On Fri, 19 Mar 2004 19:52, Aleksey Nogin <aleksey(a)nogin.org> wrote:
Not sure where these come from (possibly it's because of my using
the
vnc module in X). Safe to dontaudit?
audit(1079686139.241:0): avc: denied { getattr } for pid=9439
exe=/usr/X11R6/bin/XFree86 path=/dev/urandom dev=hda2 ino=2689265
scontext=system_u:system_r:xdm_xserver_t
tcontext=system_u:object_r:urandom_device_t tclass=chr_file
audit(1079686139.241:0): avc: denied { ioctl } for pid=9439
exe=/usr/X11R6/bin/XFree86 path=/dev/urandom dev=hda2 ino=2689265
scontext=system_u:system_r:xdm_xserver_t
tcontext=system_u:object_r:urandom_device_t tclass=chr_file
As far as I am aware there is no valid ioctl for the urandom device, it takes
reads as requests for random data and writes as additions to the entropy
pool. Programs that do an IOCTL are bogus, but there's no harm in allowing
it. As for getattr, that's valid so I've changed my tree to allow that too.
Read was already allowed for SSP (which only does blind reads with no getattr
and no ioctl).
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page