avc denied from postgresql
Richard Hally
rhally at mindspring.com
Thu Jul 1 06:00:21 UTC 2004
Yuichi Nakamura wrote:
> On Wed, 16 Jun 2004 00:31:58 -0400
> Richard Hally <rhallyx at mindspring.com> wrote:
>
>>With the above change to the postgresql.fc I get the following avc
>>denied messages when booting:
>
> You must add
> /usr/bin/postgres -- system_u:object_r:postgresql_exec_t
> to postgresql.fc
> and , comment out
> session optional /lib/security/$ISA/pam_selinux.so multiple
> from /etc/pam.d/su.
>
Thanks for the reply, it looks to me that the problem is more like the
policy and file_contexts were written for the way Debian(or some other
distro) installs PostgresSQL and Fedora installs things differently. The
most notable is that in the .fc it has the only postgresql_exec_t with a
regex for /usr/lib(64)?/postgresql/bin/.* and on Fedora the executables
are in /usr/bin.
The question I have is: how do we handle these case where different
distros put the same files in different places? Do we continue to add to
the policy for each different distro?
Richard Hally
More information about the selinux
mailing list