New answers tagged selinux
0
So I finally got the SELinux errors to go away.
I ended up having to allow the following attributes:
allow syslogd_t named_cache_t:file { read ioctl open getattr };
I found this out by just stringing together a bunch of audit2allow procedures to come up with the final module. I renamed the module rsysloglocal.te. I had to manually compile it by ...
0
Reason behind the issue:
The reason behind the issue is that you have placed the shell script file inside "/home/sh/"
It seems like /sh/ folder which resides under /home/ folder is not a system generated folder (one created while creating system user), instead you have created it manually. So when the cron runs the system restricts access to the scripts ...
1
I guess the traditional way would be to make pseudo-users (like the games-user) for the program/set of programs, assign this user to the groups for devices it should access (eg. camera), and run the program(s) SUID as this user. If you removed permissions for "others" (not owner or group), only the owner and members of the group - including the pseudo-user ...
1
If you look at the context set for the directory /var/log you'll noticed the following things.
First, the directory /var/log has the following selinux context set:
$ ls -Z /var | grep "log$"
drwxr-xr-x. root root system_u:object_r:var_log_t:s0 log
Second, the log file, /var/log/messages, has no additional context:
$ ls -Z /var/log/messages
...
3
What you can do is use a FUSE filesystem like bindfs in combination with a LD_PRELOAD hijacker that disables the mkdir and rmdir system calls. Like create a wrapper.c file with:
#include <errno.h>
int mkdir() { errno = EPERM; return -1; }
int rmdir() { errno = EPERM; return -1; }
Compile it with:
gcc -fPIC -shared -o wrapper.so wrapper.c
And run:
...
6
The elegant way would be using richacls. But that is not an official part of the kernel yet and thus may be difficult to use for you.
An easy workaround would be to use the samba parameters directory mask and force directory security mode to render newly created directories useless (inaccessible) to the users so that they learn not to create directories.
...
Top 50 recent answers are included
