execmem
by Jason Dravet
When execstack was turned off on December 9 and execmem and execmod were
turned off on December 10 several programs broke and I opened bugzilla
issues for them. Now one of the programmers has contacted me about this,
but now the program works. I am pretty sure the program was not fixed (I
have not updated it) as suggested by
http://people.redhat.com/drepper/selinux-mem.html. I think the selinux
policy changed and allows the exec* access again. How can I turn off this
access so the program can be fixed properly?
I tried the following command: setsebool -P allow_execmem=0 allow_execmod=0
allow_execheap=0
and this is what I got:
libsemanage.dbase_llist_set: record not found in the database
libsemanage.dbase_llist_set: could not set record value
Could not change policy booleans
I am running selinux-policy-targeted-2.1.8-3 and selinux-policy-2.1.8-3 in
enforcing mode on Fedora rawhide.
Thanks,
Jason
18 years, 3 months
more on readahead/hal
by Tom London
Today's rawhide, targeted/enforcing.
[Reporting this since build log indicated fixes for hal/readahead.
Sorry if I am jumping the gun....]
hal issues:
----
type=PATH msg=audit(01/10/2006 07:18:22.011:13) : item=0
name=/media/disk/.created-by-hal flags=follow inode=2289300 dev=fd:00
mode=file,644 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/10/2006 07:18:22.011:13) : cwd=/
type=AVC_PATH msg=audit(01/10/2006 07:18:22.011:13) :
path=/media/disk/.created-by-hal
type=SYSCALL msg=audit(01/10/2006 07:18:22.011:13) : arch=i386
syscall=stat64 success=no exit=-13(Permission denied) a0=870f008
a1=bf9ee1b8 a2=25cff4 a3=870f5a8 items=1 pid=2512
auid=unknown(4294967295) uid=root gid=root euid=root suid=root
fsuid=root egid=root sgid=root fsgid=root comm=hal-system-stor
exe=/bin/bash
type=AVC msg=audit(01/10/2006 07:18:22.011:13) : avc: denied {
getattr } for pid=2512 comm=hal-system-stor name=.created-by-hal
dev=dm-0 ino=2289300 scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:mnt_t:s0 tclass=file
----
type=PATH msg=audit(01/10/2006 07:18:22.027:14) : item=0
name=/media/disk-1/.created-by-hal flags=follow inode=2289302
dev=fd:00 mode=file,644 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/10/2006 07:18:22.027:14) : cwd=/
type=AVC_PATH msg=audit(01/10/2006 07:18:22.027:14) :
path=/media/disk-1/.created-by-hal
type=SYSCALL msg=audit(01/10/2006 07:18:22.027:14) : arch=i386
syscall=stat64 success=no exit=-13(Permission denied) a0=870f588
a1=bf9ee1b8 a2=25cff4 a3=870f008 items=1 pid=2512
auid=unknown(4294967295) uid=root gid=root euid=root suid=root
fsuid=root egid=root sgid=root fsgid=root comm=hal-system-stor
exe=/bin/bash
type=AVC msg=audit(01/10/2006 07:18:22.027:14) : avc: denied {
getattr } for pid=2512 comm=hal-system-stor name=.created-by-hal
dev=dm-0 ino=2289302 scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:mnt_t:s0 tclass=file
----
type=PATH msg=audit(01/10/2006 07:18:22.059:15) : item=0
name=/media/disk-2/.created-by-hal flags=follow inode=2289314
dev=fd:00 mode=file,644 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/10/2006 07:18:22.059:15) : cwd=/
type=AVC_PATH msg=audit(01/10/2006 07:18:22.059:15) :
path=/media/disk-2/.created-by-hal
type=SYSCALL msg=audit(01/10/2006 07:18:22.059:15) : arch=i386
