xfs socket startup fails with strict policy

[Stephen Smalley]

On Wed, 2004-08-25 at 18:51, Leonard den Ottolander wrote:
> Hi,
> 
> I'm seeing the following at startup. I have to boot to runlevel 3
> because X won't start since it "could not open default font 'fixed'".
> There is no socket for xfs (7100) although service xfs is reported
> running.
> 
> Aug 25 23:27:36 k6-joy xfs: xfs startup succeeded
> Aug 25 23:27:36 k6-joy kernel: audit(1093469256.744:0): avc:  denied  {
> getattr } for  pid=2171 exe=/usr/X11R6/bin/xfs path=/tmp/.font-unix
> dev=hda6 ino=425186 scontext=system_u:system_r:xfs_t
> tcontext=system_u:object_r:initrc_tmp_t tclass=dir
> Aug 25 23:27:36 k6-joy xfs[2171]: cannot establish any listening sockets
> Aug 25 23:27:37 k6-joy xfs[2171]: ignoring font path element
> /usr/X11R6/lib/X11/fonts/Speedo (unreadable) 
> 
> Running a fixfiles relabel did not fix this issue.

Already bugzilla'd, I think.  /etc/init.d/xfs needs to restorecon
/tmp/.font-unix after re-creating it (previously, it was getting
re-created by xfs itself, and the policy automatically put it into the
right type using a file_type_auto_trans rule from xfs_t).

-- 
Stephen Smalley <sds at epoch.ncsc.mil>
National Security Agency