changing categories with "semanage translation -m"
by Murray McAllister
Hi,
I added the following two translations using "semanage translation -a -T
[name] level":
s0:c1 NotSecret
s0:c1.c2 Secret
If I want to change the categories, say to have Secret as s0:c3, or only
so:c2, can I use semanage? I tried "semanage translation -m -T Secret
s0:c2":
/usr/sbin/semanage: s0:c2 not defined in translations
If I use "-a" instead of "-m", it adds another translation.
Is the recommended way of changing categories adding a new one, and then
'semanage login -m -r s0:xy user', for any users using the old range?
Cheers.
I am using:
* Fedora release 9 (Sulphur)
* kernel-2.6.25.14-108.fc9.i686
* kernel-headers-2.6.25.14-108.fc9.i386
* policycoreutils-2.0.52-5.fc9.i386
* mcstrans-0.2.11-1.fc9.i386
* selinux-policy-targeted-3.3.1-84.fc9.noarch
* selinux-policy-3.3.1-84.fc9.noarch
* selinux-policy-devel-3.3.1-84.fc9.noarch
* libselinux-python-2.0.67-4.fc9.i386
* libselinux-2.0.67-4.fc9.i386
$ sestatus
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 22
Policy from config file: targeted
15 years, 8 months
error when adding a translation with "semanage translation -a"
by Murray McAllister
Hi,
This is probably user error. I want to add a translation:
1. sudo cat /etc/selinux/targeted/setrans.conf
s0=
s0-s0:c0.c1023=SystemLow-SystemHigh
s0:c0.c1023=SystemHigh
2. $ sudo semanage translation -l
Level Translation
s0
s0-s0:c0.c1023 SystemLow-SystemHigh
s0:c0.c1023 SystemHigh
3. Attempt to add a new translation:
$ sudo semanage translation -a -T NotSecret s0:c1
/etc/init.d/functions: line 19: /sbin/consoletype: Permission denied
basename: write error: Permission denied
basename: write error: Permission denied
env: /etc/init.d/mcstrans: Permission denied
4. Translation appears to have been added:
sudo semanage translation -l
Level Translation
s0
s0-s0:c0.c1023 SystemLow-SystemHigh
s0:c0.c1023 SystemHigh
s0:c1 NotSecret
sudo cat /etc/selinux/targeted/setrans.conf
s0=
s0-s0:c0.c1023=SystemLow-SystemHigh
s0:c0.c1023=SystemHigh
s0:c1=NotSecret
The following is logged to /var/log/messages:
Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing service
(semanage_t) "execute" to ./consoletype (consoletype_exec_t). For
complete SELinux messages. run sealert -l
3a9da9b1-9310-492b-a4fd-3706d8d78259
Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing service
(semanage_t) "execute" to ./consoletype (consoletype_exec_t). For
complete SELinux messages. run sealert -l
3a9da9b1-9310-492b-a4fd-3706d8d78259
Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing service
(semanage_t) "read" to pipe (semanage_t). For complete SELinux messages.
run sealert -l 154967ff-45a0-4b8f-bf04-25546f129dd3
Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing service
(semanage_t) "read" to pipe (semanage_t). For complete SELinux messages.
run sealert -l 154967ff-45a0-4b8f-bf04-25546f129dd3
Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing basename
(semanage_t) "getattr" to pipe (semanage_t). For complete SELinux
messages. run sealert -l 641f7545-c40c-4d79-84c7-97e2b32d8c0a
Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing basename
(semanage_t) "write" to pipe (semanage_t). For complete SELinux
messages. run sealert -l 2ab7598a-b0f7-4dec-a10d-cb4cfac057ee
Aug 31 20:57:01 localhost setroubleshoot: SELinux is preventing basename
(semanage_t) "getattr" to pipe (semanage_t). For complete SELinux
messages. run sealert -l 641f7545-c40c-4d79-84c7-97e2b32d8c0a
Aug 31 20:57:01 localhost setroubleshoot: SELinux is preventing basename
(semanage_t) "write" to pipe (semanage_t). For complete SELinux
messages. run sealert -l 2ab7598a-b0f7-4dec-a10d-cb4cfac057ee
Aug 31 20:57:01 localhost setroubleshoot: SELinux is preventing service
(semanage_t) "read" to pipe (semanage_t). For complete SELinux messages.
