libgpod HAL callout and SELinux denials

Daniel J Walsh dwalsh at redhat.com
Wed Jan 14 17:41:44 UTC 2009


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Todd Zullinger wrote:
> I wrote:
>> Daniel J Walsh wrote:
>>> And I will add rules to allow this in F10 and F11.
> 
> The selinux-policy-3.5.13-38.fc10 fixed things nicely (noted in bodhi
> as well).
> 
>>> Are you planning on putting this in F9?
> 
> The rules aren't in the selinux-policy-3.3.1-117.fc9 that's in
> updates-testing yet, right?
> 
> While I'm looking at these iPod callouts, I noticed that there's some
> podsleuth policy to allow podsleuth to do similar things.  Should we
> coordinate things so that podsleuth and libgpod can share some
> selinux-policy?
> 
> I do find that the podsleuth hal callout still produces AVC denials on
> F-10 (every time an iPod is inserted):
> 
> type=AVC msg=audit(1231370741.744:256): avc:  denied  { execstack } for  pid=1521 comm="mono" scontext=system_u:system_r:podsleuth_t:s0 tcontext=system_u:system_r:podsleuth_t:s0 tclass=process
> type=SYSCALL msg=audit(1231370741.744:256): arch=40000003 syscall=125 success=yes exit=0 a0=bfd5f000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=1518 pid=1521 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mono" exe="/usr/bin/mono" subj=system_u:system_r:podsleuth_t:s0 key=(null)
> 
> Is this a generic mono execstack problem or is it something that needs
> to be fixed in podsleuth or selinux-policy?
> 
> 
> 
> ------------------------------------------------------------------------
> 
> --
> fedora-selinux-list mailing list
> fedora-selinux-list at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
mono uses execstack so any app that is written with mono will require
execstack.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkluI9cACgkQrlYvE4MpobNm7ACgk8afxQr+E0iW23DrQpr72+CQ
u3cAoIlNEEOHREFUMMHpZdC1PDz6JEMB
=8jE/
-----END PGP SIGNATURE-----




More information about the fedora-selinux-list mailing list