syscall=stat64 success=no exit=-13(Permission denied) a0=870f688
a1=bf9ee1b8 a2=25cff4 a3=870f008 items=1 pid=2512
auid=unknown(4294967295) uid=root gid=root euid=root suid=root
fsuid=root egid=root sgid=root fsgid=root comm=hal-system-stor
exe=/bin/bash
type=AVC msg=audit(01/10/2006 07:18:22.059:15) : avc: denied {
getattr } for pid=2512 comm=hal-system-stor name=.created-by-hal
dev=dm-0 ino=2289314 scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:mnt_t:s0 tclass=file
----
type=PATH msg=audit(01/10/2006 07:18:24.972:16) : item=0 name=/boot
flags=follow inode=2 dev=03:02 mode=dir,755 ouid=root ogid=root
rdev=00:00
type=CWD msg=audit(01/10/2006 07:18:24.972:16) : cwd=/
type=AVC_PATH msg=audit(01/10/2006 07:18:24.972:16) : path=/boot
type=SYSCALL msg=audit(01/10/2006 07:18:24.972:16) : arch=i386
syscall=stat64 success=no exit=-13(Permission denied) a0=bff484ce
a1=bff4844c a2=258ff4 a3=303 items=1 pid=2507 auid=unknown(4294967295)
uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root
fsgid=root comm=hald exe=/usr/sbin/hald
type=AVC msg=audit(01/10/2006 07:18:24.972:16) : avc: denied {
getattr } for pid=2507 comm=hald name=/ dev=hda2 ino=2
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:boot_t:s0 tclass=dir
----
type=PATH msg=audit(01/10/2006 07:18:25.076:17) : item=0 name=/boot
flags=follow inode=2 dev=03:02 mode=dir,755 ouid=root ogid=root
rdev=00:00
type=CWD msg=audit(01/10/2006 07:18:25.076:17) : cwd=/
type=AVC_PATH msg=audit(01/10/2006 07:18:25.076:17) : path=/boot
type=SYSCALL msg=audit(01/10/2006 07:18:25.076:17) : arch=i386
syscall=stat64 success=no exit=-13(Permission denied) a0=bff484ce
a1=bff4844c a2=258ff4 a3=302 items=1 pid=2507 auid=unknown(4294967295)
uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root
fsgid=root comm=hald exe=/usr/sbin/hald
type=AVC msg=audit(01/10/2006 07:18:25.076:17) : avc: denied {
getattr } for pid=2507 comm=hald name=/ dev=hda2 ino=2
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:boot_t:s0 tclass=dir
----
type=PATH msg=audit(01/10/2006 07:18:25.228:18) : item=0 name=/boot
flags=follow inode=2 dev=03:02 mode=dir,755 ouid=root ogid=root
rdev=00:00
type=CWD msg=audit(01/10/2006 07:18:25.228:18) : cwd=/
type=AVC_PATH msg=audit(01/10/2006 07:18:25.228:18) : path=/boot
type=SYSCALL msg=audit(01/10/2006 07:18:25.228:18) : arch=i386
syscall=stat64 success=no exit=-13(Permission denied) a0=bff484ce
a1=bff4844c a2=258ff4 a3=301 items=1 pid=2507 auid=unknown(4294967295)
uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root
fsgid=root comm=hald exe=/usr/sbin/hald
type=AVC msg=audit(01/10/2006 07:18:25.228:18) : avc: denied {
getattr } for pid=2507 comm=hald name=/ dev=hda2 ino=2
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:boot_t:s0 tclass=dir
----
type=PATH msg=audit(01/10/2006 07:18:31.368:20) : item=0 name=/boot
flags=follow inode=2 dev=03:02 mode=dir,755 ouid=root ogid=root
rdev=00:00
type=CWD msg=audit(01/10/2006 07:18:31.368:20) : cwd=/
type=AVC_PATH msg=audit(01/10/2006 07:18:31.368:20) : path=/boot
type=SYSCALL msg=audit(01/10/2006 07:18:31.368:20) : arch=i386
syscall=stat64 success=no exit=-13(Permission denied) a0=bff4864e
a1=bff485cc a2=258ff4 a3=301 items=1 pid=2507 auid=unknown(4294967295)
uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root