run sealert -l 154967ff-45a0-4b8f-bf04-25546f129dd3
Aug 31 20:57:01 localhost setroubleshoot: SELinux is preventing env
(semanage_t) "transition" to /etc/rc.d/init.d/mcstrans (semanage_t). For
complete SELinux messages. run sealert -l
ac0f934e-29dc-4702-a2f4-3a752150cb8f
The following is logged to /var/log/audit/audit.log:
type=AVC msg=audit(1220180220.598:367): avc: denied { execute } for
pid=2118 comm="service" name="consoletype" dev=sda5 ino=73034
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=system_u:object_r:consoletype_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1220180220.598:367): arch=40000003 syscall=11
success=no exit=-13 a0=8d4c760 a1=8d4c7a8 a2=8d4c3b8 a3=0 items=0
ppid=2117 pid=2118 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 ses=1 comm="service" exe="/bin/bash"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.599:368): avc: denied { execute } for
pid=2118 comm="service" name="consoletype" dev=sda5 ino=73034
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=system_u:object_r:consoletype_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1220180220.599:368): arch=40000003 syscall=33
success=no exit=-13 a0=8d4c760 a1=1 a2=11 a3=8d4c760 items=0 ppid=2117
pid=2118 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 ses=1 comm="service" exe="/bin/bash"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.637:369): avc: denied { read } for
pid=2116 comm="service" path="pipe:[12134]" dev=pipefs ino=12134
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tclass=fifo_file
type=SYSCALL msg=audit(1220180220.637:369): arch=40000003 syscall=3
success=no exit=-13 a0=3 a1=bfb075c8 a2=80 a3=80 items=0 ppid=2115
pid=2116 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 ses=1 comm="service" exe="/bin/bash"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.679:370): avc: denied { read } for
pid=2116 comm="service" path="pipe:[12135]" dev=pipefs ino=12135
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tclass=fifo_file
type=SYSCALL msg=audit(1220180220.679:370): arch=40000003 syscall=3
success=no exit=-13 a0=3 a1=bfb079c8 a2=80 a3=80 items=0 ppid=2115
pid=2116 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 ses=1 comm="service" exe="/bin/bash"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.694:371): avc: denied { getattr } for
pid=2119 comm="basename" path="pipe:[12135]" dev=pipefs ino=12135
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tclass=fifo_file
type=SYSCALL msg=audit(1220180220.694:371): arch=40000003 syscall=197
success=no exit=-13 a0=1 a1=bfd3e414 a2=960ff4 a3=9614c0 items=0
ppid=2116 pid=2119 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 ses=1 comm="basename" exe="/bin/basename"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.708:372): avc: denied { write } for
pid=2119 comm="basename" path="pipe:[12135]" dev=pipefs ino=12135
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tclass=fifo_file
type=SYSCALL msg=audit(1220180220.708:372): arch=40000003 syscall=4
success=no exit=-13 a0=1 a1=b7f3d000 a2=8 a3=8 items=0 ppid=2116
pid=2119 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 ses=1 comm="basename" exe="/bin/basename"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.727:373): avc: denied { getattr } for
pid=2120 comm="basename" path="pipe:[12136]" dev=pipefs ino=12136
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tclass=fifo_file
type=SYSCALL msg=audit(1220180220.727:373): arch=40000003 syscall=197
success=no exit=-13 a0=1 a1=bffb9684 a2=960ff4 a3=9614c0 items=0
ppid=2116 pid=2120 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 ses=1 comm="basename" exe="/bin/basename"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.728:374): avc: denied { write } for
pid=2120 comm="basename" path="pipe:[12136]" dev=pipefs ino=12136
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tclass=fifo_file
type=SYSCALL msg=audit(1220180220.728:374): arch=40000003 syscall=4
success=no exit=-13 a0=1 a1=b80b8000 a2=8 a3=8 items=0 ppid=2116
pid=2120 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 ses=1 comm="basename" exe="/bin/basename"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.749:375): avc: denied { read } for
pid=2116 comm="service" path="pipe:[12136]" dev=pipefs ino=12136
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tclass=fifo_file
type=SYSCALL msg=audit(1220180220.749:375): arch=40000003 syscall=3
success=no exit=-13 a0=3 a1=bfb079c8 a2=80 a3=80 items=0 ppid=2115
pid=2116 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 ses=1 comm="service" exe="/bin/bash"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.760:376): avc: denied { transition } for
pid=2121 comm="env" path="/etc/rc.d/init.d/mcstrans" dev=sda5
ino=222868 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:semanage_t:s0 tclass=process
type=SYSCALL msg=audit(1220180220.760:376): arch=40000003 syscall=11
success=no exit=-13 a0=bfd449ce a1=bfd435b8 a2=9922858 a3=5 items=0
ppid=2116 pid=2121 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 ses=1 comm="env" exe="/bin/env"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
The system:
* Fedora release 9 (Sulphur)
* kernel-2.6.25.14-108.fc9.i686
* kernel-headers-2.6.25.14-108.fc9.i386
* policycoreutils-2.0.52-5.fc9.i386
* mcstrans-0.2.11-1.fc9.i386
* selinux-policy-targeted-3.3.1-84.fc9.noarch
* selinux-policy-3.3.1-84.fc9.noarch
* selinux-policy-devel-3.3.1-84.fc9.noarch
* libselinux-python-2.0.67-4.fc9.i386
* libselinux-2.0.67-4.fc9.i386
$ sestatus
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 22
Policy from config file: targeted
ps -eZ | grep mcs
system_u:system_r:setrans_t:SystemLow-SystemHigh 1262 ? 00:00:00 mcstransd
Regards,
Murray.
