selinux policy UBAC question
by Roberto Sassu
Hi all
i'm using the selinux policy shipped with Fedora 13 and UBAC turned on.
I removed the unconfined package and i noted the unconfined_t domain with
unconfined_u user is unable to access a file with another selinux user.
I tried to build a custom module which contains the line:
ubac_process_exempt(unconfined_t)
but this does not solve the issue. How do i configure the policy to allow some
domains to circumvent the UBAC enforcement?
Thanks in advance for replies.
Roberto Sassu
13 years, 6 months
- 2
- 11
selinux blocking access, no AVC warnings in /var/log/messages or /var/log/audit/audit.log
by Jonathan Kamens
Hi all,
I need to set up a procmail rule that receives an aliases file via
email, saves it within the home directory of the user receiving the
email, and builds a postfix hash map out of it with postalias.
There were various selinux denied messages associated with the work the
script has to do, which I fixed incrementally with several test runs of
the script combined with audit2allow, yielding this eventual policy:
module aliasupdate 1.0;
require {
type postfix_postdrop_t;
type user_home_t;
type postfix_master_exec_t;
type procmail_t;
class file { getattr append read open execute execute_no_trans };
}
allow postfix_postdrop_t user_home_t:file { getattr append };
allow procmail_t postfix_master_exec_t:file execute_no_trans;
allow procmail_t postfix_master_exec_t:file { read execute open getattr };
Now, however, I'm still getting a permission problem. From my procmail log:
postalias: fatal: open /etc/postfix/main.cf: Permission denied
I know this is an selinux issue, since the problem goes away if I do
"setenforce 0", but here's the weird thing: when this error occurs,
nothing gets logged in either /var/log/messages or
/var/log/audit/audit.log, so I can't figure out how to fix my selinux
policy to allow whatever action is being denied here.
Can somebody help me figure out why selinux would fail to log any sort
of message when blocking access, and what I can do to fix it?
Thank you,
Jonathan Kamens
13 years, 6 months
- 2
- 3