fsgid=root comm=hald exe=/usr/sbin/hald
type=AVC msg=audit(01/10/2006 07:18:31.368:20) : avc: denied {
getattr } for pid=2507 comm=hald name=/ dev=hda2 ino=2
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:boot_t:s0 tclass=dir
----
type=PATH msg=audit(01/10/2006 07:19:16.279:31) : item=0
name=/media/disk-3/.created-by-hal flags=parent,open,create
inode=2289282 dev=fd:00 mode=dir,755 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/10/2006 07:19:16.279:31) : cwd=/
type=SYSCALL msg=audit(01/10/2006 07:19:16.279:31) : arch=i386
syscall=open success=no exit=-13(Permission denied) a0=bfc0b888
a1=8941 a2=1b6 a3=8941 items=1 pid=2837 auid=unknown(4294967295)
uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root
fsgid=root comm=touch exe=/bin/touch
type=AVC msg=audit(01/10/2006 07:19:16.279:31) : avc: denied {
create } for pid=2837 comm=touch name=.created-by-hal
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:mnt_t:s0 tclass=file
----
type=PATH msg=audit(01/10/2006 07:19:22.523:32) : item=0
name=/media/disk-3/.created-by-hal flags=parent,open,create
inode=2289282 dev=fd:00 mode=dir,755 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/10/2006 07:19:22.523:32) : cwd=/
type=SYSCALL msg=audit(01/10/2006 07:19:22.523:32) : arch=i386
syscall=open success=no exit=-13(Permission denied) a0=bfdad851
a1=8941 a2=1b6 a3=8941 items=1 pid=2850 auid=unknown(4294967295)
uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root
fsgid=root comm=touch exe=/bin/touch
type=AVC msg=audit(01/10/2006 07:19:22.523:32) : avc: denied {
create } for pid=2850 comm=touch name=.created-by-hal
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:mnt_t:s0 tclass=file
----
type=PATH msg=audit(01/10/2006 07:19:22.531:33) : item=0 name=/boot
flags=follow inode=2 dev=03:02 mode=dir,755 ouid=root ogid=root
rdev=00:00
type=CWD msg=audit(01/10/2006 07:19:22.531:33) : cwd=/
type=AVC_PATH msg=audit(01/10/2006 07:19:22.531:33) : path=/boot
type=SYSCALL msg=audit(01/10/2006 07:19:22.531:33) : arch=i386
syscall=stat64 success=no exit=-13(Permission denied) a0=bff4864e
a1=bff485cc a2=258ff4 a3=301 items=1 pid=2507 auid=unknown(4294967295)
uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root
fsgid=root comm=hald exe=/usr/sbin/hald
type=AVC msg=audit(01/10/2006 07:19:22.531:33) : avc: denied {
getattr } for pid=2507 comm=hald name=/ dev=hda2 ino=2
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:boot_t:s0 tclass=dir
----
type=PATH msg=audit(01/10/2006 07:19:22.531:34) : item=0
name=/media/disk-3 flags=follow inode=2 dev=03:02 mode=dir,755
ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/10/2006 07:19:22.531:34) : cwd=/
type=AVC_PATH msg=audit(01/10/2006 07:19:22.531:34) : path=/media/disk-3
type=SYSCALL msg=audit(01/10/2006 07:19:22.531:34) : arch=i386
syscall=stat64 success=no exit=-13(Permission denied) a0=bff4864e
a1=bff485cc a2=258ff4 a3=301 items=1 pid=2507 auid=unknown(4294967295)
uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root
fsgid=root comm=hald exe=/usr/sbin/hald
type=AVC msg=audit(01/10/2006 07:19:22.531:34) : avc: denied {
getattr } for pid=2507 comm=hald name=/ dev=hda2 ino=2
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:boot_t:s0 tclass=dir
----
Still have problems with readahead. From /var/log/messages:
