racoon denials

Daniel Fazekas fdsubs at t-online.hu
Mon Aug 17 15:37:42 UTC 2009

On Aug 17, 2009, at 16:10, Dominick Grift wrote:

> echo "setkey_domtrans(racoon_t)" >> myracoon.te;

This line results in the follow error:
myracoon.te":6:ERROR 'syntax error' at token 'setkey_domtrans' on line  

And the avcs which cause audit2allow to suggest this remains:
allow racoon_t setkey_exec_t:file { read execute open  
execute_no_trans };

But it seems to have cleared up all the rest, thanks!

> This is just the rules translated into policy. I am not positive  
> whether racoon or setkey creates the object in tmp, read shadow, and  
> get attributes of fs_t:filesystem.

racoon itself reads shadow.
The rest is all caused by racoon executing a bash shell script, which  
in turn executes setkey.

I believe now that the tmp file accesses are likely caused by that  
script's use of here-document << syntax to specify the input for setkey.


/sbin/setkey -c << EOT
spdadd ${INTERNAL_ADDR4}/32[any][any] any -P in ipsec
spdadd[any] ${INTERNAL_ADDR4}/32[any] any -P out ipsec

More information about the fedora-selinux-list mailing list