AVC everytime I launch a tab in firefox from gnome-terminal
by Chuck Anderson
Every time I launch a tab from a URL in gnome-terminal, I get this
AVC:
Hmm why is this program set-uid root?
>ls -l /usr/lib/nspluginwrapper/plugin-config
-rwsr-xr-x 1 root root 60048 2008-03-11 10:02 /usr/lib/nspluginwrapper/plugin-config*
Summary:
SELinux is preventing plugin-config (nsplugin_config_t) "execstack" to <Unknown>
(nsplugin_config_t).
Detailed Description:
SELinux denied access requested by plugin-config. It is not expected that this
access is required by plugin-config and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:
c0.c1023
Target Context unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:
c0.c1023
Target Objects None [ process ]
Source plugin-config
Source Path /usr/lib/nspluginwrapper/plugin-config
Port <Unknown>
Host dustpuppy.wpi.edu
Source RPM Packages nspluginwrapper-0.9.91.5-26.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-31.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name dustpuppy.wpi.edu
Platform Linux dustpuppy.wpi.edu
2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
11:33:46 EDT 2008 i686 i686
Alert Count 14
First Seen Tue 08 Apr 2008 03:07:02 PM EDT
Last Seen Fri 11 Apr 2008 11:02:14 AM EDT
Local ID 3be91387-8d68-4700-868a-cc02880ae589
Line Numbers
Raw Audit Messages
host=dustpuppy.wpi.edu type=AVC msg=audit(1207926134.511:4168): avc: denied { execstack } for pid=30324 comm="plugin-config" scontext=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 tclass=process
host=dustpuppy.wpi.edu type=SYSCALL msg=audit(1207926134.511:4168): arch=40000003 syscall=125 success=no exit=-13 a0=bff95000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=30322 pid=30324 auid=10002 uid=10002 gid=10002 euid=0 suid=0 fsuid=0 egid=10002 sgid=10002 fsgid=10002 tty=(none) ses=1 comm="plugin-config" exe="/usr/lib/nspluginwrapper/plugin-config" subj=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 key=(null)
16 years
Rawhide MLS policy.22 and policy.23
by Joe Nall
I have an MLS policy.22 and policy.23 on current rawhide. The system
boots and runs policy.22. sedispol doesn't like policy.23. What
controls which policy is in use? Is 22 the correct policy to be
running today?
joe
16 years
Confining Firefox
by Christoph Höger
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
I've just read Daniels livejournal entry about confining firefox.
One thing that hit me, when I dug a little depper into SELinux last
semester, was that firefox can actually read ~/.ssh
I don't know _any_ reason why it should.
And I assume this is one kind of access, that SELinux should prevent.
Away from talking about explicit deny rules, I would suggest, that in
fedora 9 you (the active SELinux developers) deny it using something
like a "unconfined_for_all_applications_but_firefox_and_fellows_t" to
cut off those security relevant directories.
Otherwise the next *-plugin exploit could crack even hole enterprise
networks by reading admins ssh keys.
regards
christoph
ps: What is the current state of getting a real
"High-Level-Language(TM)" for SELinux configuration?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iD8DBQFH/UnNhMBO4cVSGS8RAgW2AKCnHBJnEc0MMRWEYh4WgInpLmVzugCfSjkQ
3KHcUVRPd2g9sux9ZBWlofE=
=TTfw
-----END PGP SIGNATURE-----
16 years
Re: gconf alert
by Valent Turkovic
On Sat, Apr 5, 2008 at 9:21 PM, Daniel J Walsh <dwalsh(a)redhat.com> wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Valent Turkovic wrote:
> > On Sat, Mar 29, 2008 at 6:55 PM, Daniel J Walsh <dwalsh(a)redhat.com> wrote:
> >> -----BEGIN PGP SIGNED MESSAGE-----
> >> Hash: SHA1
> >>
> >> Valent Turkovic wrote:
> >>
> >>> On Thu, Mar 27, 2008 at 6:36 PM, John Dennis <jdennis(a)redhat.com> wrote:
> >> >> Valent Turkovic wrote:
> >> >> > I'm creating live cds under rawhide and I have selinux in permissive
> >> >> > mode, could that be reason I'm seeing these hundreds of alerts?
> >> >>
> >> >> https://www.redhat.com/archives/fedora-selinux-list/2008-March/msg00130.html
> >> >>
> >> >> --
> >> >> John Dennis <jdennis(a)redhat.com>
> >> >>
> >> >
> >> > Ok, I'm an idiot :) I got so much going on at once (work, moving to
> >> > new apartment, etc...) that I totally forgot I got this replied
> >> > already.
> >> >
> >> > But I want to keep in permissive an not enforcing mode so is just
> >> > "load_policy" enough ?
> >> >
> >> > Cheers,
> >> > Valent.
> >> >
> >> load_policy and you might need to kill any processes that are running as
> >> unlabeled_t. Potentially you could have files that are mislabeled.
> >
> >
> >
> > I made several load_policy and relabels with reboot ans I still see
> > these errors!
> > Do you have any idea why?
> >
> > Cheers,
> > Valent
> > .
> >
> >
> Do you have two policy files in /etc/selinux/targeted/policy?
# ls -al /etc/selinux/targeted/policy
total 4056
drwxr-xr-x 2 root root 4096 2008-04-03 23:05 .
drwxr-xr-x 5 root root 4096 2008-04-03 23:05 ..
-rw-r--r-- 1 root root 4128435 2008-04-03 23:05 policy.21
as you can see I have only on file in policy directory
> If you do, remove the lower version and then execute load_policy,
> Relabel the file in question and you should not have a problem. If the
> file is in /tmp you can remove it or set its label to tmp_t.
I'm going now to move all files from /tmp to another folder and then
if reboot succeeds I'll delete those files and see if I still see
selinux alerts.
So you haven't seen this kind of error? Nobody has reported anything similar?
