ÐµÑ€ÐµÐ¼ÐµÐ½Ð½Ð°Ñ <computeroutput>named_write_master_zones</computeroutput> должна быть включена."
+
+#. Tag: para
+#, no-c-format
+msgid "The information in manual pages helps you configure the correct file types and Booleans, helping to prevent SELinux from denying access."
+msgstr "Ð˜Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ Ð² Ñтраницах руководÑтва помогает наÑтроить корректные типы файлов и Булевы переключатели, Ð¿Ñ€ÐµÐ´Ð¾Ñ‚Ð²Ñ€Ð°Ñ‰Ð°Ñ SELinux от Ð±Ð»Ð¾ÐºÐ¸Ñ€Ð¾Ð²Ð°Ð½Ð¸Ñ Ð´Ð¾Ñтупа."
+
+#. Tag: title
+#, no-c-format
+msgid "Permissive Domains"
+msgstr "Разрешающие домены (Permissive Domains)"
+
+#. Tag: para
+#, no-c-format
+msgid "When SELinux is running in permissive mode, SELinux does not deny access, but denials are logged for actions that would have been denied if running in enforcing mode. Previously, it was not possible to make a single domain permissive (remember: processes run in domains). In certain situations, this led to making the whole system permissive to troubleshoot issues."
+msgstr "Когда SELinux запущен в разрешающем режиме, SELinux не блокирует доÑтуп, но блокировки журналируютÑÑ ÐºÐ°Ðº дейÑтвиÑ, которые были бы блокированы, еÑли запущен принудительный режим. Раньше, не было возможноÑти Ñделать определенный домен разрешающим (помните: процеÑÑÑ‹ запуÑкаютÑÑ Ð² доменах). Ð’ некоторых ÑитуациÑÑ…, Ñто ведет к тому, чтобы Ñделать вÑÑŽ ÑиÑтему разрешающей Ð´Ð»Ñ Ð´Ð¸Ð°Ð³Ð½Ð¾Ñтики и иÑÐ¿Ñ€Ð°Ð²Ð»ÐµÐ½Ð¸Ñ Ð¾ÑˆÐ¸Ð±Ð¾Ðº."
+
+#. Tag: para
+#, no-c-format
+msgid "Fedora &PRODVER; includes permissive domains, where an administrator can configure a single process (domain) to run permissive, rather than making the whole system permissive. SELinux checks are still performed for permissive domains; however, the kernel allows access and reports an AVC denial for situations where SELinux would have denied access. Permissive domains are also available in Fedora 9 (with the latest updates applied)."
+msgstr "Fedora &PRODVER; включает разрешающие домены, где админиÑтратор может Ñконфигурировать определенный процеÑÑ (домен) Ð´Ð»Ñ Ð·Ð°Ð¿ÑƒÑка в разрешающем режиме, вмеÑто того, чтобы вÑÑŽ ÑиÑтему перевеÑти в разрешающий режим. SELinux вÑÑ‘ равно выполнÑет проверки разрешающих доменов; однако, Ñдро предоÑтавлÑет доÑтуп и Ñообщает AVC об отказах в доÑтупе, когда SELinux блокирует доÑтуп. Разрешающие домены доÑтупны также и в Fedora 9 (Ñ ÑƒÑтановленными поÑледними обновлениÑми)."
+
+#. Tag: para
+#, no-c-format
+msgid "In Red Hat Enterprise Linux 4 and 5, <computeroutput><replaceable>domain</replaceable>_disable_trans</computeroutput> Booleans are available to prevent an application from transitioning to a confined domain, and therefore, the process runs in an unconfined domain, such as <computeroutput>initrc_t</computeroutput>. Turning such Booleans on can cause major problems. For example, if the <computeroutput>httpd_disable_trans</computeroutput> Boolean is turned on:"
+msgstr "Ð’ Red Hat Enterprise Linux 4 and 5, доÑтупны Булевы переключатели <computeroutput><replaceable>domain</replaceable>_disable_trans</computeroutput> Ð´Ð»Ñ Ð¿Ñ€ÐµÐ´Ð¾Ñ‚Ð²Ñ€Ð°Ñ‰ÐµÐ½Ð¸Ñ Ð¿Ñ€Ð¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹ Ð²Ñ‹Ð¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ Ð¿ÐµÑ€ÐµÑ…Ð¾Ð´Ð¾Ð² (transitions) в ограниченный домен, кроме того, процеÑÑ, запуÑкаетÑÑ Ð² неограниченном домене, таком как <computeroutput>initrc_t</computeroutput>. ÐаÑтройка подобных Булевых значений может привеÑти к возникновению значительных проблем. Ðапример, еÑли Булево значение <computeroutput>httpd_disable_trans</computeroutput> включено:"
+
+#. Tag: para
+#, no-c-format
+msgid "<systemitem class=\"daemon\">httpd</systemitem> runs in the unconfined <computeroutput>initrc_t</computeroutput> domain. Files created by processes running in the <computeroutput>initrc_t</computeroutput> domain may not have the same labeling rules applied as files created by a process running in the <computeroutput>httpd_t</computeroutput> domain, potentially allowing processes to create mislabeled files. This causes access problems later on."
+msgstr "<systemitem class=\"daemon\">httpd</systemitem> запуÑтитÑÑ Ð² неограниченном <computeroutput>initrc_t</computeroutput> домене. Файлы Ñозданные таким процеÑÑом, запущенном в <computeroutput>initrc_t</computeroutput> домене, могут не получить меток безопаÑноÑти, которые получат файлы, Ñозданные в домене <computeroutput>httpd_t</computeroutput>, потенциально позволÑÑ Ð¿Ñ€Ð¾Ñ†ÐµÑÑам Ñоздавать некорректно промаркированные файлы. Ð’ дальнейшем такие Ñитуации вызывают проблемы."
+
+#. Tag: para
+#, no-c-format
+msgid "confined domains that are allowed to communicate with <computeroutput>httpd_t</computeroutput> can not communicate with <computeroutput>initrc_t</computeroutput>, possibly causing additional failures."
+msgstr "ограниченный домены, которым разрешено взаимодейÑтвовать Ñ <computeroutput>httpd_t</computeroutput>, не разрешено взаимодейÑтвовать Ñ <computeroutput>initrc_t</computeroutput>, возможно такие Ñитуации приводÑÑ‚ к дополнительным проблемам."
+
+#. Tag: para
+#, no-c-format
+msgid "The <computeroutput><replaceable>domain</replaceable>_disable_trans</computeroutput> Booleans were removed from Fedora 7, even though there was no replacement. Permissive domains solve the above issues: transition rules apply, and files are created with the correct labels."
+msgstr "Булевы Ð·Ð½Ð°Ñ‡ÐµÐ½Ð¸Ñ <computeroutput><replaceable>domain</replaceable>_disable_trans</computeroutput> были удалены из Fedora 7, и Ð´Ð»Ñ Ð½Ð¸Ñ… не подразумеваетÑÑ Ð½Ð¸ÐºÐ°ÐºÐ¾Ð¹ замены. Разрешающие домены решают подобные Ñитуации: правила переходов применÑÑŽÑ‚ÑÑ Ð¸ файлы ÑоздаютÑÑ Ñ ÐºÐ¾Ñ€Ñ€ÐµÐºÑ‚Ð½Ñ‹Ð¼Ð¸ метками."
+
+#. Tag: para
+#, no-c-format
+msgid "Permissive domains can be used for:"
+msgstr "Разрешающие домены могут быть иÑпользованы длÑ:"
+
+#. Tag: para
+#, no-c-format
+msgid "making a single process (domain) run permissive to troubleshoot an issue, rather than putting the entire system at risk by making the entire system permissive."
+msgstr "ПеревеÑти работу определенного процеÑÑа (домена) в разрешающий режим Ð´Ð»Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° и выÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð¿Ñ€Ð¾Ð±Ð»ÐµÐ¼, вмеÑто Ð¿Ð¾Ð´Ð²ÐµÑ€Ð¶ÐµÐ½Ð¸Ñ Ñ€Ð¸Ñку целой ÑиÑтемы, заÑчет перевода ÑиÑтемы в разрешающий режим."
