f11, selinux, ifconfig

[Steven Stern]

Due to problems with our wireless router, I have a script that restarts 
the network on my PC when it loses wireless access:

( ! /usr/sbin/fping $ROUTER_IP > /dev/null ) && /sbin/service network 
restart

When the network is restarted, two AVCs are generated

type=AVC msg=audit(1245718515.955:48417): avc:  denied  { read } for 
pid=28186 comm="gconf-defaults-" name="mls" dev=selinuxfs ino=12 
scontext=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 
tcontext=system_u:object_r:security_t:s0 tclass=file
type=AVC msg=audit(1245718515.955:48417): avc:  denied  { open } for 
pid=28186 comm="gconf-defaults-" name="mls" dev=selinuxfs ino=12 
scontext=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 
tcontext=system_u:object_r:security_t:s0 tclass=file


Audit2allow generates this policy

module ifconfig20090624 1.0;

require {
	type ifconfig_t;
	type security_t;
	type gconfdefaultsm_t;
	class file { read open };
}

#============= gconfdefaultsm_t ==============
allow gconfdefaultsm_t security_t:file { read open };

#============= ifconfig_t ==============
allow ifconfig_t security_t:file { read open };


-- 

   Steve