policy for mgetty fax receive and new_fax

[Dominick Grift]

On 12/29/2009 01:52 PM, Klaus Lichtenwalder wrote:
> Dominick,
> 
> Am Dienstag, den 29.12.2009, 13:02 +0100 schrieb Dominick Grift:
> 
>> Whoops i forgot some policy:
> 
> Ok, I was already wondering whether that could be it, trying to
> understand :-)
> 
>>
>> echo "policy_module(mygetty, 1.0.0)" > mygetty.te;
>> echo "optional_policy(\`" >> mygetty.te;
>> echo "gen_require(\`" >> mygetty.te;
>> echo "type getty_t;" >> mygetty.te;
>> echo "')" >> mygetty.te;
>> echo "corecmd_exec_bin(getty_t)" >> mygetty.te;
>> echo "corecmd_exec_shell(getty_t)" >> mygetty.te;
>> echo "kernel_read_system_state(getty_t)" >> mygetty.te;
>> echo "')" >> mygetty.te;
>>
>> make -f /usr/share/selinux/devel/Makefile mygetty.pp
>> sudo semodule -i mygetty.pp
>>
>> As for system_mail_t:
>>
>> echo "policy_module(mymail, 1.0.0)" > mymail.te;
>> echo "optional_policy(\`" >> mymail.te;
>> echo "gen_require(\`" >> mymail.te;
>> echo "type system_mail_t;" >> mymail.te;
>> echo "')" >> mymail.te;
>> echo "term_use_unallocated_ttys(system_mail_t)" >> mymail.te;
>> echo "')" >> mymail.te;
>>
>> make -f /usr/share/selinux/devel/Makefile mymail.pp
>> sudo semodule -i mymail.pp
>>
>> That should help. 
> 
> 
> This helps a lot, as fax receiving (and notifying) works without AVC
> denials showing up. No I'm off trying to understand everything. With all
> those makros, one get's a lot done with little code :-)

Well there was already policy for getty present but it seems to not be
sufficient for your configuration (or it may signal misconfiguration on
your part)

With regard to system_mail_t this is likely due to a bug. (known bug)
Where the tty device does not get properly labeled. My fix makes it work
but it is not a good fix ( user tty devices need to get labeled properly)

If you are certain that you are using getty properly then consider
reporting the AVC denials and my policy for getty_t to
bugzilla/selinux-policy so that getties policy can be extended to
support your configuration.

> Thanks again
> Klaus
> 
> 
> 
> --
> fedora-selinux-list mailing list
> fedora-selinux-list at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 261 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/fedora-selinux-list/attachments/20091229/11a3ce71/attachment.sig>