Valent.
--
http://kernelreloaded.blog385.com/
linux, blog, anime, spirituality, windsurf, wireless
registered as user #367004 with the Linux Counter, http://counter.li.org.
ICQ: 2125241, Skype: valent.turkovic
16 years
setsebool ok & smb denied
by Laurent Jacquot
Hello,
on my F8 up2date, SMB is denied read access to user_iceauth_home_t
context even if I have:
[root@jack ~]# getsebool -a |grep samba
samba_domain_controller --> off
samba_enable_home_dirs --> on
samba_export_all_ro --> off
samba_export_all_rw --> off
samba_run_unconfined --> on
samba_share_nfs --> off
use_samba_home_dirs --> on
Should I bugzilla it? and also dontaudit, allow or deny?
Résumé:
SELinux is preventing the samba daemon from reading users' home
directories.
Description détaillée:
SELinux has denied the samba daemon access to users' home directories.
Someone
is attempting to access your home directories via your samba daemon. If
you only
setup samba to share non-home directories, this probably signals a
intrusion
attempt. For more information on SELinux integration with samba, look at
the
samba_selinux man page. (man samba_selinux)
Autoriser l'accès:
Si vous souhaitez que samba partage des répertoires personnels vous
devez
activer le booléen samba_enable_home_dirs : "setsebool -P
samba_enable_home_dirs=1"
La commande suivante autorisera cet accès :
setsebool -P samba_enable_home_dirs=1
Informations complémentaires:
Contexte source system_u:system_r:smbd_t:s0
Contexte cible system_u:object_r:user_iceauth_home_t:s0
Objets du contexte /home/alex/.ICEauthority [ file ]
Source smbd
Source Path /usr/sbin/smbd
Port <Inconnu>
Host jack.lutty.net
Source RPM Packages samba-3.0.28a-0.fc8
Target RPM Packages
Politique RPM selinux-policy-3.0.8-95.fc8
Selinux activé True
Type de politique targeted
MLS activé True
Mode strict Enforcing
Nom du plugin samba_enable_home_dirs
Nom de l'hôte jack.lutty.net
Plateforme Linux jack.lutty.net 2.6.24.4-64.fc8 #1
SMP Sat
Mar 29 09:54:46 EDT 2008 i686 i686
Compteur d'alertes 28
First Seen ven 04 avr 2008 23:16:29 CEST
Last Seen mer 09 avr 2008 16:34:17 CEST
Local ID d2ee22f9-866b-4305-94c8-a029aee20c19
Numéros des lignes
Messages d'audit bruts
host=jack.lutty.net type=AVC msg=audit(1207751657.63:1353): avc: denied
{ getattr } for pid=32716 comm="smbd" path="/home/alex/.ICEauthority"
dev=dm-11 ino=850503 scontext=system_u:system_r:smbd_t:s0
tcontext=system_u:object_r:user_iceauth_home_t:s0 tclass=file
host=jack.lutty.net type=SYSCALL msg=audit(1207751657.63:1353):
arch=40000003 syscall=195 success=no exit=-13 a0=bfc33194 a1=bfc32914
a2=4c5ff4 a3=bfc32914 items=0 ppid=3346 pid=32716 auid=4294967295
uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=500 sgid=0 fsgid=500
tty=(none) comm="smbd" exe="/usr/sbin/smbd"
subj=system_u:system_r:smbd_t:s0 key=(null)
jk
16 years
loadkey avc denied
by Laurent Jacquot
Hello,
Every time I reboot, I have those 9 AVCs in /var/log/messages:
Apr 3 19:18:35 jack kernel: audit(1207243095.907:4): avc: denied
{ sys_admin } for pid=1707 comm="loadkeys" capability=21
scontext=system_u:system_r:loadkeys_t:s0
tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability
Apr 3 19:18:35 jack kernel: audit(1207243095.907:5): avc: denied
{ sys_admin } for pid=1707 comm="loadkeys" capability=21
scontext=system_u:system_r:loadkeys_t:s0
tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability
Apr 3 19:18:35 jack kernel: audit(1207243095.907:6): avc: denied
{ sys_admin } for pid=1707 comm="loadkeys" capability=21
scontext=system_u:system_r:loadkeys_t:s0
tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability
Apr 3 19:18:35 jack kernel: audit(1207243095.907:7): avc: denied
{ sys_admin } for pid=1707 comm="loadkeys" capability=21
scontext=system_u:system_r:loadkeys_t:s0
tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability
Apr 3 19:18:35 jack kernel: audit(1207243095.907:8): avc: denied
{ sys_admin } for pid=1707 comm="loadkeys" capability=21
scontext=system_u:system_r:loadkeys_t:s0
tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability
Apr 3 19:18:35 jack kernel: audit(1207243095.907:9): avc: denied
{ sys_admin } for pid=1707 comm="loadkeys" capability=21
scontext=system_u:system_r:loadkeys_t:s0
tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability
Apr 3 19:18:35 jack kernel: audit(1207243095.907:10): avc: denied
{ sys_admin } for pid=1707 comm="loadkeys" capability=21
scontext=system_u:system_r:loadkeys_t:s0
tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability
Apr 3 19:18:35 jack kernel: audit(1207243095.907:11): avc: denied
{ sys_admin } for pid=1707 comm="loadkeys" capability=21
scontext=system_u:system_r:loadkeys_t:s0
tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability
Apr 3 19:18:35 jack kernel: audit(1207243095.907:12): avc: denied
{ sys_admin } for pid=1707 comm="loadkeys" capability=21
scontext=system_u:system_r:loadkeys_t:s0
tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability
They are generated before audit runs.
What are they trying to tell me? Should I relabel something or bug it?
TIA
Laurent
16 years
Fedora 8: NetworkManager, OpenVPN and SELinux
by Pedro Lamarão
Hello all.
