avc denied messages from microcode_ctl

Russell Coker russell at coker.com.au
Mon Jun 14 10:17:16 UTC 2004


On Mon, 14 Jun 2004 15:31, Richard Hally <rhallyx at mindspring.com> wrote:
> While booting the 427  kernel in enforcing mode with
> selinux-policy-strict-1.13.4-5,
> the following avc denied messages occur:
>
> Jun 13 21:04:03 new2 kernel: audit(1087175026.816:0): avc:  denied  {
> write } for  pid=1247 exe=/sbin/microcode_ctl name=microcode dev=hda2
> ino=1070659 scontext=system_u:system_r:cpucontrol_t
> tcontext=system_u:object_r:device_t tclass=chr_file

/u?dev/cpu/.*           -c      system_u:object_r:cpu_device_t

The above line in file_contexts/types.fc should cover /dev/cpu/microcode.  I 
think that the problem you are having is because for some (unknown) reason 
those device nodes were mis-labeled.  I don't know what might have caused 
this, I have not been able to reproduce it.

I suggest just using setfiles to relabel /dev/cpu.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page



More information about the fedora-selinux-list mailing list