Dan Walsh's Blog  Got SELinux?  Previous Entry Add to Memories
Share Next Entry Understanding SELinux A colleague or mine,
Andrew, was baffled by SELinux,  He ran  sudo vpnc
./default.conf  And an  SELinux denial message about vpnc_t
trying to read a file labeled user_home_t.  He did not
understand what was going on.  Three people chimed in and gave
him different ways to get around the SELinux denial.  The first
advised to label the file etc_t chcon -t etc_t ./default.conf
The second advised to build a custom policy using audit2allow.
grep vpnc /var/log/audit/audit.log | audit2allow -m myvpnc;
semodule -i myvpnc.pp  The third advised the user to edit the
file /etc/vpnc/default.conf instead of a local file in his home
dir.  Andrew found all solutions worked, lets examine what is
going on, and figure out which is the best solution.  When
Andrew logs into the system, SELinux assigns him the default
SELinux user unconfined_t.  For the most part the unconfined
user is allowed to do everything he can do if SELinu