Dang, I think I spoke too soon. I looked on bugzilla and found this bug 712681, long story short is that it now starts so skip this question for the moment, I&#39;ve got to sleep and can&#39;t test it anymore but it did start and I&#39;m getting waves of denials in my logs again. Excellent.<div>
<br><div class="gmail_quote">On Thu, Jun 30, 2011 at 12:20 AM, Michael Milverton <span dir="ltr">&lt;<a href="mailto:m.milverton@gmail.com">m.milverton@gmail.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Hi,<div><br></div><div>I&#39;m in the process of writing a policy for couchdb (nosql database). I&#39;m using the selinux-polgengui and eclipse slide tools to help. I&#39;ve hit a road block because it won&#39;t start but I&#39;m not getting any more AVC&#39;s. I&#39;m wondering if anybody might be able to offer some clue about getting more AVC&#39;s from it because if it won&#39;t talk to me I can&#39;t get much further.</div>

<div><br></div><div>The only entries in audit.log are:</div><div><br></div><div><div>type=CRED_ACQ msg=audit(1309362790.614:1343): user pid=11935 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg=&#39;op=PAM:setcred acct=&quot;couchdb&quot; exe=&quot;/sbin/runuser&quot; hostname=? addr=? terminal=? res=success&#39;</div>

<div>type=USER_START msg=audit(1309362790.619:1344): user pid=11935 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg=&#39;op=PAM:session_open acct=&quot;couchdb&quot; exe=&quot;/sbin/runuser&quot; hostname=? addr=? terminal=? res=success&#39;</div>

<div>type=USER_END msg=audit(1309362790.640:1345): user pid=11935 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg=&#39;op=PAM:session_close acct=&quot;couchdb&quot; exe=&quot;/sbin/runuser&quot; hostname=? addr=? terminal=? res=success&#39;</div>

<div>type=CRED_DISP msg=audit(1309362790.641:1346): user pid=11935 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg=&#39;op=PAM:setcred acct=&quot;couchdb&quot; exe=&quot;/sbin/runuser&quot; hostname=? addr=? terminal=? res=success&#39;</div>

<div>type=SERVICE_START msg=audit(1309362790.676:1347): user pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=&#39;: comm=&quot;couchdb&quot; exe=2F62696E2F73797374656D64202864656C6574656429 hostname=? addr=? terminal=? res=failed&#39;</div>

</div><div><br></div><div><br></div><div>Now, it will start fine (and run) when it is unlabeled (not what I want of course). Couchdb runs under the username/group couchdb but I haven&#39;t added any transition rules for this yet (any help on this would be appreciated).</div>

<div><br></div><div>FC FILE:</div><div><div>/usr/bin/couchdb<span style="white-space:pre-wrap">	</span>--<span style="white-space:pre-wrap">	</span>gen_context(system_u:object_r:couchdb_exec_t,s0)</div>
<div>/usr/bin/couchjs    --  gen_context(system_u:object_r:couchdb_exec_t,s0) </div></div><div><br></div><div>TE FILE:</div><div><div>policy_module(couchdb,1.0.0) </div><div>require {</div><div>    type bin_t;</div><div>
    type fs_t;</div>
<div>    type proc_t;</div><div>}</div><div><br></div><div><br></div><div>type couchdb_t;</div><div><br></div><div>domain_type(couchdb_t)</div><div>permissive couchdb_t;</div><div><br></div><div># Access to shared libraries</div>

<div>libs_use_ld_so(couchdb_t)</div><div>libs_use_shared_libs(couchdb_t)</div><div>miscfiles_read_localization(couchdb_t)</div><div>dev_read_urand(couchdb_t)</div><div><span style="white-space:pre-wrap">		</span></div>
<div><br></div><div># Type for the daemon</div><div>type couchdb_exec_t;</div><div>files_type(couchdb_exec_t)</div><div>domain_entry_file(couchdb_t, couchdb_exec_t)</div><div>init_daemon_domain(couchdb_t, couchdb_exec_t)</div>

<div><br></div><div># Logging</div><div>logging_send_syslog_msg(couchdb_t)<span style="white-space:pre-wrap">			</span></div><div>logging_log_file(couchdb_t)</div><div><br></div><div># Temp files</div><div>
type couchdb_tmp_t;</div><div>files_tmp_file(couchdb_tmp_t)</div><div>manage_dirs_pattern(couchdb_t, couchdb_tmp_t, couchdb_tmp_t)</div><div>manage_files_pattern(couchdb_t, couchdb_tmp_t, couchdb_tmp_t)</div><div>files_tmp_filetrans(couchdb_t, couchdb_tmp_t, { dir file })</div>

<div><br></div><div><br></div><div>#type couchdb_config_t;</div><div>files_read_etc_files(couchdb_t) </div><div><br></div><div># /bin/basename and some others</div><div>allow couchdb_t bin_t:file { read getattr open execute execute_no_trans };</div>

<div>allow couchdb_t fs_t:filesystem getattr;</div><div>allow couchdb_t proc_t:file { read getattr open };</div><div>allow couchdb_t self:fifo_file { read write getattr };</div><div><br></div><div># Not sure about this</div>

<div>auth_domtrans_chk_passwd(couchdb_t)</div><div><br></div><div># Not sure about this either.</div><div>domain_use_interactive_fds(couchdb_t)</div></div><div><br></div><div><br></div><div>Any clues, tips, advice would be most appreciated</div>

<div><br></div><div>Thanks</div><div><br></div>
</blockquote></div><br></div>