avc denied messages from microcode_ctl
Richard Hally
rhallyx at mindspring.com
Mon Jun 14 18:59:15 UTC 2004
Russell Coker wrote:
>On Mon, 14 Jun 2004 15:31, Richard Hally <rhallyx at mindspring.com> wrote:
>
>
>>While booting the 427 kernel in enforcing mode with
>>selinux-policy-strict-1.13.4-5,
>>the following avc denied messages occur:
>>
>>Jun 13 21:04:03 new2 kernel: audit(1087175026.816:0): avc: denied {
>>write } for pid=1247 exe=/sbin/microcode_ctl name=microcode dev=hda2
>>ino=1070659 scontext=system_u:system_r:cpucontrol_t
>>tcontext=system_u:object_r:device_t tclass=chr_file
>>
>>
>
>/u?dev/cpu/.* -c system_u:object_r:cpu_device_t
>
>The above line in file_contexts/types.fc should cover /dev/cpu/microcode. I
>think that the problem you are having is because for some (unknown) reason
>those device nodes were mis-labeled. I don't know what might have caused
>this, I have not been able to reproduce it.
>
>I suggest just using setfiles to relabel /dev/cpu.
>
>
>
There is no /udev/cpu. There is a /udev/microcode. It is labeled device_t.
Richard Hally
More information about the fedora-selinux-list
mailing list