All of lore.kernel.org
 help / color / mirror / Atom feed
From: James Morris <jmorris@namei.org>
To: Alexey Dobriyan <adobriyan@gmail.com>
Cc: auke-jan.h.kok@intel.com, e1000-devel@lists.sourceforge.net,
	netdev@vger.kernel.org, Daniel J Walsh <dwalsh@redhat.com>,
	"Eric W. Biederman" <ebiederm@xmission.com>,
	Eric Paris <eparis@parisplace.org>,
	Andrew Morton <akpm@linux-foundation.org>,
	Stephen Smalley <sds@tycho.nsa.gov>,
	David Miller <davem@davemloft.net>
Subject: Re: networking probs in next-20081203
Date: Fri, 12 Dec 2008 20:26:40 +1100 (EST)	[thread overview]
Message-ID: <alpine.LRH.1.10.0812122022520.32426@tundra.namei.org> (raw)
In-Reply-To: <20081212052420.GA14948@x200.localdomain>

On Fri, 12 Dec 2008, Alexey Dobriyan wrote:

> Yes, please, someone test it.

Still getting avc denials:

avc:  denied  { mount } for  pid=2308 comm="dhclient" name="/" 
dev=proc/net ino=4026531842 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 
tcontext=system_u:object_r:proc_t:s0 tclass=filesystem
type=SYSCALL msg=audit(1229073699.174:53): arch=c000003e syscall=2 
success=no exit=-2 a0=45bef7 a1=80000 a2=1b6 a3=7f296
e71c6f0 items=0 ppid=2259 pid=2308 auid=0 uid=0 gid=0 euid=0 suid=0 
fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=1 comm="
dhclient" exe="/sbin/dhclient" 
subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null)

It seems the problem is that the /proc/net mountpoint is now labeled as 
proc_t.

-- 
James Morris
<jmorris@namei.org>

------------------------------------------------------------------------------
SF.Net email is Sponsored by MIX09, March 18-20, 2009 in Las Vegas, Nevada.
The future of the web can't happen without you.  Join us at MIX09 to help
pave the way to the Next Web now. Learn more and register at
http://ad.doubleclick.net/clk;208669438;13503038;i?http://2009.visitmix.com/

  reply	other threads:[~2008-12-12  9:26 UTC|newest]

Thread overview: 28+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-12-04  1:18 networking probs in next-20081203 Andrew Morton
2008-12-04 15:14 ` Alexey Dobriyan
2008-12-04 17:41   ` Kok, Auke
2008-12-04 17:52     ` Alexey Dobriyan
2008-12-04 18:11       ` [E1000-devel] " Stephen Smalley
2008-12-04 18:21         ` David Miller
2008-12-04 19:32           ` Stephen Smalley
2008-12-04 20:06             ` Stephen Smalley
2008-12-04 21:00               ` [E1000-devel] " Eric W. Biederman
2008-12-05  2:03                 ` James Morris
2008-12-05  7:49                   ` Eric W. Biederman
2008-12-05 14:12                 ` Stephen Smalley
2008-12-11 10:41                   ` James Morris
2008-12-12  5:24                     ` Alexey Dobriyan
2008-12-12  9:26                       ` James Morris [this message]
2008-12-12  9:29                         ` James Morris
2008-12-12 10:51                           ` Eric W. Biederman
2008-12-12 21:40                             ` [E1000-devel] " James Morris
2008-12-12 21:24                         ` Stephen Smalley
2008-12-15 13:28                           ` James Morris
2008-12-19  1:04                             ` [PATCH 0/3][RFC] Fix security and SELinux handling of proc/* filesystems James Morris
2008-12-19  1:05                               ` [PATCH 1/3][RFC] SELinux: correctly detect proc filesystems of the form "proc/foo" James Morris
2008-12-19 12:29                                 ` David P. Quigley
2008-12-19  1:06                               ` [PATCH 2/3][RFC] security: pass mount flags to security_sb_kern_mount() James Morris
2008-12-19 12:52                                 ` Stephen Smalley
2008-12-19  1:07                               ` [PATCH 3/3][RFC] SELinux: don't check permissions for kernel mounts James Morris
2008-12-19 12:52                                 ` Stephen Smalley
2008-12-19  6:40                               ` [PATCH 0/3][RFC] Fix security and SELinux handling of proc/* filesystems David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=alpine.LRH.1.10.0812122022520.32426@tundra.namei.org \
    --to=jmorris@namei.org \
    --cc=adobriyan@gmail.com \
    --cc=akpm@linux-foundation.org \
    --cc=auke-jan.h.kok@intel.com \
    --cc=davem@davemloft.net \
    --cc=dwalsh@redhat.com \
    --cc=e1000-devel@lists.sourceforge.net \
    --cc=ebiederm@xmission.com \
    --cc=eparis@parisplace.org \
    --cc=netdev@vger.kernel.org \
    --cc=sds@tycho.nsa.gov \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.