+
+#. Tag: para
+#, no-c-format
+msgid "creating policies for new applications. Previously, it was recommended that a minimal policy be created, and then the entire machine put into permissive mode, so that the application could run, but SELinux denials still logged. <command>audit2allow</command> could then be used to help write the policy. This put the whole system at risk. With permissive domains, only the domain in the new policy can be marked permissive, without putting the whole system at risk."
+msgstr "ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ Ð¿Ð¾Ð»Ð¸Ñ‚Ð¸Ðº Ð´Ð»Ñ Ð½Ð¾Ð²Ð¾Ð³Ð¾ приложениÑ. Раньше, рекомендовалоÑÑŒ, Ñоздавать минимальную политику, и затем вÑÑ Ð¼Ð°ÑˆÐ¸Ð½Ð° перемещалаÑÑŒ в разрешающий режим, так, чтобы Ð¿Ñ€Ð¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ñ Ð¼Ð¾Ð³Ð»Ð¾ выполнитьÑÑ, но блокировки SELinux вÑÑ‘ равно логировалиÑÑŒ. Дальше команда <command>audit2allow</command> могла быть иÑпользована Ð´Ð»Ñ ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ Ð¿Ð¾Ð»Ð¸Ñ‚Ð¸ÐºÐ¸. Ðто делает вÑÑŽ ÑиÑтему уÑзвимой. С иÑпользованием разрешающих доменов, только домен в новой политике помечаетÑÑ ÐºÐ°Ðº разрешающий, без риÑка уÑзвимоÑти вÑей ÑиÑтемы."
+
+#. Tag: title
+#, no-c-format
+msgid "Making a Domain Permissive"
+msgstr "Подготовка разрешающего домена"
+
+#. Tag: para
+#, no-c-format
+msgid "To make a domain permissive, run the <command>semanage permissive -a <replaceable>domain</replaceable></command> command, where <replaceable>domain</replaceable> is the domain you want to make permissive. For example, run the following command as the Linux root user to make the <computeroutput>httpd_t</computeroutput> domain (the domain the Apache HTTP Server runs in) permissive:"
+msgstr "Ð”Ð»Ñ Ñ‚Ð¾Ð³Ð¾ чтобы Ñделать домен разрешающим, необходимо выполнить команду <command>semanage permissive -a <replaceable>domain</replaceable></command>, где <replaceable>domain</replaceable> - Ñто домен, который нужно Ñделать разрешающим. Ðапример, выполнение Ñледующей команды от имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root, Ñделает домен <computeroutput>httpd_t</computeroutput> (домен, в котором запуÑкаетÑÑ Apache HTTP Server) разрешающим:"
+
+#. Tag: para
+#, no-c-format
+msgid "<command>/usr/sbin/semanage permissive -a httpd_t</command>"
+msgstr "<command>/usr/sbin/semanage permissive -a httpd_t</command>"
+
+#. Tag: para
+#, no-c-format
+msgid "To view a list of domains you have made permissive, run the <command>semodule -l | grep permissive</command> command as the Linux root user. For example:"
+msgstr "Ð”Ð»Ñ Ð¿Ñ€Ð¾Ñмотра доменов, работающих в разрешающем режиме, выполните команду <command>semodule -l | grep permissive</command> от имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root. Ðапример:"
+
+#. Tag: para
+#, no-c-format
+msgid "If you no longer want a domain to be permissive, run the <command>semanage permissive -d <replaceable>domain</replaceable></command> command as the Linux root user. For example:"
+msgstr "ЕÑли вам больше не требуетÑÑ ÑущеÑтвование разрешающего домена, выполните команду <command>semanage permissive -d <replaceable>domain</replaceable></command> от имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root. Ðапример:"
+
+#. Tag: para
+#, no-c-format
+msgid "<command>/usr/sbin/semanage permissive -d httpd_t</command>"
+msgstr "<command>/usr/sbin/semanage permissive -d httpd_t</command>"
+
+#. Tag: title
+#, no-c-format
+msgid "Denials for Permissive Domains"
+msgstr "Блокировки Ð´Ð»Ñ Ð Ð°Ð·Ñ€ÐµÑˆÐ°ÑŽÑ‰Ð¸Ñ… доменов"
+
+#. Tag: para
+#, no-c-format
+msgid "The <computeroutput>SYSCALL</computeroutput> message is different for permissive domains. The following is an example AVC denial (and the associated system call) from the Apache HTTP Server:"
+msgstr "Сообщение <computeroutput>SYSCALL</computeroutput> отличаетÑÑ Ð´Ð»Ñ Ñ€Ð°Ð·Ñ€ÐµÑˆÐ°ÑŽÑ‰Ð¸Ñ… доменов. Ðиже показан пример блокировки AVC (и ÑоответÑтвующего ÑиÑтемного вызова) от Apache HTTP Server:"
+
+#. Tag: para
+#, no-c-format
+msgid "By default, the <computeroutput>httpd_t</computeroutput> domain is not permissive, and as such, the action is denied, and the <computeroutput>SYSCALL</computeroutput> message contains <computeroutput>success=no</computeroutput>. The following is an example AVC denial for the same situation, except the <command>semanage permissive -a httpd_t</command> command has been run to make the <computeroutput>httpd_t</computeroutput> domain permissive:"
+msgstr "По умолчанию, домен <computeroutput>httpd_t</computeroutput> не разрешающий и, как ÑледÑтвие, дейÑтвие блокируетÑÑ Ð¸ Ñообщение <computeroutput>SYSCALL</computeroutput> Ñодержит <computeroutput>success=no</computeroutput>. Ðиже показан пример блокировки AVC Ð´Ð»Ñ Ñ‚Ð°ÐºÐ¾Ð¹ же Ñитуации, за иÑключением выполненной команды <command>semanage permissive -a httpd_t</command> Ð´Ð»Ñ Ð·Ð°Ð¿ÑƒÑка домена <computeroutput>httpd_t</computeroutput> в разрешающем режиме:"
+
+#. Tag: para
+#, no-c-format
+msgid "In this case, although an AVC denial was logged, access was not denied, as shown by <computeroutput>success=yes</computeroutput> in the <computeroutput>SYSCALL</computeroutput> message."
+msgstr "Ð’ Ñтом Ñлучае, неÑÐ¼Ð¾Ñ‚Ñ€Ñ Ð½Ð° то, что блокировка AVC запиÑана, доÑтуп не блокирован, как показано в Ñообщении <computeroutput>SYSCALL</computeroutput> <computeroutput>success=yes</computeroutput>."
+
+#. Tag: para
+#, no-c-format
+msgid "Refer to Dan Walsh's <ulink url=\"http://danwalsh.livejournal.com/24537.html\">\"Permissive Domains\"</ulink> blog entry for further information about permissive domains."
+msgstr "Ð”Ð¾Ð¿Ð¾Ð»Ð½Ð¸Ñ‚ÐµÐ»ÑŒÐ½Ð°Ñ Ð¸Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ Ð² блоге Dan Walsh <ulink url=\"http://danwalsh.livejournal.com/24537.html\">\"Permissive Domains\"</ulink> о разрешающих доменах."
+
+#. Tag: title
+#, no-c-format
+msgid "Searching For and Viewing Denials"
+msgstr "ПоиÑк и проÑмотр блокировок"
+
+#. Tag: para
+#, no-c-format
+msgid "This section assumes the <package>setroubleshoot</package>, <package>setroubleshoot-server</package>, <package>dbus</package> and <package>audit</package> packages are installed, and that the <systemitem class=\"daemon\">auditd</systemitem>, <systemitem class=\"daemon\">rsyslogd</systemitem>, and <systemitem class=\"daemon\">setroubleshootd</systemitem> daemons are running. Refer to <xref linkend=\"sect-Security-Enhanced_Linux-Working_with_SELinux-Which_Log_File_is_Used\" /> for information about starting these daemons. A number of tools are available for searching for and viewing SELinux denials, such as <command>ausearch</command>, <command>aureport</command>, and <command>sealert</command>."