15 years, 8 months
MLS enforcing and kerberos
by Robert Story
I'm trying to switch a working kerberos server from targeted/enforcing
to mls/enforcing. The krb5kdc daemon start fine, but kadmin does not.
There is a single avc in the audit log:
type=AVC msg=audit(1219421464.372:719): avc: denied { getattr } for pid=2436 comm="kadmind" path="/var/tmp/kadmin_0" dev=dm-5 ino=82064 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s15:c0.c1023 tclass=file
I ran this through audit2allow and loaded the module, with no luck. I
ran 'semodule -DB' to see what else was being hit and not audited, and
get quite a few more:
type=AVC msg=audit(1219421462.655:714): avc: denied { siginh } for pid=2436 comm="kadmind" scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tclass=process
type=AVC msg=audit(1219421462.655:714): avc: denied { rlimitinh } for pid=2436 comm="kadmind" scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tclass=process
type=AVC msg=audit(1219421462.655:714): avc: denied { noatsecure } for pid=2436 comm="kadmind" scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tclass=process
type=SYSCALL msg=audit(1219421462.655:714): arch=14 syscall=11 success=yes exit=0 a0=100f1600 a1=100f13b0 a2=100f03d8 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null)
type=AVC msg=audit(1219421462.668:715): avc: denied { read } for pid=2436 comm="kadmind" name="config" dev=dm-5 ino=57734 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:selinux_config_t:s0 tclass=file
type=SYSCALL msg=audit(1219421462.668:715): arch=14 syscall=5 success=no exit=-13 a0=1fcdc380 a1=10000 a2=1b6 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null)
type=AVC msg=audit(1219421462.670:716): avc: denied { write } for pid=2436 comm="kadmind" name="kdc.conf" dev=dm-5 ino=82034 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:krb5kdc_conf_t:s0 tclass=file
type=SYSCALL msg=audit(1219421462.670:716): arch=14 syscall=33 success=no exit=-13 a0=20020c30 a1=2 a2=1b6 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null)
type=AVC msg=audit(1219421462.671:717): avc: denied { write } for pid=2436 comm="kadmind" name="krb5.conf" dev=dm-5 ino=378227 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:krb5_conf_t:s0 tclass=file
type=SYSCALL msg=audit(1219421462.671:717): arch=14 syscall=33 success=no exit=-13 a0=20020d20 a1=2 a2=1b6 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null)
type=AVC msg=audit(1219421464.369:718): avc: denied { name_bind } for pid=2436 comm="kadmind" src=916 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:hi_reserved_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1219421464.369:718): arch=14 syscall=102 success=no exit=-13 a0=2 a1=bfb6c484 a2=10 a3=bfb6c5dc items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null)
type=AVC msg=audit(1219421464.372:719): avc: denied { getattr } for pid=2436 comm="kadmind" path="/var/tmp/kadmin_0" dev=dm-5 ino=82064 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s15:c0.c1023 tclass=file
type=SYSCALL msg=audit(1219421464.372:719): arch=14 syscall=195 success=no exit=-13 a0=203136c0 a1=bfb6c120 a2=bfb6c120 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null)
type=AVC msg=audit(1219421464.405:720): avc: denied { getattr } for pid=2436 comm="kadmind" path="/var/tmp/kadmin_0" dev=dm-5 ino=82064 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s15:c0.c1023 tclass=file
type=SYSCALL msg=audit(1219421464.405:720): arch=14 syscall=195 success=no exit=-13 a0=20409ad8 a1=bfb6c120 a2=bfb6c120 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null)
running this through audit2allow and loading the module doesn't help
either... What can I try next?