I'm experimenting with a VPN connection set up through the
NetworkManager panel applet.
I have all certificate and key files stored in my home directory.
Trying to start this VPN connection triggers an AVC DENIED.
host=localhost.localdomain type=AVC msg=audit(1207523029.36:66): avc:
denied { read } for pid=6400 comm="openvpn" name="pedro.crt" dev=dm-2
ino=2408465 scontext=system_u:system_r:openvpn_t:s0
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
host=localhost.localdomain type=SYSCALL msg=audit(1207523029.36:66):
arch=40000003 syscall=5 success=no exit=-13 a0=bfa7ef0b a1=8000 a2=1b6
a3=8d23660 items=0 ppid=6396 pid=6400 auid=500 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="openvpn"
exe="/usr/sbin/openvpn" subj=system_u:system_r:openvpn_t:s0 key=(null)
It seems to me that this denial makes complete sense, since OpenVPN
should not be reading users' files.
On the other hand, this NetworkManager configuration functionality
should allow users to use their own files -- that is, it seems users are
not required to be root and place files in /etc/openvpn.
Also, most users won't be knowledgeable enough to know how to change
file label -- and this would be error prone, if there was ever a full
relabel in the filesystem.
I'll be using all files in /etc/openvpn while this is not sorted out to
exercise NetworkManager.
--
P.
16 years
flood of selinux avcs, settroubleshoot all over the place(sorry for all the avcs)
by Antonio Olivares
Dear all,
Here are all the selinux errors that I have encountered.
I apologize for putting in all at the same time, but I am just overwhelmed at the amount. I guess setroubleshoot daemon got happy and started sending all the avcs encountered.
Thank you for advice given in advance.
Regards,
Antonio
Summary:
SELinux is preventing gvfsd-trash (staff_t) "dac_override" to <Unknown>
(staff_t).
Detailed Description:
SELinux denied access requested by gvfsd-trash. It is not expected that this
access is required by gvfsd-trash and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context root:staff_r:staff_t:SystemLow-SystemHigh
Target Context root:staff_r:staff_t:SystemLow-SystemHigh
Target Objects None [ capability ]
Source pulseaudio
Source Path /usr/bin/pulseaudio
Port <Unknown>
Host localhost.localdomain
Source RPM Packages gvfs-0.2.3-1.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-29.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
11:33:46 EDT 2008 i686 i686
Alert Count 39
First Seen Wed 09 Apr 2008 07:03:20 PM CDT
Last Seen Wed 09 Apr 2008 07:03:45 PM CDT
Local ID d2fbeab2-c5e1-4968-a58a-3897ade13c01
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207785825.117:127): avc: denied { dac_override } for pid=5405 comm="gvfsd-trash" capability=1 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability
host=localhost.localdomain type=AVC msg=audit(1207785825.117:127): avc: denied { dac_read_search } for pid=5405 comm="gvfsd-trash" capability=2 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability
host=localhost.localdomain type=SYSCALL msg=audit(1207785825.117:127): arch=40000003 syscall=196 success=no exit=-13 a0=86652e8 a1=b741b1e0 a2=d14ff4 a3=0 items=0 ppid=5404 pid=5405 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="gvfsd-trash" exe="/usr/libexec/gvfsd-trash" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
Summary:
SELinux is preventing escd (staff_t) "read write" to
./636F6F6C6B6579706B313173452D47617465203020302D30 (auth_cache_t).
Detailed Description:
SELinux denied access requested by escd. It is not expected that this access is
required by escd and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for
./636F6F6C6B6579706B313173452D47617465203020302D30,
restorecon -v './636F6F6C6B6579706B313173452D47617465203020302D30'
If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context root:staff_r:staff_t:SystemLow-SystemHigh
Target Context system_u:object_r:auth_cache_t
Target Objects ./636F6F6C6B6579706B313173452D47617465203020302D30
[ file ]
Source escd
Source Path /usr/lib/esc-1.0.1/escd
Port <Unknown>
Host localhost.localdomain
Source RPM Packages esc-1.0.1-9.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-29.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
11:33:46 EDT 2008 i686 i686
Alert Count 1
First Seen Wed 09 Apr 2008 07:03:22 PM CDT
Last Seen Wed 09 Apr 2008 07:03:22 PM CDT
Local ID 6cd2e4ee-4e7e-4112-adcc-b3705916d481
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207785802.447:91): avc: denied { read write } for pid=5282 comm="escd" name=636F6F6C6B6579706B313173452D47617465203020302D30 dev=dm-0 ino=2485540 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:auth_cache_t:s0 tclass=file
host=localhost.localdomain type=SYSCALL msg=audit(1207785802.447:91): arch=40000003 syscall=5 success=no exit=-13 a0=8a45540 a1=20002 a2=180 a3=0 items=0 ppid=1 pid=5282 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="escd" exe="/usr/lib/esc-1.0.1/escd" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
Summary:
SELinux is preventing pulseaudio (staff_t) "ipc_lock" to <Unknown> (staff_t).
Detailed Description:
SELinux denied access requested by pulseaudio. It is not expected that this
access is required by pulseaudio and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context root:staff_r:staff_t:SystemLow-SystemHigh
Target Context root:staff_r:staff_t:SystemLow-SystemHigh
Target Objects None [ capability ]
Source gnome-keyring-d
Source Path /usr/bin/gnome-keyring-daemon
Port <Unknown>
Host localhost.localdomain
Source RPM Packages pulseaudio-0.9.10-1.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-29.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
11:33:46 EDT 2008 i686 i686
Alert Count 15
First Seen Wed 09 Apr 2008 07:03:06 PM CDT
Last Seen Wed 09 Apr 2008 07:03:21 PM CDT
Local ID 638ce06f-cd52-41b7-8f87-c3296b7b9c4e
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207785801.262:89): avc: denied { ipc_lock } for pid=5217 comm="pulseaudio" capability=14 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability
host=localhost.localdomain type=SYSCALL msg=audit(1207785801.262:89): arch=40000003 syscall=150 success=yes exit=0 a0=b6804000 a1=3c84 a2=195cb4 a3=3c84 items=0 ppid=5214 pid=5217 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
Summary:
SELinux is preventing gvfs-fuse-daemo (staff_t) "sys_admin" to <Unknown>
(staff_t).