+msgstr "Ð’ Ñтом разделе предполагаетÑÑ, что пакеты <package>setroubleshoot</package>, <package>setroubleshoot-server</package>, <package>dbus</package> и <package>audit</package> уÑтановлены, и демоны <systemitem class=\"daemon\">auditd</systemitem>, <systemitem class=\"daemon\">rsyslogd</systemitem> и <systemitem class=\"daemon\">setroubleshootd</systemitem> запущены. Ð’ ÑоответÑтвии Ñ Ñ€Ð°Ð·Ð´ÐµÐ»Ð¾Ð¼ <xref linkend=\"sect-Security-Enhanced_Linux-Working_with_SELinux-Which_Log_File_is_Used\" /> об информации о запуÑке Ñтих демонов. ЧаÑÑ‚ÑŒ Ñтих утилит иÑпользуетÑÑ Ð´Ð»Ñ Ð¿Ð¾Ð¸Ñка и проÑмотра блокировок SELinux, такие как <command>ausearch</command>, <command>aureport</command> и <command>sealert</command>."
+
+#. Tag: title
+#, no-c-format
+msgid "ausearch"
+msgstr "ausearch"
+
+#. Tag: para
+#, no-c-format
+msgid "The <package>audit</package> package provides <command>ausearch</command>. From the"
+msgstr "Пакет <package>audit</package> предоÑтавлÑет <command>ausearch</command>. Из"
+
+#. Tag: citerefentry
+#, no-c-format
+msgid "manual page: \"<command>ausearch</command> is a tool that can query the audit daemon logs based for events based on different search criteria\"<footnote> <para> From the <citerefentry><refentrytitle>ausearch</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as shipped with the <package>audit</package> package in Fedora &PRODVER;. </para> </footnote>. The <command>ausearch</command> tool accesses <filename>/var/log/audit/audit.log</filename>, and as such, must be run as the Linux root user:"
+msgstr "Ñтраницы руководÑтва : \"<command>ausearch</command> - Ñто инÑтрумент который запрашивает логи демона аудита, поÑтроенных на ÑобытиÑÑ…, оÑнованных на различных критериÑÑ… поиÑка\"<footnote> <para> Из <citerefentry><refentrytitle>ausearch</refentrytitle><manvolnum>8</manvolnum></citerefentry> Ñтраницы руководÑтва, поÑтавлÑемой Ñ Ð¿Ð°ÐºÐµÑ‚Ð¾Ð¼ <package>audit</package> в Fedora &PRODVER;. </para> </footnote>. ИнÑтрумент <command>ausearch</command> запрашивает <filename>/var/log/audit/audit.log</filename> и, как ÑледÑтвие, должен быть запущен от имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root:"
+
+#. Tag: segtitle
+#, no-c-format
+msgid "Searching For"
+msgstr "ПоиÑк"
+
+#. Tag: segtitle
+#, no-c-format
+msgid "Command"
+msgstr "Команда"
+
+#. Tag: seg
+#, no-c-format
+msgid "all denials"
+msgstr "вÑе блокировки"
+
+#. Tag: seg
+#, no-c-format
+msgid "<command>/sbin/ausearch -m avc</command>"
+msgstr "<command>/sbin/ausearch -m avc</command>"
+
+#. Tag: seg
+#, no-c-format
+msgid "denials for that today"
+msgstr "блокировки за ÑегоднÑшний день"
+
+#. Tag: seg
+#, no-c-format
+msgid "<command>/sbin/ausearch -m avc -ts today</command>"
+msgstr "<command>/sbin/ausearch -m avc -ts today</command>"
+
+#. Tag: seg
+#, no-c-format
+msgid "denials from the last 10 minutes"
+msgstr "блокировки за поÑледние 10 минут"
+
+#. Tag: seg
+#, no-c-format
+msgid "<command>/sbin/ausearch -m avc -ts recent</command>"
+msgstr "<command>/sbin/ausearch -m avc -ts recent</command>"
+
+#. Tag: para
+#, no-c-format
+msgid "To search for SELinux denials for a particular service, use the <option>-c <replaceable>comm-name</replaceable></option> option, where <replaceable>comm-name</replaceable> \"is the executable’s name\"<footnote> <para> From the <citerefentry><refentrytitle>ausearch</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as shipped with the <package>audit</package> package in Fedora &PRODVER;. </para> </footnote>, for example, <systemitem class=\"daemon\">httpd</systemitem> for the Apache HTTP Server, and <systemitem class=\"daemon\">smbd</systemitem> for Samba:"
+msgstr "Ð”Ð»Ñ Ð¿Ð¾Ð¸Ñка блокировок SELinux Ð´Ð»Ñ Ð¾Ð¿Ñ€ÐµÐ´ÐµÐ»ÐµÐ½Ð½Ð¾Ð¹ Ñлужбы, иÑпользуетÑÑ Ð¾Ð¿Ñ†Ð¸Ñ <option>-c <replaceable>comm-name</replaceable></option>, где <replaceable>comm-name</replaceable> \"иÑполнÑемое Ð¸Ð¼Ñ Ñ„Ð°Ð¹Ð»Ð°\"<footnote> <para> из Ñтраницы руководÑтва <citerefentry><refentrytitle>ausearch</refentrytitle><manvolnum>8</manvolnum></citerefentry>, поÑтавлÑемой Ñ Ð¿Ð°ÐºÐµÑ‚Ð¾Ð¼ <package>audit</package> в Fedora &PRODVER;. </para> </footnote>, например, <systemitem class=\"daemon\">httpd</systemitem> Ð´Ð»Ñ Apache HTTP Server и <systemitem class=\"daemon\">smbd</systemitem> Ð´Ð»Ñ Samba:"
+
+#. Tag: para
+#, no-c-format
+msgid "<command>/sbin/ausearch -m avc -c httpd</command>"
+msgstr "<command>/sbin/ausearch -m avc -c httpd</command>"
+
+#. Tag: para
+#, no-c-format
+msgid "<command>/sbin/ausearch -m avc -c smbd</command>"
+msgstr "<command>/sbin/ausearch -m avc -c smbd</command>"
+
+#. Tag: para
+#, no-c-format
+msgid "Refer to the"
+msgstr "Ð’ ÑоответÑтвии Ñо"
+
+#. Tag: citerefentry
+#, no-c-format
+msgid "manual page for further <command>ausearch</command> options."
+msgstr "Ñтраницей руководÑтва <command>ausearch</command>."
+
+#. Tag: title
+#, no-c-format
+msgid "aureport"
+msgstr "aureport"
+
+#. Tag: para
+#, no-c-format
+msgid "The <package>audit</package> package provides <command>aureport</command>. From the"
+msgstr "Пакет <package>audit</package> предоÑтавлÑет <command>aureport</command>. Из"
+
+#. Tag: citerefentry
+#, no-c-format
+msgid "manual page: \"<command>aureport</command> is a tool that produces summary reports of the audit system logs\"<footnote> <para> From the <citerefentry><refentrytitle>aureport</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as shipped with the <package>audit</package> package in Fedora &PRODVER;. </para> </footnote>. The <command>aureport</command> tool accesses <filename>/var/log/audit/audit.log</filename>, and as such, must be run as the Linux root user. To view a list of SELinux denials and how often each one occurred, run the <command>aureport -a</command> command. The following is example output that includes two denials:"
+msgstr "Ñтраницы руководÑтва : \"<command>aureport</command> - Ñто утилита, Ñ„Ð¾Ñ€Ð¼Ð¸Ñ€ÑƒÑŽÑ‰Ð°Ñ Ð¾Ñ‚Ñ‡ÐµÑ‚Ñ‹ ÑиÑтемных журналов аудита\"<footnote> <para> Из Ñтраницы руководÑтва <citerefentry><refentrytitle>aureport</refentrytitle><manvolnum>8</manvolnum></citerefentry>, поÑтавлÑемой Ñ Ð¿Ð°ÐºÐµÑ‚Ð¾Ð¼ <package>audit</package> в Fedora &PRODVER;. </para> </footnote>. Утилита <command>aureport</command> запрашивает <filename>/var/log/audit/audit.log</filename>, а также должны быть запущена от имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root. Ð”Ð»Ñ Ð¿Ñ€Ð¾Ñмотра ÑпиÑка блокировок SELinux, а также как чаÑто ÐºÐ°Ð¶Ð´Ð°Ñ Ð¸Ð· них возникает, выполните команду <command>aureport -a</command>. Ð’ Ñледующем примере, показан вывод Ñ Ð´Ð²ÑƒÐ¼Ñ Ð±Ð»Ð¾ÐºÐ¸Ñ€Ð¾Ð²ÐºÐ°Ð¼Ð
¸:"
+
+#. Tag: citerefentry
+#, no-c-format
+msgid "manual page for further <command>aureport</command> options."
