'allow XXXX udev_tdb_t:dir r_dir_perms' needed...

[Tom London]

On Wed, 22 Dec 2004 13:52:36 -0500, Daniel J Walsh <dwalsh at redhat.com> wrote:
> >
> >
> No but I am :^)  r_dir_file($1_t, udev_tdb_t) is probably sufficient
> 

Dan,

Sorry, but that didn't quite work.

Here's what seems to get rhgb and X running again:

global_macros.te:
allow $1_t { self proc_t }:dir r_dir_perms;
allow $1_t { self proc_t }:lnk_file read;

+allow $1_t { device_t udev_tdb_t }:dir { getattr search };
allow $1_t null_device_t:chr_file rw_file_perms;
dontaudit $1_t console_device_t:chr_file rw_file_perms;
dontaudit $1_t unpriv_userdomain:fd use;

udev.te:
allow udev_t etc_t:file ioctl;
ifdef(`xdm.te', `
allow udev_t xdm_var_run_t:file { getattr read };
+allow xdm_xserver_t udev_tdb_t:dir r_dir_perms;
')

However, still get lots of AVCs for udev_tdb_t for
lvm_t, pam_console_t, ptal_t, xdm_t, and user_t

Does it make sense to add it base_user_domain()?
full_user_role()? (they already has access to device_t).
daemon_base_domain()?

[I'm sure I'm making this too complicated, but
I'm trying to avoide adding an 'allow ... udev_tdb_t:dir'
to each seperate .te file .....]

tom

-- 
Tom London