Detailed Description:
SELinux denied access requested by gvfs-fuse-daemo. It is not expected that this
access is required by gvfs-fuse-daemo and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context root:staff_r:staff_t:SystemLow-SystemHigh
Target Context root:staff_r:staff_t:SystemLow-SystemHigh
Target Objects None [ capability ]
Source gvfs-fuse-daemo
Source Path /usr/libexec/gvfs-fuse-daemon
Port <Unknown>
Host localhost.localdomain
Source RPM Packages gvfs-fuse-0.2.3-1.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-29.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
11:33:46 EDT 2008 i686 i686
Alert Count 1
First Seen Wed 09 Apr 2008 07:03:21 PM CDT
Last Seen Wed 09 Apr 2008 07:03:21 PM CDT
Local ID f714cec5-eca8-4de6-a60b-d07f6e690250
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207785801.751:90): avc: denied { sys_admin } for pid=5256 comm="gvfs-fuse-daemo" capability=21 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability
host=localhost.localdomain type=SYSCALL msg=audit(1207785801.751:90): arch=40000003 syscall=21 success=no exit=-1 a0=90654d0 a1=9064940 a2=9065510 a3=6 items=0 ppid=1 pid=5256 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="gvfs-fuse-daemo" exe="/usr/libexec/gvfs-fuse-daemon" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
Summary:
SELinux is preventing firefox (staff_t) "setuid" to <Unknown> (staff_t).
Detailed Description:
SELinux denied access requested by firefox. It is not expected that this access
is required by firefox and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context root:staff_r:staff_t:SystemLow-SystemHigh
Target Context root:staff_r:staff_t:SystemLow-SystemHigh
Target Objects None [ capability ]
Source firefox
Source Path /usr/lib/firefox-3.0b5/firefox
Port <Unknown>
Host localhost.localdomain
Source RPM Packages firefox-3.0-0.53.beta5.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-29.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
11:33:46 EDT 2008 i686 i686
Alert Count 14
First Seen Wed 09 Apr 2008 07:04:12 PM CDT
Last Seen Wed 09 Apr 2008 07:04:12 PM CDT
Local ID 728a632a-191d-449d-b1a1-aa9cff7a16f1
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207785852.141:144): avc: denied { setuid } for pid=5422 comm="firefox" capability=7 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability
host=localhost.localdomain type=SYSCALL msg=audit(1207785852.141:144): arch=40000003 syscall=208 success=yes exit=0 a0=ffffffff a1=0 a2=ffffffff a3=bfee4c1c items=0 ppid=5408 pid=5422 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="firefox" exe="/usr/lib/firefox-3.0b5/firefox" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
Summary:
SELinux is preventing firefox (staff_t) "write" to ./firefox-3.0b5 (lib_t).
Detailed Description:
SELinux denied access requested by firefox. It is not expected that this access
is required by firefox and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./firefox-3.0b5,
restorecon -v './firefox-3.0b5'
If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context root:staff_r:staff_t:SystemLow-SystemHigh
Target Context system_u:object_r:lib_t
Target Objects ./firefox-3.0b5 [ dir ]
Source firefox
Source Path /usr/lib/firefox-3.0b5/firefox
Port <Unknown>
Host localhost.localdomain
Source RPM Packages firefox-3.0-0.53.beta5.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-29.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
11:33:46 EDT 2008 i686 i686
Alert Count 1
First Seen Wed 09 Apr 2008 07:03:48 PM CDT
Last Seen Wed 09 Apr 2008 07:03:52 PM CDT
Local ID ba8ecec3-9fce-4945-92ed-d9640d5a0ea7
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207785832.379:129): avc: denied { write } for pid=5422 comm="firefox" name="firefox-3.0b5" dev=dm-0 ino=4287001 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=dir
host=localhost.localdomain type=SYSCALL msg=audit(1207785832.379:129): arch=40000003 syscall=5 success=no exit=-13 a0=85ec4f0 a1=82c1 a2=1a4 a3=82c1 items=0 ppid=5408 pid=5422 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="firefox" exe="/usr/lib/firefox-3.0b5/firefox" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
Summary:
SELinux is preventing pulseaudio (staff_t) "sys_resource" to <Unknown>
(staff_t).
Detailed Description:
SELinux denied access requested by pulseaudio. It is not expected that this
access is required by pulseaudio and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context root:staff_r:staff_t:SystemLow-SystemHigh
Target Context root:staff_r:staff_t:SystemLow-SystemHigh
Target Objects None [ capability ]
Source pulseaudio
Source Path /usr/bin/pulseaudio
Port <Unknown>
Host localhost.localdomain
Source RPM Packages pulseaudio-0.9.10-1.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-29.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
11:33:46 EDT 2008 i686 i686
Alert Count 2
First Seen Wed 09 Apr 2008 07:03:20 PM CDT
Last Seen Wed 09 Apr 2008 07:03:20 PM CDT
Local ID 40e0b7ff-cb5f-42de-8f1d-8302ea0c173f
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207785800.594:72): avc: denied { sys_resource } for pid=5217 comm="pulseaudio" capability=24 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability
host=localhost.localdomain type=SYSCALL msg=audit(1207785800.594:72): arch=40000003 syscall=75 success=no exit=-1 a0=e a1=bfa8cd1c a2=d14ff4 a3=e items=0 ppid=5214 pid=5217 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
Summary:
SELinux is preventing bash (staff_t) "write" to ./ccache (var_t).
