Re: selinux and udev ?

Nicolas Mailhot wrote:
> Le mardi 29 novembre 2005 à 13:23 -0500, Stephen Smalley a écrit :
>   
> > On Tue, 2005-11-29 at 18:56 +0100, Nicolas Mailhot wrote:
> >     
> > > Le mardi 29 novembre 2005 à 11:48 -0500, Stephen Smalley a écrit :
> > >       
> > > > On Tue, 2005-11-29 at 08:20 -0800, Tom London wrote:
> > > >         
> > > > > There are reports in fedora-test about the 2.X policy slowing down
> > > > > udev. (Appears that folks are comparing booting with selinxux=1 with
> > > > > selinux=0).
> > > > >
> > > > > I have to admit that udev is running slower (targeted/enforcing).
> > > > >
> > > > > Any validity to this?  Known issue? How to track down?
> > > > >           
> > > > First, check whether you have any avc denials associated with udev in
> > > > your audit.log.
> > > >         
> > > There are certainly many denials with the new 2.0 policy, including udev
> > > stuff (at least it was the case a week ago). I've posted 2.0 audit logs
> > > many times in bugzilla.
> > >       
> > I think many of those avc issues have been resolved, although there may
> > still be lingering ones.  I think that the udev slowdown is more likely
> > matchpathcon / file_contexts issues.
> >     
> The udev denial seems fixed with selinux-policy-targeted-2.0.6-1. So
> things get (slowly) fixed. But most issues are still there :
>
> audit2allow < /var/log/audit/audit.log
> allow dovecot_auth_t var_lib_t:dir search;
> allow system_chkpwd_t devpts_t:chr_file { read write };
> allow procmail_t spamd_port_t:tcp_socket name_connect;
> allow updfstab_t tmpfs_t:dir getattr;
> allow dovecot_auth_t etc_runtime_t:file read;
> allow spamd_t port_t:udp_socket name_bind;
> (this bit is the spamassassin resolver issue Steven Stern just reported
> for FC4. It was briefly fixed in Rawhide, then regressed to broken stage
> with the 2.x policy change)
>
> (generated on a clean fully relabeled system after 3 min of activity)
>
> That's almost the same list I had with selinux-policy-targeted-2.0.0
>
> Regards,
>
>   
> ------------------------------------------------------------------------
> --
> fedora-selinux-list mailing list
> fedora-selinux-list@xxxxxxxxxx
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
selinux-policy-2.0.6-2 should fix most of those.  Available on
ftp://people.redhat.com/dwalsh/SELinux/Fedora


--