selinux preventing lircmd

[kwhiskers]

I am using f8 with selinux in enforcing mode. in the xorg logs, i see a message that lircm, the lirc mouse, has permission denied. in the audit logs, it is confirmed that selinux is prevenitng the lircm mouse from starting.

how can i get the mouse to work without disabling selinux (f8 is the first fedora in which i want to seriously give selinux a try and not disable it like i always have done whenever it prevented me from using my computer and from it functioning like it is supposed to).

help!

[DamianS]

Are you running SEtroubleshoot?
Every time there is a policy violation (or attempted violation) it pops up and tells you all about it.
One of its sections is called "allowing access" which tells you what to do, to allow the process and keep SELinux happy.

[kwhiskers]

Yes, I am running selinux troubleshooter.

As it turns out, it doesn't pop up to tell me, as the blocking occurs when X is just trying to start up, but when I arrive at the graphical display, I can click on setroubleshoot and I can view the message.

The message is not very helpful. It says that if I want to allow, I should look in the FAQ. When I click FAQ, nothing happens at all.

I searched on the web and found a number of selinux FAQs, including one from redhat.

What I read on one of these was not very encouraging. You are supposed to run selinux policy generation tool. I gave it a try, although I haven't got a clue what I am supposed to do. I entered lircmd and put in /dev/input because I know it is trying to access one of the events under input/, which appears to be what is getting blocked.

When I finished, a bunch of files were generated: a .te, a shell script, and a few others. I didn't dare run any of these and there were more instructions after that, none of which made any sense to me at all.

I wish there was just a button somewhere that says, allow lircmd, yes or no. I would be comfortable with that.

In my experience, when you mess around with selinux, it involves lengthy relabelling and the final result is that everything is totally messed up (yes, I have tried for the last few fedoras), and every time, the only way to get out of the mess is to totally disable selinux.

I would really like to actually run it enforcing for a change, but these glitches that still never have gotten solved after so many years are disheartening.