Detailed Description:
SELinux denied access requested by bash. It is not expected that this access is
required by bash and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./ccache,
restorecon -v './ccache'
If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context root:staff_r:staff_t:SystemLow-SystemHigh
Target Context system_u:object_r:var_t
Target Objects ./ccache [ dir ]
Source bash
Source Path /bin/bash
Port <Unknown>
Host localhost.localdomain
Source RPM Packages bash-3.2-22.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-29.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
11:33:46 EDT 2008 i686 i686
Alert Count 1
First Seen Wed 09 Apr 2008 07:03:18 PM CDT
Last Seen Wed 09 Apr 2008 07:03:18 PM CDT
Local ID 8b8507ac-7e45-4ce0-b52f-b25b6c69c03f
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207785798.523:69): avc: denied { write } for pid=5092 comm="bash" name="ccache" dev=dm-0 ino=2485510 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_t:s0 tclass=dir
host=localhost.localdomain type=SYSCALL msg=audit(1207785798.523:69): arch=40000003 syscall=33 success=no exit=-13 a0=9eaad78 a1=2 a2=d14ff4 a3=0 items=0 ppid=4990 pid=5092 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="bash" exe="/bin/bash" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
Summary:
SELinux is preventing gnome-session (staff_t) "write" to ./fontconfig (fonts_t).
Detailed Description:
SELinux denied access requested by gnome-session. It is not expected that this
access is required by gnome-session and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./fontconfig,
restorecon -v './fontconfig'
If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context root:staff_r:staff_t:SystemLow-SystemHigh
Target Context system_u:object_r:fonts_t
Target Objects ./fontconfig [ dir ]
Source gnome-session
Source Path /usr/bin/gnome-session
Port <Unknown>
Host localhost.localdomain
Source RPM Packages gnome-session-2.22.1-1.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-29.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
11:33:46 EDT 2008 i686 i686
Alert Count 1
First Seen Wed 09 Apr 2008 07:03:18 PM CDT
Last Seen Wed 09 Apr 2008 07:03:18 PM CDT
Local ID fddf24c2-0902-4a50-8909-4bd30c0839b6
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207785798.732:70): avc: denied { write } for pid=5092 comm="gnome-session" name="fontconfig" dev=dm-0 ino=2387443 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fonts_t:s0 tclass=dir
host=localhost.localdomain type=SYSCALL msg=audit(1207785798.732:70): arch=40000003 syscall=33 success=no exit=-13 a0=8536358 a1=2 a2=a85694 a3=852daa8 items=0 ppid=4990 pid=5092 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="gnome-session" exe="/usr/bin/gnome-session" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
Summary:
SELinux is preventing escd (user_t) "write" to ./coolkey (auth_cache_t).
Detailed Description:
SELinux denied access requested by escd. It is not expected that this access is
required by escd and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./coolkey,
restorecon -v './coolkey'
If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context user_u:user_r:user_t
Target Context system_u:object_r:auth_cache_t
Target Objects ./coolkey [ dir ]
Source escd
Source Path /usr/lib/esc-1.0.1/escd
Port <Unknown>
Host localhost.localdomain
Source RPM Packages esc-1.0.1-9.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-29.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
11:33:46 EDT 2008 i686 i686
Alert Count 4
First Seen Wed 09 Apr 2008 06:34:01 PM CDT
Last Seen Wed 09 Apr 2008 07:02:51 PM CDT
Local ID 08e479ee-11d3-4d0c-892c-e8ce4f8beb7b
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207785771.193:60): avc: denied { write } for pid=4321 comm="escd" name="coolkey" dev=dm-0 ino=2485506 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:auth_cache_t:s0 tclass=dir
host=localhost.localdomain type=SYSCALL msg=audit(1207785771.193:60): arch=40000003 syscall=5 success=no exit=-13 a0=88b4ba0 a1=4c2 a2=180 a3=88b3508 items=0 ppid=1 pid=4321 auid=502 uid=502 gid=502 euid=502 suid=502 fsuid=502 egid=502 sgid=502 fsgid=502 tty=(none) ses=3 comm="escd" exe="/usr/lib/esc-1.0.1/escd" subj=user_u:user_r:user_t:s0 key=(null)
Summary:
SELinux is preventing userhelper (user_t) "read write" to ./eject
(userhelper_conf_t).
Detailed Description:
SELinux denied access requested by userhelper. It is not expected that this
access is required by userhelper and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./eject,
restorecon -v './eject'
If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context user_u:user_r:user_t
Target Context system_u:object_r:userhelper_conf_t
Target Objects ./eject [ file ]
Source userhelper
Source Path /usr/sbin/userhelper
Port <Unknown>
Host localhost.localdomain
Source RPM Packages usermode-1.96-1
Target RPM Packages
Policy RPM selinux-policy-3.3.1-29.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
11:33:46 EDT 2008 i686 i686
Alert Count 3
First Seen Wed 09 Apr 2008 06:34:03 PM CDT
Last Seen Wed 09 Apr 2008 06:54:10 PM CDT
Local ID 971298b0-6bc0-4ee0-a08e-efb07076dd3d
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207785250.626:49): avc: denied { read write } for pid=4559 comm="userhelper" name="eject" dev=dm-0 ino=4055485 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:userhelper_conf_t:s0 tclass=file
host=localhost.localdomain type=SYSCALL msg=audit(1207785250.626:49): arch=40000003 syscall=5 success=no exit=-13 a0=82e3508 a1=2 a2=b809cee0 a3=82e3530 items=0 ppid=4558 pid=4559 auid=502 uid=502 gid=502 euid=0 suid=0 fsuid=0 egid=502 sgid=502 fsgid=502 tty=(none) ses=3 comm="userhelper" exe="/usr/sbin/userhelper" subj=user_u:user_r:user_t:s0 key=(null)
Summary:
SELinux is preventing userhelper (user_t) "read" to ./eject (userhelper_conf_t).
