please see http://www.coker.com.au/selinux/tweaks.html,
section of which, for libnss:
libnss-db requires that all programs get access to the database
directory (/var/lib/misc by default) and the files under it. The
policy could be adjusted to assign etc_t to the directory
containing those files, and the cron job used to rebuild the
databases would need to be granted write access to etc_t.
However I have not bothered doing this as nss-db on Linux still
has issues due to having no mechanism for automatic updates
and for the applications to determine whether the flat-file
or the db has the most current data.
If the Linux implementation was as good as the AIX
implementation then I would sort this out. However I don't
feel inclined to write policy for something that has so many
problems (and which does not actually give a performance
benefit in the vast majority of systems).
my wishlist item is please could the issues in libnss-db be
sorted out, such that a decent SE/Linux security policy can
be written for this program!
thank you,
l.