Created attachment 380843 [details]
AVC denials from permissive mode

Description of problem:
Policy for mgetty+sendfax is not ok. It is now in the getty policy, but this is not enough for fax reception of mgetty and following email notification


Version-Release number of selected component (if applicable):
mgetty-1.1.36-5.fc12.x86_64
selinux-policy-3.6.32-59.fc12.noarch
selinux-policy-targeted-3.6.32-59.fc12.noarch


How reproducible:
Activate mgetty in default Fedora 12 install, receive a fax over serial line

  
Actual results:
Notification fails, AVC denials clutter the log

Expected results:
"quiet" fax reception


Additional info:
Dominick Grift from fedora-selinux-list kindly reviewd my AVC denials (see attachment) and created a policy for mgetty, that works (safe of a more thorough security review). As mgetty does more than the normal gettys I guess it merits its own policy?

mygetty.te:
policy_module(mygetty, 1.0.0)
optional_policy(`
gen_require(`
type getty_t;
')
corecmd_exec_bin(getty_t)
corecmd_exec_shell(getty_t)
kernel_read_system_state(getty_t)
')


mymail.te:
policy_module(mymail, 1.0.0)
optional_policy(`
gen_require(`
type system_mail_t;
')
term_use_unallocated_ttys(system_mail_t)
')


(Though mgetty seems to leak the serial port to sendmail, which obviously is a bug and would not need to be taken care of in the policy)