selinux October 2015

selinux@lists.fedoraproject.org

16 participants
22 discussions

Re: RHEL 7 consoletype_exec interface issue
by Douglas Brown 27 Mar '17

27 Mar '17

Hi, In RHEL 7 when using the userdom_unpriv_user_template interface to create a new role, it in turn uses the consoletype_exec interface; but when I attempt to insert a policy compiled with this, it says the type consoletype_exec_t doesn’t exist. N.B. This works on RHEL 6. Thanks, Doug

3 2

transition from init_rc
by Tracy Reed 08 Dec '15

08 Dec '15

I think I'm really close to having this policy finished and working, just a couple things to work out... When I exercise my app and then run audit2allow and it says: #!!!! This avc is a constraint violation. You will need to add an attribute to either the source or target type to make it work. #Contraint rule: allow myapp_t default_t:dir search; allow myapp_t default_t:dir read; allow myapp_t default_t:file execmod; allow myapp_t myapp_bin_t:file write; does it mean only the first line is an constraint violation? Or are all of those constraint violations? How does one typically deal with constraint violations? By attribute above I suppose it means a type attribue but how do I know which one to add? Then I have these: #!!!! This avc is a constraint violation. You will need to add an attribute to either the source or target type to make it work. #Contraint rule: allow initrc_t default_t:file relabelto; #!!!! This avc is a constraint violation. You will need to add an attribute to either the source or target type to make it work. #Contraint rule: allow initrc_t myapp_api_t:file relabelto; The init script which starts the service relabels the files when the service starts. I suspect this is a bad idea and I'm not sure why they are doing it. I think they may be applying security categories here. We may have to find a different way to approach that. But how would I allow this if I wanted to? Similarly: #!!!! This avc is a constraint violation. You will need to add an attribute to either the source or target type to make it work. #Contraint rule: allow setfiles_t default_t:file relabelfrom; #!!!! This avc is a constraint violation. You will need to add an attribute to either the source or target type to make it work. #Contraint rule: allow setfiles_t myapp_api_t:file relabelfrom; etc... This is all on CentOS 6.5. Thanks! -- Tracy Reed

4 5

1 Weird Trick That Forces Your Eyes Into Perfect 20/20 Vision in Just 7 Days...
by Tom London 30 Oct '15

30 Oct '15

1 0

How To LEGALLY Cut Electric Bill Up To 80% With Easy Way
by Tom London 29 Oct '15

29 Oct '15

1 0

Restore Perfect 20/20 Vision in 7 Days Naturally
by Tom London 29 Oct '15

29 Oct '15

1 0

Is *anyone* reading this list who's a moderator?
by mark 28 Oct '15

28 Oct '15

I mean, we've had four or five spam in the last few days.... mark

4 3

Your Electric Bill: How to Cut Costs Up To 80% Legally
by Tom London 28 Oct '15

28 Oct '15

1 0

How To Get 20/20 Vision in As Little As A Week
by Tom London 28 Oct '15

28 Oct '15

1 0

Re: Is *anyone* reading this list who's a moderator?
by mark 27 Oct '15

27 Oct '15

Mario Rosic wrote: > Hey, > > people don't see the spam because it's being filtered out by their spam > filters. > Yeah, well, the list admin(s) shouldn't be filtering... mark > Regards, > Mario > > Am 2015-10-27 um 21:51 schrieb m.roth(a)5-cent.us: >> I mean, we've had four or five spam in the last few days.... >> >> mark >> >> -- >> selinux mailing list >> selinux(a)lists.fedoraproject.org >> https://admin.fedoraproject.org/mailman/listinfo/selinux > >

1 0

How To Get 20/20 Vision in As Little As A Week
by Tom London 27 Oct '15

27 Oct '15

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux October 2015