Re: Centos 5 OpenVPN / SElinux

On Wed, 2007-05-30 at 19:47 +0200, Bernd Bartmann wrote:
> On 5/30/07, Daniel J Walsh <dwalsh@redhat.com> wrote:
> > Easiest thing to do is update policy with these two rules.
> >
> > # grep openvpn /var/log/audit/audit.log | audit2allow -M myopenvpn
> > # semodule -i myopenvpn.pp
> >
> > This will add the following rules:
> > allow openvpn_t pppd_t:fd use;
> > allow openvpn_t self:process execstack;
> >
> > The pppd_t:fd is probably a leaked file descriptor and could probably be
> > dontaudited.
> > The execstack is potentially a problem in openvpn_t. This is probably a
> > coding problem and should be reported as a bug/
>
> Daniel, do you mean a bug in SElinux or OpenVPN?

OpenVPN. See Ulrich Drepper's description of the selinux memory protection tests, particularly the execstack description.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.