Bug 445101 - (staff_u) zillion AVC denials
Summary: (staff_u) zillion AVC denials
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: rawhide
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-05-03 18:50 UTC by Matěj Cepl
Modified: 2018-04-11 07:28 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2008-05-05 20:41:35 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
/var/log/audit/audit.log (2.93 MB, text/plain)
2008-05-03 18:50 UTC, Matěj Cepl
no flags Details
generated SELinux module (1.85 KB, text/plain)
2008-05-03 22:17 UTC, Matěj Cepl
no flags Details

Description Matěj Cepl 2008-05-03 18:50:18 UTC
Description of problem:
I thought I will be filing one bug per AVC denial while using staff_u, but there
is too much junk here. I think that everything (except for bitlbee bugs) in the
attached /var/log/audit/audit.log is relevant as a staff_u bug.

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.3.1-42.fc9.noarch
(the rest is from Rawhide as of today)

Comment 1 Matěj Cepl 2008-05-03 18:50:18 UTC
Created attachment 304465 [details]
/var/log/audit/audit.log

Comment 2 Matěj Cepl 2008-05-03 22:17:23 UTC
Created attachment 304468 [details]
generated SELinux module

When removing all lines from audit.log before I switched to using staff_u, I
generated this selinux module with audit2allow

Comment 3 Daniel Walsh 2008-05-05 18:30:27 UTC
If you are testing staff_t please do not run in permissive mode.  Any avc that
you collected while in permissive mode is useless.  Since staff_u is not allowed
to run su, when in permissive mode you ran visudo which is also not allowed so
lots of AVC messages are useless to me.

You need to setup sudo before hand and user sudo to switch to unconfined_t when
run as root.



Comment 4 Matěj Cepl 2008-05-05 20:41:35 UTC
OK, if I cannot run in permissive mode, than I am afraid I cannot use staff_u at
all (need for developing stuff permissive mode).

Comment 5 Daniel Walsh 2008-05-06 21:23:30 UTC
Not sure why you need permissive mode for developing.  I use staff_t which a
transition to unconfined_t and I develop every day.



Comment 6 Matěj Cepl 2008-05-06 21:31:37 UTC
I am probably much worse programmer than you (well, I am not a programmer at
all, strictly speaking) so when hacking on bitlbee (which is confined) I am
hitting SELinux all the time.


Note You need to log in before you can comment on or make changes to this bug.