0

I want to confine a certain user to be able to bind a node.js server to a certain port. That bit is working.

What isn't working is allowing said user to access his own files.

audit2allow is telling me this:

#============= user_t ==============
#!!!! This avc is a constraint violation.  You will need to add an attribute to either the source or target type to make it work.
#Constraint rule: 
allow user_t user_home_t:dir { write remove_name add_name };
#!!!! This avc is a constraint violation.  You will need to add an attribute to either the source or target type to make it work.
#Constraint rule: 
allow user_t user_home_t:file { read write execute open };

I have no idea what attribute I could add to make it more clear my user should be able to access its own files.

Here's the audit.log entry

type=AVC msg=audit(1396865445.876:184): avc:  denied  { write } for  pid=20389 comm="node" name="hawkejs-client-side.js" dev=md2 ino=92144931 scontext=sandbox_u:user_r:user_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file

audit2why is giving me this:

type=AVC msg=audit(1396865445.876:184): avc:  denied  { write } for  pid=20389 comm="node" name="hawkejs-client-side.js" dev=md2 ino=92144931 scontext=sandbox_u:user_r:user_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file

    Was caused by:
        Policy constraint violation.

        May require adding a type attribute to the domain or type to satisfy the constraint.

        Constraints are defined in the policy sources in policy/constraints (general), policy/mcs (MCS), and policy/mls (MLS).
  • Did you write the system's entire SELinux policy from scratch? – Michael Hampton Apr 7 '14 at 12:20
  • SELinux in Debian is just not operative. – dawud Apr 9 '14 at 19:13
-1

This link is explaining about constraint violation, and how to copw with: http://cat.devtwo.org/post/An-SELinux-constraint-violation-(p-1-of-5)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.