+msgstr "Ñтраница руководÑтва <command>aureport</command> Ñ Ð´Ð¾Ð¿Ð¾Ð»Ð½Ð¸Ñ‚ÐµÐ»ÑŒÐ½Ñ‹Ð¼Ð¸ опциÑми."
+
+#. Tag: title
+#, no-c-format
+msgid "sealert"
+msgstr "sealert"
+
+#. Tag: para
+#, no-c-format
+msgid "The <package>setroubleshoot-server</package> package provides <command>sealert</command>, which reads denial messages translated by <package>setroubleshoot-server</package>. Denials are assigned IDs, as seen in <filename>/var/log/messages</filename>. The following is an example denial from <filename>messages</filename>:"
+msgstr "Пакет <package>setroubleshoot-server</package> предоÑтавлÑет <command>sealert</command>, ÐºÐ¾Ñ‚Ð¾Ñ€Ð°Ñ Ñ‡Ð¸Ñ‚Ð°ÐµÑ‚ ÑÐ¾Ð¾Ð±Ñ‰ÐµÐ½Ð¸Ñ Ð¾ блокировках, транÑлированные <package>setroubleshoot-server</package>. Блокировкам назначаютÑÑ ID, как показано в <filename>/var/log/messages</filename>. Ðиже показан пример блокировки из <filename>messages</filename>:"
+
+#. Tag: para
+#, no-c-format
+msgid "In this example, the denial ID is <computeroutput>84e0b04d-d0ad-4347-8317-22e74f6cd020</computeroutput>. The <option>-l</option> option takes an ID as an argument. Running the <command>sealert -l 84e0b04d-d0ad-4347-8317-22e74f6cd020</command> command presents a detailed analysis of why SELinux denied access, and a possible solution for allowing access."
+msgstr "Ð’ Ñтом примере, ID блокировки <computeroutput>84e0b04d-d0ad-4347-8317-22e74f6cd020</computeroutput>. ÐžÐ¿Ñ†Ð¸Ñ <option>-l</option> берет ID в качеÑтве аргумента. ЗапуÑк команды <command>sealert -l 84e0b04d-d0ad-4347-8317-22e74f6cd020</command> покажет детальный анализ причины, почему SELinux блокировал доÑтуп и возможное решение предоÑÑ‚Ð°Ð²Ð»ÐµÐ½Ð¸Ñ Ð´Ð¾Ñтупа."
+
+#. Tag: para
+#, no-c-format
+msgid "If you are running the X Window System, have the <package>setroubleshoot</package> and <package>setroubleshoot-server</package> packages installed, and the <systemitem class=\"daemon\">setroubleshootd</systemitem>, <systemitem class=\"daemon\">dbus</systemitem> and <systemitem class=\"daemon\">auditd</systemitem> daemons are running, a warning is displayed when access is denied by SELinux. Clicking on 'Show' launches the <command>sealert</command> GUI, and displays denials in HTML output:"
+msgstr "ЕÑли запущена X Window System, и уÑтановлены пакеты <package>setroubleshoot</package> и <package>setroubleshoot-server</package>, а также демоны <systemitem class=\"daemon\">setroubleshootd</systemitem>, <systemitem class=\"daemon\">dbus</systemitem> и <systemitem class=\"daemon\">auditd</systemitem> запущены, то при блокировке доÑтупа SELinux будет показано предупреждение. Ðажмите 'Show', Ñто запуÑтит GUI <command>sealert</command> и покажет блокировку в HTML формате:"
+
+#. Tag: para
+#, no-c-format
+msgid "Run the <command>sealert -b</command> command to launch the <command>sealert</command> GUI."
+msgstr "Выполните команду <command>sealert -b</command> Ð´Ð»Ñ Ð·Ð°Ð¿ÑƒÑка GUI <command>sealert</command>."
+
+#. Tag: para
+#, no-c-format
+msgid "Run the <command>sealert -l \\*</command> command to view a detailed analysis of all denials."
+msgstr "Выполните команду <command>sealert -l \\*</command> Ð´Ð»Ñ Ð¿Ñ€Ð¾Ñмотра детального анализа вÑех блокировок."
+
+#. Tag: para
+#, no-c-format
+msgid "As the Linux root user, run the <command>sealert -a /var/log/audit/audit.log -H > audit.html</command> command to create a HTML version of the <command>sealert</command> analysis, as seen with the <command>sealert</command> GUI."
+msgstr "От имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root, выполните команду <command>sealert -a /var/log/audit/audit.log -H > audit.html</command> Ð´Ð»Ñ ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ HTML верÑии анализа <command>sealert</command>, как показано в GUI <command>sealert</command>."
+
+#. Tag: citerefentry
+#, no-c-format
+msgid "manual page for further <command>sealert</command> options."
+msgstr "Ñтраница руководÑтва <command>sealert</command> Ñ Ð´Ð¾Ð¿Ð¾Ð»Ð½Ð¸Ñ‚ÐµÐ»ÑŒÐ½Ñ‹Ð¼Ð¸ опциÑми."
+
+#. Tag: title
+#, no-c-format
+msgid "Raw Audit Messages"
+msgstr "Ðеобработанные ÑÐ¾Ð¾Ð±Ñ‰ÐµÐ½Ð¸Ñ Ð°ÑƒÐ´Ð¸Ñ‚Ð°"
+
+#. Tag: para
+#, no-c-format
+msgid "Raw audit messages are logged to <filename>/var/log/audit/audit.log</filename>. The following is an example AVC denial (and the associated system call) that occurred when the Apache HTTP Server (running in the <computeroutput>httpd_t</computeroutput> domain) attempted to access the <filename>/var/www/html/file1</filename> file (labeled with the <computeroutput>samba_share_t</computeroutput> type):"
+msgstr "Ðеобработанные ÑÐ¾Ð¾Ð±Ñ‰ÐµÐ½Ð¸Ñ Ð°ÑƒÐ´Ð¸Ñ‚Ð° запиÑываютÑÑ Ð² <filename>/var/log/audit/audit.log</filename>. Ðиже показан пример блокировки AVC (и ÑвÑзанный Ñ Ñтим ÑиÑтемный вызов), которые поÑвлÑÑŽÑ‚ÑÑ, когда Apache HTTP Server (запущенный в домене <computeroutput>httpd_t</computeroutput>) запрашивает доÑтуп к файлу <filename>/var/www/html/file1</filename> (маркированный типом <computeroutput>samba_share_t</computeroutput>):"
+
+#. Tag: term
+#, no-c-format
+msgid "<replaceable>{ getattr }</replaceable>"
+msgstr "<replaceable>{ getattr }</replaceable>"
+
+#. Tag: para
+#, no-c-format
+msgid "The item in braces indicates the permission that was denied. <computeroutput>getattr</computeroutput> indicates the source process was trying to read the target file's status information. This occurs before reading files. This action is denied due to the file being accessed having the wrong label. Commonly seen permissions include <computeroutput>getattr</computeroutput>, <computeroutput>read</computeroutput>, and <computeroutput>write</computeroutput>."
+msgstr "Ðлемент в Ñкобках показывает информацию о том, что доÑтуп был блокирован. <computeroutput>getattr</computeroutput> показывает информацию о том, что процеÑÑ-иÑточник пыталÑÑ Ð¿Ñ€Ð¾Ñ‡ÐµÑÑ‚ÑŒ информацию о ÑтатуÑе файла. Ðто проиÑходит перед чтением файла. Ðто дейÑтвие было блокировано, так как файл, к которому запрашивалÑÑ Ð´Ð¾Ñтуп, был промаркирован неправильной меткой. Обычно Ñ€Ð°Ð·Ñ€ÐµÑˆÐµÐ½Ð¸Ñ Ð½Ð° проÑмотр включают: <computeroutput>getattr</computeroutput>, <computeroutput>read</computeroutput> и <computeroutput>write</computeroutput>."