Jan 10 07:18:01 localhost kernel: audit(1136906246.537:4): avc:
denied { search } for pid=1570 comm="readahead" name="/" dev=ramfs
ino=4195 scontext=system_u:system_r:readahead_t:s0
tcontext=system_u:object_r:ramfs_t:s0 tclass=dir
Jan 10 07:18:01 localhost kernel: audit(1136906246.537:5): avc:
denied { search } for pid=1570 comm="readahead" name="/" dev=ramfs
ino=4195 scontext=system_u:system_r:readahead_t:s0
tcontext=system_u:object_r:ramfs_t:s0 tclass=dir
Jan 10 07:18:01 localhost kernel: audit(1136906246.537:6): avc:
denied { search } for pid=1570 comm="readahead" name="/" dev=ramfs
ino=4195 scontext=system_u:system_r:readahead_t:s0
tcontext=system_u:object_r:ramfs_t:s0 tclass=dir
Jan 10 07:18:01 localhost kernel: audit(1136906254.213:7): avc:
denied { search } for pid=1570 comm="readahead" name="/" dev=ramfs
ino=4195 scontext=system_u:system_r:readahead_t:s0
tcontext=system_u:object_r:ramfs_t:s0 tclass=dir
Jan 10 07:18:01 localhost kernel: audit(1136906254.213:8): avc:
denied { search } for pid=1570 comm="readahead" name="/" dev=ramfs
ino=4195 scontext=system_u:system_r:readahead_t:s0
tcontext=system_u:object_r:ramfs_t:s0 tclass=dir
Jan 10 07:18:01 localhost kernel: audit(1136906254.213:9): avc:
denied { search } for pid=1570 comm="readahead" name="/" dev=ramfs
ino=4195 scontext=system_u:system_r:readahead_t:s0
tcontext=system_u:object_r:ramfs_t:s0 tclass=dir
--
Tom London
18 years, 3 months
FC3 nscd AVC denied
by Lamont R. Peterson
All,
Here's the setup ... Using authconfig to turn on nscd and setup TLS encrypted
LDAP authentication & user information, the LDAP server's "server.crt" file
has been copied to /etc/openldap/ on the client and
the /etc/openldap/ldap.conf file got the line
"TLS_CACERT /etc/openldap/server.crt" added to it. I'm using the latest nscd
package for FC3 (which fixed another bug related to LDAP).
Starting nscd produces these three avc denied messages
(from /var/log/messages):
Jan 11 09:56:52 station13 nscd: 27993 Access Vector Cache (AVC) started
Jan 11 09:56:52 station13 nscd: nscd startup succeeded
Jan 11 09:56:53 station13 kernel: audit(1136998613.032:0): avc: denied
{ read } for pid=27993 exe=/usr/sbin/nscd name=cert.pem dev=sda2 ino=738049
scontext=root:system_r:nscd_t tcontext=system_u:object_r:usr_t
tclass=lnk_file
Jan 11 09:56:53 station13 kernel: audit(1136998613.032:0): avc: denied
{ read } for pid=27993 exe=/usr/sbin/nscd name=urandom dev=tmpfs ino=935
scontext=root:system_r:nscd_t tcontext=system_u:object_r:urandom_device_t
tclass=chr_file
Jan 11 09:56:53 station13 kernel: audit(1136998613.032:0): avc: denied
{ read } for pid=27993 exe=/usr/sbin/nscd name=random dev=tmpfs ino=934
scontext=root:system_r:nscd_t tcontext=system_u:object_r:random_device_t
tclass=chr_file
Also, in this configuration, logins to LDAP accounts fail; the username is
unrecognized. If I shut down nscd, then LDAP account logins work again.
Running "setsebool -P nscd_disable_trans 1" and then restarting nscd (i.e.
"/etc/init.d/nscd restart") fixes the login problem. It appears that nscd
will only attempts to open file handles to /usr/share/ssl/cert.pem which is a
symlink to certs/ca-bundle.crt (both have the label system_u:object_r:usr_t)
and /dev/random & /dev/urandom at startup.
