nis+ and selinux targeted (nscd/ntpd problems)

[Daniel J Walsh]

Niki Waibel wrote:

>if you run FC3 and nis-utils-1.4.1 it is necessary to
>add the following in
> /etc/selinux/targeted/src/policy/domains/misc/custom.te
>to make nscd running properly:
>  
>

This looks like you have a labeling problem.  Have file_t files around 
means that
you ran with SELinux disabled at some point.  So you probably need to 
relabel the
system. 

touch /.autorelabel
reboot
will relabel.

The directories under /var/db could be relabeled via

restorecon -R -v /var/db

>===
>allow nscd_t file_t:file { read write };
>        #EXE=/usr/sbin/nscd  NAME=passwd   :  read write
>allow nscd_t file_t:file getattr;
>        #EXE=/usr/sbin/nscd  PATH=/var/db/nscd/passwd   :  getattr
>        #EXE=/usr/sbin/nscd  PATH=/var/db/nscd/group   :  getattr
>        #EXE=/usr/sbin/nscd  PATH=/var/db/nscd/hosts   :  getattr
>allow nscd_t var_t:file { getattr read };
>        #EXE=/usr/sbin/nscd  NAME=NIS_COLD_START   :  read
>        #EXE=/usr/sbin/nscd  PATH=/var/nis/NIS_COLD_START   :  getattr
>allow nscd_t var_run_t:sock_file write;
>        #EXE=/usr/sbin/nscd  NAME=keyservsock   :  write
>allow nscd_t unconfined_t:unix_stream_socket connectto;
>        #EXE=/usr/sbin/nscd  PATH=/var/run/keyservsock   :  connectto
>===
>
>i dont know if
>===
>allow nscd_t file_t:file { read write };
>allow nscd_t file_t:file getattr;
>allow nscd_t var_t:file { getattr read };
>===
>are really a good choice ...
>
>nscd (if you have nisplus in /etc/nsswitch.conf) accesses
>the files in /var/db/nscd (getattr, read, write) and /var/nis.
>maybe there should be sthg like var_nis_t and  var_db_nscd_t?
>
>i am not sure if /etc/{passwd,group,hosts} are accessed as well...
>
>using nis+ i've also figured out that ntpd needs some add rules:
>===
>allow ntpd_t var_t:file { getattr read };
>        #EXE=/usr/sbin/ntpd  NAME=NIS_COLD_START   :  read
>        #EXE=/usr/sbin/ntpd  PATH=/var/nis/NIS_COLD_START   :  getattr
>allow ntpd_t var_run_t:sock_file write;
>        #EXE=/usr/sbin/ntpd  NAME=keyservsock   :  write
>allow ntpd_t unconfined_t:unix_stream_socket connectto;
>        #EXE=/usr/sbin/ntpd  PATH=/var/run/keyservsock   :  connectto
>===
>
>can this be integrated into the std targeted policy?
>  
>