+
+#. Tag: term
+#, no-c-format
+msgid "comm=\"<replaceable>httpd</replaceable>\""
+msgstr "comm=\"<replaceable>httpd</replaceable>\""
+
+#. Tag: para
+#, no-c-format
+msgid "The executable that launched the process. The full path of the executable is found in the <computeroutput>exe=</computeroutput> section of the system call (<computeroutput>SYSCALL</computeroutput>) message, which in this case, is <computeroutput>exe=\"/usr/sbin/httpd\"</computeroutput>."
+msgstr "ИÑполнÑемый файл, который запуÑкает процеÑÑ. Полный путь к иÑполнÑемому файлу находитÑÑ Ð² разделе <computeroutput>exe=</computeroutput> ÑÐ¾Ð¾Ð±Ñ‰ÐµÐ½Ð¸Ñ ÑиÑтемного вызова (<computeroutput>SYSCALL</computeroutput>), который в Ñтом Ñлучае <computeroutput>exe=\"/usr/sbin/httpd\"</computeroutput>."
+
+#. Tag: term
+#, no-c-format
+msgid "path=\"<replaceable>/var/www/html/file1</replaceable>\""
+msgstr "path=\"<replaceable>/var/www/html/file1</replaceable>\""
+
+#. Tag: para
+#, no-c-format
+msgid "The path to the object (target) the process attempted to access."
+msgstr "Путь к объекту (target) процеÑÑ Ð·Ð°Ð¿Ñ€Ð°ÑˆÐ¸Ð²Ð°ÑŽÑ‰Ð¸Ð¹ доÑтуп."
+
+#. Tag: term
+#, no-c-format
+msgid "scontext=\"<replaceable>unconfined_u:system_r:httpd_t:s0</replaceable>\""
+msgstr "scontext=\"<replaceable>unconfined_u:system_r:httpd_t:s0</replaceable>\""
+
+#. Tag: para
+#, no-c-format
+msgid "The SELinux context of the process that attempted the denied action. In this case, it is the SELinux context of the Apache HTTP Server, which is running in the <computeroutput>httpd_t</computeroutput> domain."
+msgstr "контекÑÑ‚ SELinux процеÑÑа, который выполнÑет блокированное дейÑтвие. Ð’ данном Ñлучае, Ñто контекÑÑ‚ SELinux процеÑÑа Apache HTTP Server, запущенный в домене <computeroutput>httpd_t</computeroutput>."
+
+#. Tag: term
+#, no-c-format
+msgid "tcontext=\"<replaceable>unconfined_u:object_r:samba_share_t:s0</replaceable>\""
+msgstr "context=\"<replaceable>unconfined_u:object_r:samba_share_t:s0</replaceable>\""
+
+#. Tag: para
+#, no-c-format
+msgid "The SELinux context of the object (target) the process attempted to access. In this case, it is the SELinux context of <filename>file1</filename>. Note: the <computeroutput>samba_share_t</computeroutput> type is not accessible to processes running in the <computeroutput>httpd_t</computeroutput> domain."
+msgstr "КонтекÑÑ‚ SELinux объекта (цели, target) процеÑÑа, запрашивающего доÑтуп. Ð’ данном Ñлучае - Ñто контекÑÑ‚ SELinux файла <filename>file1</filename>. Примечание: тип <computeroutput>samba_share_t</computeroutput> не доÑтупен процеÑÑам, запущенным в <computeroutput>httpd_t</computeroutput> домене."
+
+#. Tag: para
+#, no-c-format
+msgid "In certain situations, the <computeroutput>tcontext</computeroutput> may match the <computeroutput>scontext</computeroutput>, for example, when a process attempts to execute a system service that will change characteristics of that running process, such as the user ID. Also, the <computeroutput>tcontext</computeroutput> may match the <computeroutput>scontext</computeroutput> when a process tries to use more resources (such as memory) than normal limits allow, resulting in a security check to see if that process is allowed to break those limits."
+msgstr "Ð’ определенных ÑитуациÑÑ…, <computeroutput>tcontext</computeroutput> может Ñовпадать Ñ <computeroutput>scontext</computeroutput>, например, еÑли процеÑÑ Ð¿Ñ‹Ñ‚Ð°ÐµÑ‚ÑÑ Ð²Ñ‹Ð¿Ð¾Ð»Ð½Ð¸Ñ‚ÑŒ ÑиÑтемную Ñлужбу, ÐºÐ¾Ñ‚Ð¾Ñ€Ð°Ñ Ð¸Ð·Ð¼ÐµÐ½Ñет характериÑтики Ñтого, запущенного процеÑÑа, такого как ID пользователÑ. Также <computeroutput>tcontext</computeroutput> может Ñовпадать Ñ <computeroutput>scontext</computeroutput>, когда процеÑÑ Ð¿Ñ‹Ñ‚Ð°ÐµÑ‚ÑÑ Ð¸Ñпользовать больше реÑурÑов (например, памÑти) чем позволÑет лимит, что приводит к проверке безопаÑноÑти, может ли такой процеÑÑ Ð¿Ñ€ÐµÐ¾Ð´Ð¾Ð»ÐµÑ‚ÑŒ данное ограничение."
+
+#. Tag: para
+#, no-c-format
+msgid "From the system call (<computeroutput>SYSCALL</computeroutput>) message, two items are of interest:"
+msgstr "Из ÑÐ¾Ð¾Ð±Ñ‰ÐµÐ½Ð¸Ñ ÑиÑтемного вызова (<computeroutput>SYSCALL</computeroutput>), интереÑны два пункта:"
+
+#. Tag: para
+#, no-c-format
+msgid "<computeroutput>success=<replaceable>no</replaceable></computeroutput>: indicates whether the denial (AVC) was enforced or not. <computeroutput>success=no</computeroutput> indicates the system call was not successful (SELinux denied access). <computeroutput>success=yes</computeroutput> indicates the system call was successful - this can be seen for permissive domains or unconfined domains, such as <computeroutput>initrc_t</computeroutput> and <computeroutput>kernel_t</computeroutput>."
+msgstr "<computeroutput>success=<replaceable>no</replaceable></computeroutput>: показывает была ли блокировка (AVC) принудительна или нет. <computeroutput>success=no</computeroutput> показывает, что ÑиÑтемный вызов не был выполнен уÑпешно (SELinux блокировал доÑтуп). <computeroutput>success=yes</computeroutput> показывает, что ÑиÑтемный вызов был выполнен уÑпешно - такое Ñобытие можно увидеть Ð´Ð»Ñ Ñ€Ð°Ð·Ñ€ÐµÑˆÐ°ÑŽÑ‰Ð¸Ñ… доменов или неограниченных доменов, таких как <computeroutput>initrc_t</computeroutput> и <computeroutput>kernel_t</computeroutput>."
+
+#. Tag: para
+#, no-c-format
+msgid "<computeroutput>exe=\"<replaceable>/usr/sbin/httpd</replaceable>\"</computeroutput>: the full path to the executable that launched the process, which in this case, is <computeroutput>exe=\"/usr/sbin/httpd\"</computeroutput>."
+msgstr "<computeroutput>exe=\"<replaceable>/usr/sbin/httpd</replaceable>\"</computeroutput>: полный путь к иÑполнÑемому файлу, который запуÑкает процеÑÑ, который в данном Ñлучае <computeroutput>exe=\"/usr/sbin/httpd\"</computeroutput>."
+
+#. Tag: para
+#, no-c-format
+msgid "An incorrect file type is a common cause for SELinux denying access. To start troubleshooting, compare the source context (<computeroutput>scontext</computeroutput>) with the target context (<computeroutput>tcontext</computeroutput>). Should the process (<computeroutput>scontext</computeroutput>) be accessing such an object (<computeroutput>tcontext</computeroutput>)? For example, the Apache HTTP Server (<computeroutput>httpd_t</computeroutput>) should only be accessing types specified in the"
+msgstr "Ðекорректный тип файла - Ñто оÑÐ½Ð¾Ð²Ð½Ð°Ñ Ð¿Ñ€Ð¸Ñ‡Ð¸Ð½Ð°, Ð´Ð»Ñ Ð±Ð»Ð¾ÐºÐ¸Ñ€Ð¾Ð²Ð¾Ðº доÑтупа SELinux. Ð”Ð»Ñ Ð½Ð°Ñ‡Ð°Ð»Ð° анализа и уÑÑ‚Ñ€Ð°Ð½ÐµÐ½Ð¸Ñ Ð¿Ñ€Ð¾Ð±Ð»ÐµÐ¼, Ñравните иÑходных контекÑÑ‚ (<computeroutput>scontext</computeroutput>) Ñ Ñ†ÐµÐ»ÐµÐ²Ñ‹Ð¼ контекÑтом (<computeroutput>tcontext</computeroutput>). Должен ли процеÑÑ (<computeroutput>scontext</computeroutput>) получать доÑтуп к объекту (<computeroutput>tcontext</computeroutput>)? Ðапример, Apache HTTP Server (<computeroutput>httpd_t</computeroutput>) должен получать доÑтуп только к файлам указанным в"
+
+#. Tag: citerefentry
+#, no-c-format
+msgid "manual page, such as <computeroutput>httpd_sys_content_t</computeroutput>, <computeroutput>public_content_t</computeroutput>, and so on, unless configured otherwise."