Examining /etc/selinux/targeted/src/policy/domains/program/nscd.te (that is
the right file, yes?) in the latest selinux-policy-targeted-sources for FC3
looks like nscd_t should have access to both urandom_device_t &
random_device_t:
75: allow nscd_t { urandom_device_t random_device_t }:chr_file { getattr
read};
which is a little different from the originally shipped policy:
85: allow nscd_t uransom_device_t:chr_file { getattr read };
It also looks like nscd.te used to have:
86: r_dir_file(nscd_t, usr_t)
but the newest policy has no lines referencing usr_t. I'm not certain that
nscd actually needs to read /usr/share/ssl/cert.pem in order for TLS to work,
but I can understand the need to access /dev/random and/or /dev/urandom.
OK. So, I haven't done much writing of SELinux policy, and most of that was a
while ago, but It looks like the original policy shouldn't have been causing
these problems to begin with.
What am I missing here?
Oh, and BTW, this configuration works fine on a RHEL4 client without updates.
which made me think that updating the FC3 selinux-policy-targeted package
could fix the issue. Nope; it didn't.
Thanks for all your hard work on SELinux and policy.
--
Lamont R. Peterson <lamont(a)gurulabs.com>
Senior Instructor
Guru Labs, L.C. [ http://www.GuruLabs.com/ ]
18 years, 3 months
Postfix virtual and Dovecot
by Karyl F. Stein
Any ideas on how I can get the Postfix virtual transport to deliver to a
maildir and have Dovecot pick it up? I can get one or the other to
work, but not both. The maildirs are in /srv/mirror/mail. If I make
that directory have the postfix_spool_t context, Postfix writes there
fine, but Dovecot can't access it. If I make the directory have
mail_spool_t, then Dovecot can access it, but Postfix can't. As far as
I can tell, there doesn't seem to be a common context.
I'm running FC4 with the targeted policy.
Thanks,
Karyl
18 years, 3 months
FC4 documentation for apache + selinux ?
by Timothy Murphy
Is there any documentation about the interaction
of selinux and apache under Fedora-4?
I looked at "Understanding and Customizing the Apache HTTP SELinux Policy"
at <http://fedora.redhat.com/docs/selinux-apache-fc3/index.html>,
but the changes between FC3 and FC4 seemed to make much of this irrelevant.
Is there a corresponding document for FC4?
--
Timothy Murphy
e-mail (<80k only): tim /at/ birdsnest.maths.tcd.ie
tel: +353-86-2336090, +353-1-2842366
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland
18 years, 3 months
Today's avcs....(readahead, hald)
by Tom London
Running today's rawhide(selinux-policy-targeted-2.1.7-3),
targeted/enforcing, got some avcs in messages and audit.log.
I rebooted in permissive mode and:
Get this in /var/log/messages (before auditd starts, I guess):
----
type=PATH msg=audit(01/07/2006 11:44:46.028:12) : item=0 name=/media/
flags=follow,directory,open inode=2289281 dev=fd:00 mode=dir,755
ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/07/2006 11:44:46.028:12) : cwd=/
type=SYSCALL msg=audit(01/07/2006 11:44:46.028:12) : arch=i386
syscall=open success=yes exit=3 a0=9233228 a1=18800 a2=261158
a3=92331e8 items=1 pid=2532 auid=unknown(4294967295) uid=root gid=root
euid=root suid=root fsuid=root egid=root sgid=root fsgid=root
comm=hal-system-stor exe=/bin/bash
type=AVC msg=audit(01/07/2006 11:44:46.028:12) : avc: denied { read
} for pid=2532 comm=hal-system-stor name=media dev=dm-0 ino=2289281
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:mnt_t:s0 tclass=dir
----
type=PATH msg=audit(01/07/2006 11:44:50.152:13) : item=0 name=/boot
flags=follow inode=2 dev=03:02 mode=dir,755 ouid=root ogid=root
rdev=00:00
type=CWD msg=audit(01/07/2006 11:44:50.152:13) : cwd=/
type=AVC_PATH msg=audit(01/07/2006 11:44:50.152:13) : path=/boot
