Choosing A Webhost:
A web hosting service is a type of Internet hosting service that allows individuals and organizations to provide their own website accessible via the World Wide Web. Web hosts are companies that provide space on a server they own for use by their clients as well as providing Internet connectivity, typically in a data center. Web hosts can also provide data center space and connectivity to the Internet for servers they do not own to be located in their data center, called colocation. more...
|
Re: 'allow XXXX udev_tdb_t:dir r_dir_perms' needed...: msg#00223
|
Subject: |
Re: 'allow XXXX udev_tdb_t:dir r_dir_perms' needed... |
On Thursday 23 December 2004 15:12, Tom London <selinux@xxxxxxxxx> wrote:
> Here's what seems to get rhgb and X running again:
>
> global_macros.te:
> allow $1_t { self proc_t }:dir r_dir_perms;
> allow $1_t { self proc_t }:lnk_file read;
>
> +allow $1_t { device_t udev_tdb_t }:dir { getattr search };
The problem is that the directory should have type device_t not udev_tdb_t.
The recent trend has been to label all directories under /dev as device_t.
-file_type_auto_trans(udev_t, device_t, udev_tdb_t, { file dir })
+file_type_auto_trans(udev_t, device_t, udev_tdb_t, file)
If the above change is made to udev.te and the below change is made to udev.fc
then everything will work well. This is the easiest and simplest change that
preserves expected functionality.
-/dev/\.udev\.tdb(/.*)? system_u:object_r:udev_tdb_t
+/dev/\.udev\.tdb/.* -- system_u:object_r:udev_tdb_t
I assume that the file names in directory /dev/.udev.tdb don't give anything
away - otherwise the directory surely wouldn't have mode 0755...
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
|
| |
