<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=Content-Type content="text/html; charset=us-ascii"> <meta name=Generator content="Microsoft Word 11 (filtered medium)"> <style>  </style> </head> <body lang=EN-US link=blue vlink=purple> <div class=Section1> I am trying to figure out how to get “runcon –l s1” to work while having selinux in enforcing mode. So far, I can only use the runcon command successfully with selinux in permissive mode. Here is the error I get when in enforcing mode:<o:p></o:p> <o:p> </o:p> >runcon -l s1 ./SimulatedImport /home/m252/SimulatedImport/output/junk<o:p></o:p> execvp: Permission denied<o:p></o:p> <o:p> </o:p> My shell is running as root in the unconfined_t domain. Here is the output of id –Z:<o:p></o:p> root:system_r:unconfined_t:s0-s15:c0.c255<o:p></o:p> <o:p> </o:p> The executable that I’m trying to run with runcon is “SimulatedImport”. This is a very simple program which simply creates a small text file. I have created a domain named “import_t” for this program.<o:p></o:p> <o:p> </o:p> I have an selinux policy that I built as an mls policy off the targeted policy. <o:p></o:p> <o:p> </o:p> When I run audit2allow I get the following:<o:p></o:p> <o:p> </o:p> audit2allow -i /var/log/audit/audit.log -l -v -r<o:p></o:p> require {<o:p></o:p> class dir search;<o:p></o:p> class file { getattr read };<o:p></o:p> class process transition;<o:p></o:p> type auditd_log_t;<o:p></o:p> type unconfined_t;<o:p></o:p> role system_r;<o:p></o:p> };<o:p></o:p> <o:p> </o:p> allow unconfined_t auditd_log_t:dir search;<o:p></o:p> #TYPE=AVC MSG=audit(1177347232.381:45684): COMM="audit2allow" NAME="audit" : search<o:p></o:p> #TYPE=AVC MSG=audit(1177347344.098:45698): COMM="audit2allow" NAME="audit" : search<o:p></o:p> allow unconfined_t auditd_log_t:file { getattr read };<o:p></o:p> #TYPE=AVC MSG=audit(1177347344.098:45699): COMM="audit2allow" NAME="audit.log" : getattr<o:p></o:p> #TYPE=AVC MSG=audit(1177347344.098:45698): COMM="audit2allow" NAME="audit.log" : read<o:p></o:p> allow unconfined_t self:process transition;<o:p></o:p> #TYPE=AVC MSG=audit(1177347223.780:45683): COMM="runcon" NAME="SimulatedImport" : transition<o:p></o:p> <o:p> </o:p> Adding “allow unconfined_t self:process transition;” to my “import” module seems to have no effect.<o:p></o:p> <o:p> </o:p> Any help would be appreciated.<o:p></o:p> <o:p> </o:p> Thanks,<o:p></o:p> Mike<o:p></o:p> </div> </body> </html>