+msgstr "Ñтранице руководÑтва, таким как <computeroutput>httpd_sys_content_t</computeroutput>, <computeroutput>public_content_t</computeroutput> и так далее, еÑли не Ñконфигурировано иное."
+
+#. Tag: title
+#, no-c-format
+msgid "sealert Messages"
+msgstr "Ð¡Ð¾Ð¾Ð±Ñ‰ÐµÐ½Ð¸Ñ sealert"
+
+#. Tag: para
+#, no-c-format
+msgid "Denials are assigned IDs, as seen in <filename>/var/log/messages</filename>. The following is an example AVC denial (logged to <filename>messages</filename>) that occurred when the Apache HTTP Server (running in the <computeroutput>httpd_t</computeroutput> domain) attempted to access the <filename>/var/www/html/file1</filename> file (labeled with the <computeroutput>samba_share_t</computeroutput> type):"
+msgstr "Блокировкам приÑваиваютÑÑ ID, как видно в <filename>/var/log/messages</filename>. Ðиже показан пример блокировки AVC (журналированной в <filename>messages</filename>), ÐºÐ¾Ñ‚Ð¾Ñ€Ð°Ñ Ð²Ð¾Ð·Ð½Ð¸ÐºÐ°ÐµÑ‚ когда Apache HTTP Server (запущенный в домене <computeroutput>httpd_t</computeroutput>) пытаетÑÑ Ð¿Ð¾Ð»ÑƒÑ‡Ð¸Ñ‚ÑŒ доÑтуп к файлу <filename>/var/www/html/file1</filename> (маркированный типом <computeroutput>samba_share_t</computeroutput>):"
+
+#. Tag: para
+#, no-c-format
+msgid "As suggested, run the <command>sealert -l 84e0b04d-d0ad-4347-8317-22e74f6cd020</command> command to view the complete message. This command only works on the local machine, and presents the same information as the <command>sealert</command> GUI:"
+msgstr "ПодразумеваетÑÑ, что выполнение команды <command>sealert -l 84e0b04d-d0ad-4347-8317-22e74f6cd020</command> покажет Ñообщение целиком. Ðта команда работает только на локальной машине и показывает аналогичную информацию Ñ <command>sealert</command> GUI:"
+
+#. Tag: term
+#, no-c-format
+msgid "Summary"
+msgstr "ÐšÑ€Ð°Ñ‚ÐºÐ°Ñ Ñводка"
+
+#. Tag: para
+#, no-c-format
+msgid "A brief summary of the denied action. This is the same as the denial in <filename>/var/log/messages</filename>. In this example, the <systemitem class=\"daemon\">httpd</systemitem> process was denied access to a file (<filename>file1</filename>), which is labeled with the <computeroutput>samba_share_t</computeroutput> type."
+msgstr "ÐšÑ€Ð°Ñ‚ÐºÐ°Ñ Ñводка дейÑÑ‚Ð²Ð¸Ñ Ð±Ð»Ð¾ÐºÐ¸Ñ€Ð¾Ð²ÐºÐ¸. Ðто та же ÑÐ°Ð¼Ð°Ñ Ð±Ð»Ð¾ÐºÐ¸Ñ€Ð¾Ð²ÐºÐ°, что и в <filename>/var/log/messages</filename>. Ð’ Ñтом примере процеÑÑ <systemitem class=\"daemon\">httpd</systemitem> блокирует доÑтуп к файлу (<filename>file1</filename>), который помечен типом <computeroutput>samba_share_t</computeroutput>."
+
+#. Tag: term
+#, no-c-format
+msgid "Detailed Description"
+msgstr "Детальное опиÑание"
+
+#. Tag: para
+#, no-c-format
+msgid "A more verbose description. In this example, <filename>file1</filename> is labeled with the <computeroutput>samba_share_t</computeroutput> type. This type is used for files and directories that you want to export via Samba. The description suggests changing the type to a type that can be accessed by the Apache HTTP Server and Samba, if such access is desired."
+msgstr "Более полное опиÑание. Ð’ Ñтом примере <filename>file1</filename> помечен типом <computeroutput>samba_share_t</computeroutput>. Ðтот тип иÑпользуетÑÑ Ð´Ð»Ñ Ñ„Ð°Ð¹Ð»Ð¾Ð² и каталогов, которые необходимо ÑкÑпортировать через Samba. ОпиÑание подразумевает изменение типа на тип, который может быть доÑтупен Ð´Ð»Ñ Apache HTTP Server и Samba, еÑли доÑтуп блокируетÑÑ."
+
+#. Tag: term
+#, no-c-format
+msgid "Allowing Access"
+msgstr "ПредоÑтавление доÑтупа"
+
+#. Tag: para
+#, no-c-format
+msgid "A suggestion for how to allow access. This may be relabeling files, turning a Boolean on, or making a local policy module. In this case, the suggestion is to label the file with a type accessible to both the Apache HTTP Server and Samba."
+msgstr "ÐŸÑ€ÐµÐ´Ð¿Ð¾Ð»Ð¾Ð¶ÐµÐ½Ð¸Ñ ÐºÐ°Ðº можно разрешить доÑтуп. Ðто можно Ñделать Ñ Ð¿Ð¾Ð¼Ð¾Ñ‰ÑŒÑŽ перемаркировки файлов, Ð²ÐºÐ»ÑŽÑ‡ÐµÐ½Ð¸Ñ Ð‘ÑƒÐ»ÐµÐ²Ñ‹Ñ… переменных или ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ Ð»Ð¾ÐºÐ°Ð»ÑŒÐ½Ð¾Ð³Ð¾ Ð¼Ð¾Ð´ÑƒÐ»Ñ Ð¿Ð¾Ð»Ð¸Ñ‚Ð¸ÐºÐ¸. Ð’ данном Ñлучае предполагаетÑÑ Ð¸Ð·Ð¼ÐµÐ½ÐµÐ½Ð¸Ñ Ñ‚Ð¸Ð¿Ð° файла, на тип доÑтупный Apache HTTP Server и Samba."
+
+#. Tag: term
+#, no-c-format
+msgid "Fix Command"
+msgstr "Команда иÑправлениÑ"
+
+#. Tag: para
+#, no-c-format
+msgid "A suggested command to allow access and resolve the denial. In this example, it gives the command to change the <filename>file1</filename> type to <computeroutput>public_content_t</computeroutput>, which is accessible to the Apache HTTP Server and Samba."
+msgstr "ÐŸÑ€ÐµÐ´Ð¿Ð¾Ð»Ð°Ð³Ð°ÐµÐ¼Ð°Ñ ÐºÐ¾Ð¼Ð°Ð½Ð´Ð° Ð´Ð»Ñ Ð¿Ñ€ÐµÐ´Ð¾ÑÑ‚Ð°Ð²Ð»ÐµÐ½Ð¸Ñ Ð´Ð¾Ñтуп и Ñ€Ð°Ð·Ñ€ÐµÑˆÐµÐ½Ð¸Ñ Ð±Ð»Ð¾ÐºÐ¸Ñ€Ð¾Ð²ÐºÐ¸. Ð’ данном примере, даётÑÑ ÐºÐ¾Ð¼Ð°Ð½Ð´Ð°, изменÑÑŽÑ‰Ð°Ñ Ñ‚Ð¸Ð¿ <filename>file1</filename> на <computeroutput>public_content_t</computeroutput>, который доÑтупен Apache HTTP Server и Samba."
