selinux and udev ?

[Nicolas Mailhot]

Le mardi 29 novembre 2005 à 13:23 -0500, Stephen Smalley a écrit :
> On Tue, 2005-11-29 at 18:56 +0100, Nicolas Mailhot wrote:
> > Le mardi 29 novembre 2005 à 11:48 -0500, Stephen Smalley a écrit :
> > > On Tue, 2005-11-29 at 08:20 -0800, Tom London wrote:
> > > > There are reports in fedora-test about the 2.X policy slowing down
> > > > udev. (Appears that folks are comparing booting with selinxux=1 with
> > > > selinux=0).
> > > > 
> > > > I have to admit that udev is running slower (targeted/enforcing).
> > > > 
> > > > Any validity to this?  Known issue? How to track down?
> > > 
> > > First, check whether you have any avc denials associated with udev in
> > > your audit.log.
> > 
> > There are certainly many denials with the new 2.0 policy, including udev
> > stuff (at least it was the case a week ago). I've posted 2.0 audit logs
> > many times in bugzilla.
> 
> I think many of those avc issues have been resolved, although there may
> still be lingering ones.  I think that the udev slowdown is more likely
> matchpathcon / file_contexts issues.

The udev denial seems fixed with selinux-policy-targeted-2.0.6-1. So
things get (slowly) fixed. But most issues are still there :

audit2allow < /var/log/audit/audit.log
allow dovecot_auth_t var_lib_t:dir search;
allow system_chkpwd_t devpts_t:chr_file { read write };
allow procmail_t spamd_port_t:tcp_socket name_connect;
allow updfstab_t tmpfs_t:dir getattr;
allow dovecot_auth_t etc_runtime_t:file read;
allow spamd_t port_t:udp_socket name_bind;
(this bit is the spamassassin resolver issue Steven Stern just reported
for FC4. It was briefly fixed in Rawhide, then regressed to broken stage
with the 2.x policy change)

(generated on a clean fully relabeled system after 3 min of activity)

That's almost the same list I had with selinux-policy-targeted-2.0.0

Regards,

-- 
Nicolas Mailhot
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Ceci est une partie de message
	=?ISO-8859-1?Q?num=E9riquement?= =?ISO-8859-1?Q?_sign=E9e?=
Url : http://lists.fedoraproject.org/pipermail/selinux/attachments/20051129/864c3b11/attachment.bin