avc denied from mDNSResponder
Stephen Smalley
sds at epoch.ncsc.mil
Mon Jul 12 12:53:13 UTC 2004
On Sat, 2004-07-10 at 03:23, Richard Hally wrote:
> When booting in enforcing mode with the latest strict
> policy(selinux-policy-strict-sources-1.14.1-5)
> the following avc denied message is produced.
>
> Jul 10 03:12:02 new2 network: Bringing up interface eth0: succeeded
> Jul 10 03:12:04 new2 kernel: audit(1089443524.677:0): avc: denied {
> name_bind
> } for pid=2016 exe=/usr/bin/mDNSResponder scontext=user_u:user_r:user_t
> tcontext=system_u:object_r:dns_port_t tclass=udp_socket
The fact that it is running in user_u likely means that it is being
started via su (to run in some pseudo user identity), and since that
pseudo user identity does not exist in the policy, it is being remapped
to user_u.
--
Stephen Smalley <sds at epoch.ncsc.mil>
National Security Agency
More information about the fedora-selinux-list
mailing list