type=SYSCALL msg=audit(01/07/2006 11:44:50.152:13) : arch=i386
syscall=stat64 success=yes exit=0 a0=bfd80ede a1=bfd80e5c a2=359ff4
a3=303 items=1 pid=2527 auid=unknown(4294967295) uid=root gid=root
euid=root suid=root fsuid=root egid=root sgid=root fsgid=root
comm=hald exe=/usr/sbin/hald
type=AVC msg=audit(01/07/2006 11:44:50.152:13) : avc: denied {
getattr } for pid=2527 comm=hald name=/ dev=hda2 ino=2
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:boot_t:s0 tclass=dir
----
type=PATH msg=audit(01/07/2006 11:44:50.152:14) : item=0
name=/proc/sys/fs/binfmt_misc flags=follow inode=4808 dev=00:13
mode=dir,755 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/07/2006 11:44:50.152:14) : cwd=/
type=SYSCALL msg=audit(01/07/2006 11:44:50.152:14) : arch=i386
syscall=stat64 success=yes exit=0 a0=bfd80ed9 a1=bfd80e5c a2=359ff4
a3=303 items=1 pid=2527 auid=unknown(4294967295) uid=root gid=root
euid=root suid=root fsuid=root egid=root sgid=root fsgid=root
comm=hald exe=/usr/sbin/hald
type=AVC msg=audit(01/07/2006 11:44:50.152:14) : avc: denied {
search } for pid=2527 comm=hald name=fs dev=proc ino=-268435429
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:sysctl_fs_t:s0 tclass=dir
----
type=PATH msg=audit(01/07/2006 11:44:50.152:15) : item=0
name=/var/lib/nfs/rpc_pipefs flags=follow inode=5930 dev=00:14
mode=dir,755 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/07/2006 11:44:50.152:15) : cwd=/
type=SYSCALL msg=audit(01/07/2006 11:44:50.152:15) : arch=i386
syscall=stat64 success=yes exit=0 a0=bfd80edb a1=bfd80e5c a2=359ff4
a3=303 items=1 pid=2527 auid=unknown(4294967295) uid=root gid=root
euid=root suid=root fsuid=root egid=root sgid=root fsgid=root
comm=hald exe=/usr/sbin/hald
type=AVC msg=audit(01/07/2006 11:44:50.152:15) : avc: denied {
search } for pid=2527 comm=hald name=nfs dev=dm-0 ino=2142222
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:var_lib_nfs_t:s0 tclass=dir
----
type=PATH msg=audit(01/07/2006 11:45:00.837:17) : item=0
name=/var/lib/nfs/rpc_pipefs flags=follow inode=5930 dev=00:14
mode=dir,755 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/07/2006 11:45:00.837:17) : cwd=/
type=SYSCALL msg=audit(01/07/2006 11:45:00.837:17) : arch=i386
syscall=stat64 success=yes exit=0 a0=bfd8105b a1=bfd80fdc a2=359ff4
a3=bfd8105e items=1 pid=2527 auid=unknown(4294967295) uid=root
gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root
comm=hald exe=/usr/sbin/hald
type=AVC msg=audit(01/07/2006 11:45:00.837:17) : avc: denied {
search } for pid=2527 comm=hald name=nfs dev=dm-0 ino=2142222
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:var_lib_nfs_t:s0 tclass=dir
----
type=PATH msg=audit(01/07/2006 11:45:40.036:25) : item=1
flags=follow,open inode=327257 dev=fd:00 mode=file,755 ouid=root
ogid=root rdev=00:00
type=PATH msg=audit(01/07/2006 11:45:40.036:25) : item=0
name=/usr/bin/skype flags=follow,open inode=145693 dev=fd:00
mode=file,755 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/07/2006 11:45:40.036:25) : cwd=/home/tbl
type=SYSCALL msg=audit(01/07/2006 11:45:40.036:25) : arch=i386
syscall=execve success=yes exit=0 a0=9126db0 a1=bffa9740 a2=9114078
a3=0 items=2 pid=2857 auid=unknown(4294967295) uid=tbl gid=tbl
euid=tbl suid=tbl fsuid=tbl egid=tbl sgid=tbl fsgid=tbl comm=skype
exe=/usr/bin/skype
type=AVC msg=audit(01/07/2006 11:45:40.036:25) : avc: granted {
execmem } for pid=2857 comm=skype
scontext=user_u:system_r:unconfined_t:s0
tcontext=user_u:system_r:unconfined_t:s0 tclass=process
type=AVC msg=audit(01/07/2006 11:45:40.036:25) : avc: granted {
execmem } for pid=2857 comm=skype
scontext=user_u:system_r:unconfined_t:s0
tcontext=user_u:system_r:unconfined_t:s0 tclass=process
----
type=PATH msg=audit(01/07/2006 11:45:41.792:26) : item=0
