Red Hat Bugzilla – Bug 403891
Links to configuration files
Last modified: 2007-11-30 17:12:24 EST
This is probably more of a question than a bug... In the past I have often used links to /etc/ configuration files to allow for multiple different configurations. This worked fine in FC6 except for a few /etc files that were not allowed to be links (such as /etc/aliases or /etc/passwd). In F8, using links for some configuration files (e.g. /etc/ntp.conf, /etc/cups/cupsd.conf, /etc/samba/smb.conf, /etc/samba/smbusers, /etc/cups/cupsd.conf, /etc/cups/printers.conf) generates selinux errors. For example: type=AVC msg=audit(1196113851.391:14): avc: denied { read } for pid=2436 comm="cupsd" name="cupsd.conf.temp" dev=sda7 ino=1102943 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cupsd_rw_etc_t:s0 tclass=lnk_file I understand why selinux might want to avoid links but is there any good way for me to selectively override this rule for some config files without opening the hole wide open?
You can add your own rules using policy modules. The easiest thing to do it use audit2allow to generate custom policy packages and then install them. # grep cupsd /var/log/audit/audit.log | audit2allow -M mycups # semodule -i mycups.pp
BTY Questions like this should be asked on the Fedora-Selinux Mailling list.