Detailed Description:
SELinux denied access requested by userhelper. It is not expected that this
access is required by userhelper and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./eject,
restorecon -v './eject'
If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context user_u:user_r:user_t
Target Context system_u:object_r:userhelper_conf_t
Target Objects ./eject [ file ]
Source userhelper
Source Path /usr/sbin/userhelper
Port <Unknown>
Host localhost.localdomain
Source RPM Packages usermode-1.96-1
Target RPM Packages
Policy RPM selinux-policy-3.3.1-29.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
11:33:46 EDT 2008 i686 i686
Alert Count 3
First Seen Wed 09 Apr 2008 06:34:03 PM CDT
Last Seen Wed 09 Apr 2008 06:54:10 PM CDT
Local ID fe10c9ad-5af2-4402-b68e-8d6951329af6
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207785250.628:50): avc: denied { read } for pid=4559 comm="userhelper" name="eject" dev=dm-0 ino=4055485 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:userhelper_conf_t:s0 tclass=file
host=localhost.localdomain type=SYSCALL msg=audit(1207785250.628:50): arch=40000003 syscall=5 success=no exit=-13 a0=82e3508 a1=0 a2=b809cee0 a3=82e3530 items=0 ppid=4558 pid=4559 auid=502 uid=502 gid=502 euid=0 suid=0 fsuid=0 egid=502 sgid=502 fsgid=502 tty=(none) ses=3 comm="userhelper" exe="/usr/sbin/userhelper" subj=user_u:user_r:user_t:s0 key=(null)
Summary:
SELinux is preventing escd (user_t) "read write" to
./636F6F6C6B6579706B313173452D47617465203020302D353031 (auth_cache_t).
Detailed Description:
SELinux denied access requested by escd. It is not expected that this access is
required by escd and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for
./636F6F6C6B6579706B313173452D47617465203020302D353031,
restorecon -v './636F6F6C6B6579706B313173452D47617465203020302D353031'
If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context user_u:user_r:user_t
Target Context system_u:object_r:auth_cache_t
Target Objects ./636F6F6C6B6579706B313173452D47617465203020302D35
3031 [ file ]
Source escd
Source Path /usr/lib/esc-1.0.1/escd
Port <Unknown>
Host localhost.localdomain
Source RPM Packages esc-1.0.1-9.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-29.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
11:33:46 EDT 2008 i686 i686
Alert Count 2
First Seen Wed 09 Apr 2008 06:49:21 PM CDT
Last Seen Wed 09 Apr 2008 06:51:48 PM CDT
Local ID 655d0a34-ec8a-4327-ae0c-a21175fccec7
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207785108.494:39): avc: denied { read write } for pid=3737 comm="escd" name=636F6F6C6B6579706B313173452D47617465203020302D353031 dev=dm-0 ino=2485541 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:auth_cache_t:s0 tclass=file
host=localhost.localdomain type=SYSCALL msg=audit(1207785108.494:39): arch=40000003 syscall=5 success=no exit=-13 a0=880aba0 a1=20002 a2=180 a3=0 items=0 ppid=1 pid=3737 auid=501 uid=501 gid=501 euid=501 suid=501 fsuid=501 egid=501 sgid=501 fsgid=501 tty=(none) ses=2 comm="escd" exe="/usr/lib/esc-1.0.1/escd" subj=user_u:user_r:user_t:s0 key=(null)
Summary:
SELinux is preventing wine-preloader (user_t) "mmap_zero" to <Unknown> (user_t).
Detailed Description:
SELinux denied access requested by wine-preloader. It is not expected that this
access is required by wine-preloader and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context user_u:user_r:user_t
Target Context user_u:user_r:user_t
Target Objects None [ memprotect ]
Source wine-preloader
Source Path /usr/bin/wine-preloader
Port <Unknown>
Host localhost.localdomain
Source RPM Packages wine-core-0.9.58-1.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-29.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
11:33:46 EDT 2008 i686 i686
Alert Count 1
First Seen Wed 09 Apr 2008 06:50:02 PM CDT
Last Seen Wed 09 Apr 2008 06:50:02 PM CDT
Local ID 6f6e94e5-fbf2-43ea-b941-dba1d1da982b
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207785002.401:35): avc: denied { mmap_zero } for pid=3847 comm="wine-preloader" scontext=user_u:user_r:user_t:s0 tcontext=user_u:user_r:user_t:s0 tclass=memprotect
host=localhost.localdomain type=SYSCALL msg=audit(1207785002.401:35): arch=40000003 syscall=90 success=no exit=-13 a0=bfed76dc a1=bfed76dc a2=60000000 a3=bfed76dc items=0 ppid=1 pid=3847 auid=501 uid=501 gid=501 euid=501 suid=501 fsuid=501 egid=501 sgid=501 fsgid=501 tty=(none) ses=2 comm="wine-preloader" exe="/usr/bin/wine-preloader" subj=user_u:user_r:user_t:s0 key=(null)
Summary:
SELinux prevented X from using the terminal tty0.
Detailed Description:
SELinux prevented X from using the terminal tty0. In most cases daemons do not
need to interact with the terminal, usually these avc messages can be ignored.
All of the confined daemons should have dontaudit rules around using the
terminal. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this selinux-policy.
If you would like to allow all daemons to interact with the terminal, you can
turn on the allow_daemons_use_tty boolean.
Allowing Access:
Changing the "allow_daemons_use_tty" boolean to true will allow this access:
"setsebool -P allow_daemons_use_tty=1."
