Re: label

Casper <[email protected]> Mon, 13 Feb 2023 22:51:40 +0100

Newsgroups	gmane.linux.redhat.fedora.selinux
Message-ID	<[email protected]>

Henry Zhang a écrit :
>    Casper:
>    For example, I have a denied message in audit.log:
>    type=AVC msg=audit(1676313787.584:376): avc:  denied  { read write } for  pid=17799 comm="run_at_daemon" path="socket:[54386]" dev="sockfs" ino=54386 scontext=system_u:system_r:run_at_csq_daemon_t:s0 tcontext=system_u:system_r:rssi_daemon_t:s0 tclass=tcp_socket permissive=0
> 
>    how to apply restorecon?

Well this is a TCP socket... not unix file.

For TCP socket, opened at boot or later, label is always good, because
a TCP socket is not persistent.

If you think the "label" ("SELinux context" in this case) of the TCP
socket is not good, you can customize the policy of contexts applied
on opened ports with the semanage command.

For example, I allow port 18000 to have the http_port_t context on my
machine:

  semanage port -a -t http_port_t -p tcp 18000

More infos:

  man semanage

In your message, your TCP socket got run_at_csq_daemon_t context, but
rssi_daemon_t context is not allowed to access, then SELinux is
blocking access (read write).

-- 
GnuPG: AE157E0B29F0BEF2 at keys.openpgp.org
CA Cert: https://dl.casperlefantom.net/pub/ssl/root.der
Jabber/XMPP Messaging: [email protected]

_______________________________________________
selinux mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

signature.asc (application/pgp-signature, 870 B)