allow_daemons_dump_core doesn't work?
Daniel J Walsh
dwalsh at redhat.com
Mon Dec 3 16:26:49 UTC 2007
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Chuck Anderson wrote:
> I've been having issues with BIND so I set up the named process to
> dump core and enabled allow_daemons_dump_core. However, it would not
> create any core file until I put SELinux into permissive mode. I also
> didn't get any audit messages related to the failed core dump. Why is
> that? The CWD of the process is /var/named which is where the core
> dump got written after I put SELinux in permissive mode.
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
allow_daemons_dump_core, is only allowing daemons to create new files in /
It would not allow named to create a file in /var/named.
So I guess we need to add a rule to allow named to write to named_zone_t
if this boolean is set, or make named use / as its cwd.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iD8DBQFHVC5JrlYvE4MpobMRAtOwAKCerxBSjPszDUT+KVgZe1xyyJ5RnACgld+q
PVFSYPcXS/TERkhH6B9DSQQ=
=lHB3
-----END PGP SIGNATURE-----
More information about the fedora-selinux-list
mailing list