Fix Command:
setsebool -P allow_daemons_use_tty=1
Additional Information:
Source Context user_u:user_r:user_t
Target Context system_u:object_r:tty_device_t
Target Objects tty0 [ chr_file ]
Source X
Source Path /usr/bin/Xorg
Port <Unknown>
Host localhost.localdomain
Source RPM Packages xorg-x11-server-Xorg-1.4.99.901-17.20080401.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-28.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name allow_daemons_use_tty
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.201.rc8.git4.fc9.i686 #1 SMP Sun Apr 6
21:55:27 EDT 2008 i686 i686
Alert Count 8
First Seen Fri 04 Apr 2008 06:52:01 PM CDT
Last Seen Mon 07 Apr 2008 08:13:50 PM CDT
Local ID 4c3eddb6-6a5d-420f-a3de-1649183f872c
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207617230.297:90): avc: denied { setattr } for pid=5319 comm="X" name="tty0" dev=tmpfs ino=255 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:tty_device_t:s0 tclass=chr_file
host=localhost.localdomain type=SYSCALL msg=audit(1207617230.297:90): arch=40000003 syscall=212 success=no exit=-13 a0=81bc13b a1=0 a2=0 a3=bfbd70b4 items=0 ppid=5318 pid=5319 auid=502 uid=502 gid=502 euid=0 suid=0 fsuid=0 egid=502 sgid=502 fsgid=502 tty=tty1 ses=8 comm="X" exe="/usr/bin/Xorg" subj=user_u:user_r:user_t:s0 key=(null)
Summary:
SELinux is preventing gdb (xdm_t) "write" to ./rpm (rpm_var_lib_t).
Detailed Description:
SELinux denied access requested by gdb. It is not expected that this access is
required by gdb and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./rpm,
restorecon -v './rpm'
If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context system_u:system_r:xdm_t:SystemLow-SystemHigh
Target Context system_u:object_r:rpm_var_lib_t
Target Objects ./rpm [ dir ]
Source gdb
Source Path /usr/bin/gdb
Port <Unknown>
Host localhost.localdomain
Source RPM Packages gdb-6.8-1.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-26.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.195.rc8.git1.fc9.i686 #1 SMP Thu Apr 3
09:42:34 EDT 2008 i686 i686
Alert Count 196
First Seen Fri 04 Apr 2008 06:48:42 PM CDT
Last Seen Fri 04 Apr 2008 07:56:14 PM CDT
Local ID bf5f7ea8-f1a0-46bb-ade6-45dc659e7c1f
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207356974.98:206): avc: denied { write } for pid=2534 comm="gdb" name="rpm" dev=dm-0 ino=2387395 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
host=localhost.localdomain type=SYSCALL msg=audit(1207356974.98:206): arch=40000003 syscall=33 success=no exit=-13 a0=a3ddfb8 a1=2 a2=3547a4 a3=a3dde80 items=0 ppid=2533 pid=2534 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
Summary:
SELinux is preventing gdb (xdm_t) "getattr" to /var/lib/rpm/Packages
(rpm_var_lib_t).
Detailed Description:
SELinux denied access requested by gdb. It is not expected that this access is
required by gdb and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for /var/lib/rpm/Packages,
restorecon -v '/var/lib/rpm/Packages'
If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context system_u:system_r:xdm_t:SystemLow-SystemHigh
Target Context system_u:object_r:rpm_var_lib_t
Target Objects /var/lib/rpm/Packages [ file ]
Source gdb
Source Path /usr/bin/gdb
Port <Unknown>
Host localhost.localdomain
Source RPM Packages gdb-6.8-1.fc9
Target RPM Packages rpm-4.4.2.3-1.fc9
Policy RPM selinux-policy-3.3.1-26.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.25-0.195.rc8.git1.fc9.i686 #1 SMP Thu Apr 3
09:42:34 EDT 2008 i686 i686
Alert Count 196
First Seen Fri 04 Apr 2008 06:48:42 PM CDT
Last Seen Fri 04 Apr 2008 07:56:14 PM CDT
Local ID adc70120-316b-494e-a25a-1a9f014c0282
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1207356974.99:207): avc: denied { getattr } for pid=2534 comm="gdb" path="/var/lib/rpm/Packages" dev=dm-0 ino=2387402 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
host=localhost.localdomain type=SYSCALL msg=audit(1207356974.99:207): arch=40000003 syscall=195 success=no exit=-13 a0=a3ddf98 a1=bf9e3e9c a2=d14ff4 a3=64 items=0 ppid=2533 pid=2534 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
16 years
can't print to cups-pdf
by Chuck Anderson
Trying to print to Cups-PDF from firefox generates this AVC:
Summary:
SELinux is preventing cups-pdf (cups_pdf_t) "write" to ./cups (cupsd_log_t).
