MLS enforcing and kerberos

[Stephen Smalley]

On Fri, 2008-08-22 at 12:51 -0400, Robert Story wrote:
> I'm trying to switch a working kerberos server from targeted/enforcing
> to mls/enforcing.  The krb5kdc daemon start fine, but kadmin does not.
> There is a single avc in the audit log:
> 
> type=AVC msg=audit(1219421464.372:719): avc:  denied  { getattr } for  pid=2436 comm="kadmind" path="/var/tmp/kadmin_0" dev=dm-5 ino=82064 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s15:c0.c1023 tclass=file

BTW, aside from the wrong type on the file, the denial is clearly a MLS
denial - look at the levels on the two contexts.  You have a process
whose current/low level is s0 (aka SystemLow) trying to getattr (read
flow) a file at s15:c0.c1023 (aka SystemHigh).  No surprises there.
The high level of the process is only used as a ceiling for newrole -l
or if the process' domain has certain MLS privileges allowing it to act
up to its ceiling.

-- 
Stephen Smalley
National Security Agency