To fix, I'd suggest adding getattr to any allow rule where read
permission is granted in bootloader.te, or replacing uses of "read" with
the r_file_perms macro.
The attached patch is needed to make it complete. However this is something
we may want to reconsider, currently we don't include policy in the initrd so
bootloader_t has no need to read it.
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page