Detailed Description:
SELinux denied access requested by cups-pdf. It is not expected that this access
is required by cups-pdf and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./cups,
restorecon -v './cups'
If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context system_u:system_r:cups_pdf_t:s0-s0:c0.c1023
Target Context system_u:object_r:cupsd_log_t:s0
Target Objects ./cups [ dir ]
Source cups-pdf
Source Path /usr/lib/cups/backend/cups-pdf
Port <Unknown>
Host foo
Source RPM Packages cups-pdf-2.4.7-1.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-29.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name foo
Platform Linux foo
2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
11:33:46 EDT 2008 i686 i686
Alert Count 1
First Seen Tue 08 Apr 2008 12:24:18 PM EDT
Last Seen Tue 08 Apr 2008 12:24:18 PM EDT
Local ID 4eded59e-c154-4e5b-b62c-d9dbf0a482cd
Line Numbers
Raw Audit Messages
host=foo type=AVC msg=audit(1207671858.666:72): avc: denied { write } for pid=6315 comm="cups-pdf" name="cups" dev=dm-1 ino=565527 scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cupsd_log_t:s0 tclass=dir
host=foo type=SYSCALL msg=audit(1207671858.666:72): arch=40000003 syscall=5 success=no exit=-13 a0=bfb9f674 a1=441 a2=1b6 a3=440 items=0 ppid=2232 pid=6315 auid=4294967295 uid=0 gid=7 euid=0 suid=0 fsuid=0 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm="cups-pdf" exe="/usr/lib/cups/backend/cups-pdf" subj=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 key=(null)
16 years
php with oci8
by Pad Hosmane
Hi,
I am compiling php 5.2.5 with OCI8 on centOS 5. I have installed the
following from oracle
oracle-instantclient-basic-10.2.0.3-1
oracle-instantclient-sqlplus-10.2.0.3-1
oracle-instantclient-devel-10.2.0.3-1
These were the compile used while configure php
'./configure' '--prefix=/usr/local/php-5.2.5' '--cache-file=../config.cache'
'--with-libdir=lib' '--with-config-file-path=/usr/local/php-5.2.5/etc'
'--with-config-file-scan-dir=/usr/local/php-5.2.5/etc/php.d'
'--disable-debug' '--with-pic' '--disable-rpath' '--with-pear' '--with-bz2'
'--with-curl' '--with-exec-dir=/usr/bin' '--with-freetype-dir=/usr'
'--with-png-dir=/usr' '--enable-gd-native-ttf' '--with-gettext' '--with-gmp'
'--with-iconv' '--with-jpeg-dir=/usr' '--with-openssl' '--with-pspell'
'--with-pcre-regex' '--with-zlib' '--with-layout=GNU' '--enable-exif'
'--enable-ftp' '--enable-magic-quotes' '--enable-sockets' '--enable-sysvsem'
'--enable-sysvshm' '--enable-sysvmsg' '--enable-wddx' '--with-kerberos'
'--enable-ucd-snmp-hack' '--with-snmp=shared,/usr'
'--with-unixODBC=shared,/usr' '--enable-shmop' '--enable-calendar'
'--with-mime-magic=/etc/httpd/conf/magic' '--without-sqlite'
'--with-libxml-dir=/usr' '--enable-dom=shared' '--with-pgsql=shared'
'--disable-dba' '--disable-xmlreader' '--disable-xmlwriter' '--without-gdbm'
'--with-gd=shared' '--with-imap=shared' '--with-imap-ssl'
'--with-mysql=shared,/usr' '--with-mysqli=shared,/usr/bin/mysql_config'
'--enable-mbstring=shared' '--enable-mbregex' '--with-libmbfl'
'--with-pdo-mysql=shared,/usr/bin/mysql_config' '--enable-pdo=shared'
'--with-pdo-odbc=shared,unixODBC,/usr' '--with-xmlrpc=shared'
'--with-ncurses=shared' '--with-ldap=shared' '--with-pdo-pgsql=shared,/usr'
'--without-pdo-sqlite' '--with-db4=/usr' '--enable-force-cgi-redirect'
'--enable-pcntl' '--with-xsl=shared,/usr' '--enable-xmlreader=shared'
'--enable-xmlwriter=shared' '--enable-fastcgi' '--enable-cgi'
'--with-apxs2=/usr/sbin/apxs'
'--with-oci8=shared,instantclient,/usr/lib/oracle/10.2.0.3/client/lib'
'--enable-sigchild'
Compile and install was successful. Apache was not working and these are the
sealert messages, i am putting here only summary, raw audit message and
suggestions, which i followed in the same order below to make Apache work
1. Summary
SELinux is preventing /usr/local/php-5.2.5/bin/php from loading
/usr/lib/oracle/10.2.0.3/client/lib/libnnz10.so which requires text
relocation.
Raw Audit Messages
avc: denied { execmod } for comm="php" dev=dm-0 egid=0 euid=0
exe="/usr/local/php-5.2.5/bin/php" exit=-13 fsgid=0 fsuid=0 gid=0 items=0
path="/usr/lib/oracle/10.2.0.3/client/lib/libnnz10.so" pid=27356
scontext=root:system_r:unconfined_t:s0-s0:c0.c1023 sgid=0
subj=root:system_r:unconfined_t:s0-s0:c0.c1023 suid=0 tclass=file
tcontext=system_u:object_r:lib_t:s0 tty=pts1 uid=0
chcon -t textrel_shlib_t /usr/lib/oracle/10.2.0.3/client/lib/*.so
2. SELinux is preventing /usr/sbin/httpd (httpd_t) "execstack" access to
<Unknown> (httpd_t).
Raw Audit Messages
avc: denied { execstack } for comm="httpd" egid=0 euid=0
exe="/usr/sbin/httpd"
exit=-13 fsgid=0 fsuid=0 gid=0 items=0 pid=27907
scontext=root:system_r:httpd_t:s0 sgid=0 subj=root:system_r:httpd_t:s0
suid=0
tclass=process tcontext=root:system_r:httpd_t:s0 tty=(none) uid=0
setsebool -P httpd_disable_trans=1
3. Summary
SELinux is preventing /usr/sbin/httpd from changing the access
protection of
memory on the heap.
Raw Audit Messages
avc: denied { execheap } for comm="httpd" egid=0 euid=0
exe="/usr/sbin/httpd"
exit=0 fsgid=0 fsuid=0 gid=0 items=0 pid=3913
scontext=root:system_r:initrc_t:s0
sgid=0 subj=root:system_r:initrc_t:s0 suid=0 tclass=process
tcontext=root:system_r:initrc_t:s0 tty=(none) uid=0
setsebool -P allow_execheap=1
Has anybody compiled PHP 5 with Oracle client on Redhat or Centos 5 with out
any selinux issues? Is this the known issue or my procedures are wrong. I
have tried compiling couple of weeks back with Red Hat ent5 php source rpms
and got the same selinux errors. Any possible help to put back
allow_execheap=0 httpd_disable_trans=0.
Thanks.
--
View this message in context: http://www.nabble.com/php-with-oci8-tp16447650p16447650.html
Sent from the Fedora SELinux List mailing list archive at Nabble.com.
16 years, 1 month