name=/media/disk flags=parent inode=2289281 dev=fd:00 mode=dir,755
ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/07/2006 11:45:41.792:26) : cwd=/
type=SYSCALL msg=audit(01/07/2006 11:45:41.792:26) : arch=i386
syscall=mkdir success=yes exit=0 a0=bfa31919 a1=1ff a2=804e1b8
a3=bfa31919 items=1 pid=2871 auid=unknown(4294967295) uid=root
gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root
comm=mkdir exe=/bin/mkdir
type=AVC msg=audit(01/07/2006 11:45:41.792:26) : avc: denied {
create } for pid=2871 comm=mkdir name=disk
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:mnt_t:s0 tclass=dir
type=AVC msg=audit(01/07/2006 11:45:41.792:26) : avc: denied {
add_name } for pid=2871 comm=mkdir name=disk
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:mnt_t:s0 tclass=dir
type=AVC msg=audit(01/07/2006 11:45:41.792:26) : avc: denied { write
} for pid=2871 comm=mkdir name=media dev=dm-0 ino=2289281
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:mnt_t:s0 tclass=dir
----
type=PATH msg=audit(01/07/2006 11:45:41.868:27) : item=0
name=/media/disk/.created-by-hal flags=parent,open,create
inode=2289299 dev=fd:00 mode=dir,755 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/07/2006 11:45:41.868:27) : cwd=/
type=SYSCALL msg=audit(01/07/2006 11:45:41.868:27) : arch=i386
syscall=open success=yes exit=0 a0=bff77909 a1=8941 a2=1b6 a3=8941
items=1 pid=2872 auid=unknown(4294967295) uid=root gid=root euid=root
suid=root fsuid=root egid=root sgid=root fsgid=root comm=touch
exe=/bin/touch
type=AVC msg=audit(01/07/2006 11:45:41.868:27) : avc: denied {
create } for pid=2872 comm=touch name=.created-by-hal
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:mnt_t:s0 tclass=file
----
type=PATH msg=audit(01/07/2006 11:45:41.868:28) : item=0
name=/proc/self/fd/0 flags=follow inode=2289300 dev=fd:00
mode=file,644 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/07/2006 11:45:41.868:28) : cwd=/
type=SYSCALL msg=audit(01/07/2006 11:45:41.868:28) : arch=i386
syscall=utimes success=yes exit=0 a0=bff772c0 a1=0 a2=8ecff4 a3=0
items=1 pid=2872 auid=unknown(4294967295) uid=root gid=root euid=root
suid=root fsuid=root egid=root sgid=root fsgid=root comm=touch
exe=/bin/touch
type=AVC msg=audit(01/07/2006 11:45:41.868:28) : avc: denied { write
} for pid=2872 comm=touch name=.created-by-hal dev=dm-0 ino=2289300
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:mnt_t:s0 tclass=file
----
type=PATH msg=audit(01/07/2006 11:45:42.136:29) : item=0
name=/media/disk flags=parent inode=2289281 dev=fd:00 mode=dir,755
ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/07/2006 11:45:42.136:29) : cwd=/
type=SYSCALL msg=audit(01/07/2006 11:45:42.136:29) : arch=i386
syscall=rmdir success=no exit=-39(Directory not empty) a0=bffe1919
a1=0 a2=804c80c a3=bffe1919 items=1 pid=2877 auid=unknown(4294967295)
uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root
fsgid=root comm=rmdir exe=/bin/rmdir
type=AVC msg=audit(01/07/2006 11:45:42.136:29) : avc: denied { rmdir
} for pid=2877 comm=rmdir name=disk dev=dm-0 ino=2289299
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:mnt_t:s0 tclass=dir
type=AVC msg=audit(01/07/2006 11:45:42.136:29) : avc: denied {
remove_name } for pid=2877 comm=rmdir name=disk dev=dm-0 ino=2289299
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:mnt_t:s0 tclass=dir
----
type=SYSCALL msg=audit(01/07/2006 11:45:46.992:30) : arch=i386
syscall=mprotect success=yes exit=0 a0=bfcd5000 a1=1000 a2=1000007
a3=fffff000 items=0 pid=2862 auid=unknown(4294967295) uid=tbl gid=tbl
euid=tbl suid=tbl fsuid=tbl egid=tbl sgid=tbl fsgid=tbl comm=gaim
exe=/usr/bin/gaim
type=AVC msg=audit(01/07/2006 11:45:46.992:30) : avc: granted {
execmem } for pid=2862 comm=gaim
