hald seems to need to execute /usr/libexec/hal-hotplug-map:
Aug 29 12:45:46 fedora kernel: audit(1093808744.270:0): avc: denied {
execute
} for pid=3436 exe=/usr/sbin/hald name=hal-hotplug-map dev=hda2
ino=4123436 scontext=system_u:system_r:hald_t
tcontext=system_u:object_r:bin_t tclass=file
Aug 29 12:45:46 fedora kernel: audit(1093808744.284:0): avc: denied {
execute
} for pid=3436 exe=/usr/sbin/hald name=hal-hotplug-map dev=hda2
ino=4123436 scontext=system_u:system_r:hald_t
tcontext=system_u:object_r:bin_t tclass=file
Does it make sense to label /usr/libexec/hal* as hald_exec_t and add
'canexec(hald_t, hald_exec_t)' to hald.te ?
Also, seems that hald and updfstab need to do their dbus thing,
and hald wants to access printer_device_t.
Suggested patches to hald.te and hald.fc
--- hald.te 2004-08-27 14:37:17.000000000 -0700
+++ /etc/selinux/strict/src.old/policy/domains/program/hald.te
2004-08-28 13:40:57.000000000 -0700
@@ -37,7 +37,12 @@
ifdef(`udev.te', `
domain_auto_trans(hald_t, udev_exec_t, udev_t)
allow udev_t hald_t:unix_dgram_socket sendto;
+allow hald_t updfstab_t:dbus { send_msg };
+allow updfstab_t hald_t:dbus { send_msg };
')
allow hald_t usbdevfs_t:dir search;
allow hald_t usbdevfs_t:file { getattr read };
+
+allow hald_t printer_device_t:chr_file { read write };
+can_exec(hald_t, hald_exec_t)
---
/etc/selinux/strict/src.old/policy/domains/program/../../file_contexts/program/hald.fc
2004-08-27 14:37:17.000000000 -0700
+++ hald.fc 2004-08-29 13:36:44.147534409 -0700
@@ -1,2 +1,3 @@
# hald - hardware informationd daemon
/usr/sbin/hald -- system_u:object_r:hald_exec_t
+/usr/libexec/hal-.* -- system_u:object_r:hald_exec_t
Please correct/improve,
tom
tom
| 