+
+#. Tag: term
+#, no-c-format
+msgid "Additional Information"
+msgstr "Ð”Ð¾Ð¿Ð¾Ð»Ð½Ð¸Ñ‚ÐµÐ»ÑŒÐ½Ð°Ñ Ð¸Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ"
+
+#. Tag: para
+#, no-c-format
+msgid "Information that is useful in bug reports, such as the policy package name and version (<computeroutput>selinux-policy-3.5.13-11.fc12</computeroutput>), but may not help towards solving why the denial occurred."
+msgstr "Ð˜Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ Ð¿Ð¾Ð»ÐµÐ·Ð½Ð°Ñ Ð² отчетах об ошибках, таких как Ñ‚Ð°ÐºÐ°Ñ ÐºÐ°Ðº Ð¸Ð¼Ñ Ð¿Ð°ÐºÐµÑ‚Ð° политики и верÑÐ¸Ñ (<computeroutput>selinux-policy-3.5.13-11.fc12</computeroutput>), но не Ð¿Ð¾Ð¼Ð¾Ð³Ð°ÑŽÑ‰Ð°Ñ Ð² направлении Ñ€ÐµÑˆÐµÐ½Ð¸Ñ Ð¸ уÑÑ‚Ñ€Ð°Ð½ÐµÐ½Ð¸Ñ Ð¿Ñ€Ð¸Ñ‡Ð¸Ð½ поÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð±Ð»Ð¾ÐºÐ¸Ñ€Ð¾Ð²ÐºÐ¸."
+
+#. Tag: para
+#, no-c-format
+msgid "The raw audit messages from <filename>/var/log/audit/audit.log</filename> that are associated with the denial. Refer to <xref linkend=\"sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages\" /> for information about each item in the AVC denial."
+msgstr "Ðеобработанные ÑÐ¾Ð¾Ð±Ñ‰ÐµÐ½Ð¸Ñ Ð°ÑƒÐ´Ð¸Ñ‚Ð° из <filename>/var/log/audit/audit.log</filename>, ÑвÑзанные Ñ Ð±Ð»Ð¾ÐºÐ¸Ñ€Ð¾Ð²ÐºÐ¾Ð¹. Ð”Ð¾Ð¿Ð¾Ð»Ð½Ð¸Ñ‚ÐµÐ»ÑŒÐ½Ð°Ñ Ð¸Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ <xref linkend=\"sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages\" /> о каждом пункте в блокировке AVC."
+
+#. Tag: title
+#, no-c-format
+msgid "Allowing Access: audit2allow"
+msgstr "ПредоÑтавление доÑтупа: audit2allow"
+
+#. Tag: para
+#, no-c-format
+msgid "Do not use the example in this section in production. It is used only to demonstrate the use of <command>audit2allow</command>."
+msgstr "Ðе иÑпользуйте данный пример в продуктивной ÑиÑтеме. Он иÑпользуетÑÑ Ñ‚Ð¾Ð»ÑŒÐºÐ¾ Ð´Ð»Ñ Ð´ÐµÐ¼Ð¾Ð½Ñтрации иÑÐ¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ <command>audit2allow</command>."
+
+#. Tag: para
+#, no-c-format
+msgid "From the"
+msgstr "Из"
+
+#. Tag: refentrytitle
+#, no-c-format
+msgid "audit2allow"
+msgstr "audit2allow"
+
+#. Tag: citerefentry
+#, no-c-format
+msgid "manual page: \"<command>audit2allow</command> - generate SELinux policy allow rules from logs of denied operations\"<footnote> <para> From the <citerefentry><refentrytitle>audit2allow</refentrytitle><manvolnum>1</manvolnum></citerefentry> manual page, as shipped with the <package>policycoreutils</package> package in Fedora &PRODVER;. </para> </footnote>. After analyzing denials as per <xref linkend=\"sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages\" />, and if no label changes or Booleans allowed access, use <command>audit2allow</command> to create a local policy module. After access is denied by SELinux, running the <command>audit2allow</command> command presents Type Enforcement rules that allow the previously denied access."
+msgstr "Ñтраницы руководÑтва: \"<command>audit2allow</command> - генерирует разрешающие правила политики SELinux из логов (журналаов) блокированных операций\"<footnote> <para> Из Ñтраницы руководÑтва <citerefentry><refentrytitle>audit2allow</refentrytitle><manvolnum>1</manvolnum></citerefentry>, поÑтавлÑемой Ñ Ð¿Ð°ÐºÐµÑ‚Ð¾Ð¼ <package>policycoreutils</package> в Fedora &PRODVER;. </para> </footnote>. ПоÑле анализа блокировок как в <xref linkend=\"sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages\" />, и еÑли метки не изменÑÑŽÑ‚ÑÑ Ð¸ нет Булевых переменных, предоÑтавлÑющих доÑтуп, иÑпользуйте команду <command>audit2allow</command> Ð´Ð»Ñ ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ Ð»Ð¾ÐºÐ°Ð»ÑŒÐ½Ð¾Ð³Ð¾ Ð¼Ð¾Ð´ÑƒÐ»Ñ Ð¿Ð¾Ð»Ð¸Ñ‚Ð¸ÐºÐ¸. ПоÑле того, как
SELinux блокировал доÑтуп, выполнение команды <command>audit2allow</command> покажет правила Type Enforcement, которые разрешат блокированный доÑтуп."
+
+#. Tag: para
+#, no-c-format
+msgid "The following example demonstrates using <command>audit2allow</command> to create a policy module:"
+msgstr "Ð’ Ñледующем примере демонÑтрируетÑÑ Ð¸Ñпользование <command>audit2allow</command> Ð´Ð»Ñ ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ Ð¼Ð¾Ð´ÑƒÐ»Ñ Ð¿Ð¾Ð»Ð¸Ñ‚Ð¸ÐºÐ¸:"
+
+#. Tag: para
+#, no-c-format
+msgid "A denial and the associated system call are logged to <filename>/var/log/audit/audit.log</filename>:"
+msgstr "Блокировка и ÑоответÑтвующий ÑиÑтемный вызов запиÑаны в <filename>/var/log/audit/audit.log</filename>:"
+
+#. Tag: para
+#, no-c-format
+msgid "In this example, <application>certwatch</application> (<computeroutput>comm=\"certwatch\"</computeroutput>) was denied write access (<computeroutput>{ write }</computeroutput>) to a directory labeled with the <computeroutput>var_t</computeroutput> type (<computeroutput>tcontext=system_u:object_r:var_t:s0</computeroutput>). Analyze the denial as per <xref linkend=\"sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages\" />. If no label changes or Booleans allowed access, use <command>audit2allow</command> to create a local policy module."
+msgstr "Ð’ Ñтом примере <application>certwatch</application> (<computeroutput>comm=\"certwatch\"</computeroutput>) блокирует доÑтуп на запиÑÑŒ (<computeroutput>{ write }</computeroutput>) в каталог помеченный типом <computeroutput>var_t</computeroutput> (<computeroutput>tcontext=system_u:object_r:var_t:s0</computeroutput>). Проанализируйте блокировку в ÑоответÑтвии Ñ <xref linkend=\"sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages\" />. ЕÑли метки не изменены или нет Булевых переменных, предоÑтавлÑющих доÑтуп, иÑпользуйте <command>audit2allow</command> Ð´Ð»Ñ ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ Ð»Ð¾ÐºÐ°Ð»ÑŒÐ½Ð¾Ð¹ политики."
