vmware and eclipse avc denied in selinux-policy-targeted-3.0.2-3.fc8.noarch

[Ken YANG]

hi,

i am in f8 rawhide with selinux-policy-targeted-3.0.2-3.fc8.noarch

there are some avc denied about vmware and eclipse:

1 vmware config

after i update to selinux-policy-targeted-3.0.2-3.fc8.noarch,
i find my vmware must be re-configed every time i run it.

but when i run vmware-config.pl, some avc denied messages occured:

avc: denied { read, write } for comm="vmnet-bridge" cwd="/usr/bin" dev=00:10
egid=0 euid=0 exe="/usr/bin/vmnet-bridge" exit=-13 fsgid=0 fsuid=0 gid=0
inode=230929 item=0 items=1 mode=020600 name="vmnet0"
obj=system_u:object_r:device_t:s0 ogid=0 ouid=0 path="/dev/vmnet0" pid=22164
rdev=77:00 scontext=system_u:system_r:vmware_host_t:s0 sgid=0
subj=system_u:system_r:vmware_host_t:s0 suid=0 tclass=chr_file
tcontext=system_u:object_r:device_t:s0 tty=(none) uid=0

......

other avc errors are similar, it seemed that /dev/vmnet* are mislabeled,
they were all labeled device_t, not vmware_device_t.

IIRC, i installed and configured vmware 6 well, before the merge of
targeted and strict policy, i.e. <selinux-policy-targeted-3.0

i had compared the vmware* between these two versions policy, i had
not find any changes which will result to these errors.

i also find the /dev in my system is tmpfs, so the file on this fs
should be labeled using fs_use_trans.

I want to add type_transition rules to verify my guess, but i don't know
the type of /usr/bin/vmware-config.pl, which is "bin_t" now in my system


is there something i missed?


2 Eclipse avc error

when i launch eclipse(SLIDE), i got avc error:

avc: denied { unix_read, unix_write } for comm="X" egid=0 euid=0
exe="/usr/bin/Xorg" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 pid=2880
scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 sgid=0
subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 suid=0 tclass=shm
tcontext=system_u:system_r:java_t:s0 tty=tty7 uid=0


i think this should be added in policy as "dontaudit", because it seemed
that it dont influence my use of eclipse