scontext=user_u:system_r:unconfined_t:s0
tcontext=user_u:system_r:unconfined_t:s0 tclass=process
tom
--
Tom London
18 years, 3 months
hald avcs
by Steve G
Hi,
I just updated to current rawhide and I am now getting a lot of avcs from hald.
You can recreate this by running: aureport -a --failed
-Steve
AVC Report
==============================================
# date time comm subj syscall action obj event
==============================================
1. 01/06/2006 09:23:25 AM hald system_u:system_r:hald_t:s0 execve execute
system_u:object_r:usr_t:s0 denied 54
2. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat getattr
system_u:object_r:boot_t:s0 denied 55
3. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat search
system_u:object_r:var_log_t:s0 denied 56
4. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat search
system_u:object_r:sysctl_fs_t:s0 denied 57
5. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat getattr
system_u:object_r:boot_t:s0 denied 58
6. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat search
system_u:object_r:var_log_t:s0 denied 59
7. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat search
system_u:object_r:sysctl_fs_t:s0 denied 60
8. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat getattr
system_u:object_r:boot_t:s0 denied 61
9. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat search
system_u:object_r:var_log_t:s0 denied 62
10. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat search
system_u:object_r:sysctl_fs_t:s0 denied 63
11. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat getattr
system_u:object_r:boot_t:s0 denied 64
12. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat search
system_u:object_r:var_log_t:s0 denied 65
13. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat search
system_u:object_r:sysctl_fs_t:s0 denied 66
14. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat getattr
system_u:object_r:boot_t:s0 denied 67
15. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat search
system_u:object_r:var_log_t:s0 denied 68
16. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat search
system_u:object_r:sysctl_fs_t:s0 denied 69
17. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat getattr
system_u:object_r:boot_t:s0 denied 70
18. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat search
system_u:object_r:var_log_t:s0 denied 71
19. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat search
system_u:object_r:sysctl_fs_t:s0 denied 72
20. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat getattr
system_u:object_r:boot_t:s0 denied 73
21. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat search
system_u:object_r:var_log_t:s0 denied 74
22. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat search
system_u:object_r:sysctl_fs_t:s0 denied 75
__________________________________________
Yahoo! DSL Something to write home about.
Just $16.99/mo. or less.
dsl.yahoo.com
18 years, 3 months
libselinux bug or not
by William Xiong
when I use pam system to program, I invoke
pam_chauthtok function to change passwd, If I put this piece of code in
the main thread of a process, then everything is ok, but if i put the
code into a child thread, then it will return failed status.
when i trace the code, I found the pam system use selinux, the pam
system will invoke setfscreatecon() function. the implemention of
setfscreatecon() use below code to change fscreate stat:
fd = open("/proc/self/attr/fscreate", O_RDWR);
but, if the thread invode setfscreatecon() is a child thread in a
process, then, the /proc/self will point the main thread of the process,
not the child thread's own proc subdir. then the following code will fail.
can some find the same problem?
18 years, 3 months