+
+#. Tag: para
+#, no-c-format
+msgid "With a denial logged, such as the <computeroutput>certwatch</computeroutput> denial in step 1, run the <command>audit2allow -w -a</command> command to produce a human-readable description of why access was denied. The <option>-a</option> option causes all audit logs to be read. The <option>-w</option> option produces the human-readable description. The <command>audit2allow</command> tool accesses <filename>/var/log/audit/audit.log</filename>, and as such, must be run as the Linux root user:"
+msgstr "С запиÑанным Ñообщением о блокировке, таким как <computeroutput>certwatch</computeroutput> в шаге 1, выполните команду <command>audit2allow -w -a</command> Ð´Ð»Ñ ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ ÑƒÐ´Ð¾Ð±Ð½Ð¾-читаемого опиÑаниÑ, почему доÑтуп был блокирован. ÐžÐ¿Ñ†Ð¸Ñ <option>-a</option> ÑвлÑетÑÑ Ð¾Ñнованием Ð´Ð»Ñ Ñ‡Ñ‚ÐµÐ½Ð¸Ñ Ð²Ñех логов. ÐžÐ¿Ñ†Ð¸Ñ <option>-w</option> Ñоздает удобо-читаемое опиÑание. ИнÑтрумент <command>audit2allow</command> запрашивает <filename>/var/log/audit/audit.log</filename> и, как ÑледÑтвие, должен быть запущен от имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root."
+
+#. Tag: para
+#, no-c-format
+msgid "As shown, access was denied due to a missing Type Enforcement rule."
+msgstr "Как показано, доÑтуп блокирован, в ÑоответÑтвии Ñ Ð¾Ñ‚ÑутÑтвием правила Type Enforcement."
+
+#. Tag: para
+#, no-c-format
+msgid "Run the <command>audit2allow -a</command> command to view the Type Enforcement rule that allows the denied access:"
+msgstr "Выполните команду <command>audit2allow -a</command> Ð´Ð»Ñ Ð¿Ñ€Ð¾Ñмотра правил Type Enforcement. которые разрешают блокированный доÑтуп:"
+
+#. Tag: para
+#, no-c-format
+msgid "Missing Type Enforcement rules are usually caused by bugs in SELinux policy, and should be reported in <ulink url=\"https://bugzilla.redhat.com/\">Red Hat Bugzilla</ulink>. For Fedora, create bugs against the <computeroutput>Fedora</computeroutput> product, and select the <computeroutput>selinux-policy</computeroutput> component. Include the output of the <command>audit2allow -w -a</command> and <command>audit2allow -a</command> commands in such bug reports."
+msgstr "ÐедоÑтающие правила Type Enforcement обычно вызвана ошибками в политике SELinux, и о них необходимо Ñообщать в <ulink url=\"https://bugzilla.redhat.com/\">Red Hat Bugzilla</ulink>. Ð”Ð»Ñ Fedora, Ñоздайте bug напротив продукта <computeroutput>Fedora</computeroutput> и выберите компоненту <computeroutput>selinux-policy</computeroutput>. Включите вывод команд <command>audit2allow -w -a</command> и <command>audit2allow -a</command> в bug report."
+
+#. Tag: para
+#, no-c-format
+msgid "To use the rule displayed by <command>audit2allow -a</command>, run the <command>audit2allow -a -M <replaceable>mycertwatch</replaceable></command> command as the Linux root user to create custom module. The <option>-M</option> option creates a Type Enforcement file (<filename>.te</filename>) with the name specified with <option>-M</option>, in your current working directory:"
+msgstr "Ð”Ð»Ñ Ð¸ÑÐ¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¿Ñ€Ð°Ð²Ð¸Ð»Ð°, показанного <command>audit2allow -a</command>, выполните команду <command>audit2allow -a -M <replaceable>mycertwatch</replaceable></command> от имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root Ð´Ð»Ñ ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ Ð¸Ð½Ð´Ð¸Ð²Ð¸Ð´ÑƒÐ°Ð»ÑŒÐ½Ð¾Ð³Ð¾ модулÑ. ÐžÐ¿Ñ†Ð¸Ñ <option>-M</option> Ñоздает файл Type Enforcement (<filename>.te</filename>), Ñ Ð¸Ð¼ÐµÐ½ÐµÐ¼. указанным опцией <option>-M</option>, в текущем каталоге:"
+
+#. Tag: para
+#, no-c-format
+msgid "Also, <command>audit2allow</command> compiles the Type Enforcement rule into a policy package (<filename>.pp</filename>). To install the module, run the <command>/usr/sbin/semodule -i <replaceable>mycertwatch.pp</replaceable></command> command as the Linux root user."
+msgstr "Также, <command>audit2allow</command> компилирует правила Type Enforcement в пакет политики (<filename>.pp</filename>). Ð”Ð»Ñ Ð¸Ð½ÑталлÑции модулÑ, иÑпользуетÑÑ ÐºÐ¾Ð¼Ð°Ð½Ð´Ð° <command>/usr/sbin/semodule -i <replaceable>mycertwatch.pp</replaceable></command> от имени Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ root."
+
+#. Tag: para
+#, no-c-format
+msgid "Modules created with <command>audit2allow</command> may allow more access than required. It is recommended that policy created with <command>audit2allow</command> be posted to an SELinux list, such as <ulink url=\"http://www.redhat.com/mailman/listinfo/fedora-selinux-list\">fedora-selinux-list</ulink>, for review. If you believe their is a bug in policy, create a bug in <ulink url=\"https://bugzilla.redhat.com/\">Red Hat Bugzilla</ulink>."
+msgstr "Модули, Ñозданные Ñ Ð¿Ð¾Ð¼Ð¾Ñ‰ÑŒÑŽ <command>audit2allow</command> могут предоÑтавить больше доÑтупа чем требуетÑÑ. РекомендуетÑÑ Ð¿ÑƒÐ±Ð»Ð¸ÐºÐ¾Ð²Ð°Ñ‚ÑŒ политики, Ñозданные Ñ Ð¿Ð¾Ð¼Ð¾Ñ‰ÑŒÑŽ <command>audit2allow</command> в лиÑÑ‚ SELinux. такой как <ulink url=\"http://www.redhat.com/mailman/listinfo/fedora-selinux-list\">fedora-selinux-list</ulink>, Ð´Ð»Ñ Ð¾Ð±Ð·Ð¾Ñ€Ð°. ЕÑли Ð’Ñ‹ Ñчитаете, что Ñто ошибка (bug) в политике, Ñоздайте bug в <ulink url=\"https://bugzilla.redhat.com/\">Red Hat Bugzilla</ulink>."
+
+#. Tag: para
+#, no-c-format
+msgid "If you have multiple denials from multiple processes, but only want to create a custom policy for a single process, use the <command>grep</command> command to narrow down the input for <command>audit2allow</command>. The following example demonstrates using <command>grep</command> to only send denials related to <command>certwatch</command> through <command>audit2allow</command>:"
+msgstr "ЕÑли еÑÑ‚ÑŒ множеÑтво блокировок от множеÑтва процеÑÑов, но необходимо Ñоздать индивидуальную политику Ð´Ð»Ñ Ð¾Ð´Ð½Ð¾Ð³Ð¾ определенного процеÑÑа, иÑпользуйте команду <command>grep</command> Ð´Ð»Ñ ÑÑƒÐ¶ÐµÐ½Ð¸Ñ Ð²Ð²Ð¾Ð´Ð° команде <command>audit2allow</command>. Ð’ Ñледующем примере демонÑтрируетÑÑ Ð¸Ñпользование команды <command>grep</command> Ð´Ð»Ñ Ð¾Ñ‚Ð¿Ñ€Ð°Ð²ÐºÐ¸ блокировок. отноÑÑщихÑÑ Ñ‚Ð¾Ð»ÑŒÐºÐ¾ к <command>certwatch</command> Ð´Ð»Ñ <command>audit2allow</command>:"
+
+#. Tag: para
+#, no-c-format
+msgid "Refer to Dan Walsh's <ulink url=\"http://danwalsh.livejournal.com/24750.html\">\"Using audit2allow to build policy modules. Revisited.\"</ulink> blog entry for further information about using <command>audit2allow</command> to build policy modules."
+msgstr "Ð’ ÑоответÑтвии Ñ Ð±Ð»Ð¾Ð³Ð¾Ð¼ Dan Walsh's <ulink url=\"http://danwalsh.livejournal.com/24750.html\">\"Using audit2allow to build policy modules. Revisited.\"</ulink> Ð´Ð¾Ð¿Ð¾Ð»Ð½Ð¸Ñ‚ÐµÐ»ÑŒÐ½Ð°Ñ Ð¸Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ Ð¾Ð± иÑпользовании <command>audit2allow</command> Ð´Ð»Ñ ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ Ð¼Ð¾Ð´ÑƒÐ»ÐµÐ¹ политик."
+
More information about the docs-commits
mailing list