nscd with selinux with ssl

[Farkas Levente]

Daniel J Walsh wrote:
>>>> ----------------------------
>>>> # ls -aZ /etc/ssl/certs/cacert.pem
>>>> -rw-r--r--  root     root     root:object_r:usr_t 
>>>> /etc/ssl/certs/cacert.pem
>>>> ----------------------------
>>>> and in my messages:
>>>> ----------------------------
>>>> Mar 31 17:08:23 kek kernel: audit(1112281703.777:0): avc:  denied  { 
>>>> read } for  pid=14271 exe=/usr/sbin/nscd name=cacert.pem dev=md0 
>>>> ino=2291612 scontext=root:system_r:nscd_t 
>>>> tcontext=root:object_r:usr_t tclass=file
>>>> ----------------------------
>>>> that's why i ask for it:-)
>>>> yours.
>>>>
>>> I believe FC3 policy selinux-policy-targeted-1.17.30-2.90,  has 
>>> nscd.te allow to read usr_t
>>>
>>> Rawhide has added a type of cert_t, so you could execute
>>>
>>> chcon -t cert_t /etc/ssl/certs/cacert.pem
>>
>>
>>
>> the truth is that this is a rhel 4 (but there is not redhat-selinux 
>> list:-) and afaik on it the latest update is 
>> selinux-policy-targeted-1.17.30-2.52.1 so i rather wait for a official 
>> update (from you:-) and not run nscd until this happend...
>> thanks anyway.
>>
> Ok you can get the semi-official one from (It is being tested for U1 now.)
> ftp://people.redhat.com/dwalsh/SELinux/RHEL4/{selinux-policy-targeted, 
> policycoreutils}

it's still said there is no type as cert_t and nscd still can't read 
usr_t:-(

-- 
   Levente                               "Si vis pacem para bellum!"