--
Robert Story
SPARTA
15 years, 8 months
many avcs at startup, readahead and several others
by Antonio Olivares
Dear fellow selinux troubleshooters and testers,
Using rawhide, I have seen several avcs at startup namely readahead and others, while I found out that the sound problem is due to selinux getting in the way of pulse. Here's a few avcs. Advise and/or workarounds appreciated, setroubleshoot has not kicked in, these are from dmesg | grep 'avcs'
[root@localhost ~]# dmesg | grep 'avc'
type=1400 audit(1220390408.063:4): avc: denied { read write } for pid=611 comm="readahead" path="/dev/console" dev=tmpfs ino=408 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=chr_file
type=1400 audit(1220390408.064:5): avc: denied { read write } for pid=611 comm="readahead" path="/dev/console" dev=tmpfs ino=408 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=chr_file
type=1400 audit(1220390408.064:6): avc: denied { read write } for pid=611 comm="readahead" path="/dev/console" dev=tmpfs ino=408 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=chr_file
type=1400 audit(1220390408.788:7): avc: denied { fowner } for pid=611 comm="readahead" capability=3 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:readahead_t:s0 tclass=capability
type=1400 audit(1220390408.837:8): avc: denied { fowner } for pid=611 comm="readahead" capability=3 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:readahead_t:s0 tclass=capability
type=1400 audit(1220390408.838:9): avc: denied { fowner } for pid=611 comm="readahead" capability=3 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:readahead_t:s0 tclass=capability
type=1400 audit(1220390409.131:10): avc: denied { fowner } for pid=611 comm="readahead" capability=3 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:readahead_t:s0 tclass=capability
type=1400 audit(1220390433.392:11): avc: denied { write } for pid=1457 comm="ip6tables-resto" path="/0" dev=devpts ino=2 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=chr_file
type=1400 audit(1220390434.665:12): avc: denied { write } for pid=1679 comm="ip" path="/0" dev=devpts ino=2 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=chr_file
type=1400 audit(1220390483.087:13): avc: denied { search } for pid=1941 comm="pcscd" name="dbus" dev=dm-0 ino=3276848 scontext=system_u:system_r:pcscd_t:s0 tcontext=system_u:object_r:system_dbusd_var_run_t:s0 tclass=dir
type=1400 audit(1220390498.350:14): avc: denied { execute } for pid=2393 comm="gdm" name="rpm" dev=dm-0 ino=24117303 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_exec_t:s0 tclass=file
type=1400 audit(1220390498.351:15): avc: denied { getattr } for pid=2393 comm="gdm" path="/bin/rpm" dev=dm-0 ino=24117303 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_exec_t:s0 tclass=file
type=1400 audit(1220390498.351:16): avc: denied { getattr } for pid=2393 comm="gdm" path="/bin/rpm" dev=dm-0 ino=24117303 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_exec_t:s0 tclass=file
type=1400 audit(1220391361.963:17): avc: denied { setattr } for pid=3251 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220391361.965:18): avc: denied { setattr } for pid=3251 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220391361.965:19): avc: denied { setattr } for pid=3251 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220391361.966:20): avc: denied { setattr } for pid=3251 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220391361.966:21): avc: denied { write } for pid=3251 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220391480.205:22): avc: denied { setattr } for pid=3267 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220391480.206:23): avc: denied { setattr } for pid=3267 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220391480.206:24): avc: denied { setattr } for pid=3267 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220391480.206:25): avc: denied { setattr } for pid=3267 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220391480.206:26): avc: denied { write } for pid=3267 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396664.211:27): avc: denied { setattr } for pid=3639 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396664.211:28): avc: denied { setattr } for pid=3639 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396664.212:29): avc: denied { setattr } for pid=3639 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396664.212:30): avc: denied { setattr } for pid=3639 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396664.212:31): avc: denied { write } for pid=3639 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396675.758:32): avc: denied { setattr } for pid=3655 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396675.759:33): avc: denied { setattr } for pid=3655 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396675.759:34): avc: denied { setattr } for pid=3655 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396675.760:35): avc: denied { setattr } for pid=3655 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396675.760:36): avc: denied { write } for pid=3655 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396688.315:37): avc: denied { setattr } for pid=3667 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396688.316:38): avc: denied { setattr } for pid=3667 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396688.317:39): avc: denied { setattr } for pid=3667 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396688.317:40): avc: denied { setattr } for pid=3667 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396688.318:41): avc: denied { write } for pid=3667 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396800.645:42): avc: denied { setattr } for pid=3788 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396800.645:43): avc: denied { setattr } for pid=3788 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396800.646:44): avc: denied { setattr } for pid=3788 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396800.646:45): avc: denied { setattr } for pid=3788 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396800.647:46): avc: denied { write } for pid=3788 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396814.195:47): avc: denied { setattr } for pid=3800 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396814.196:48): avc: denied { setattr } for pid=3800 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396814.196:49): avc: denied { setattr } for pid=3800 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396814.197:50): avc: denied { setattr } for pid=3800 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=1400 audit(1220396814.197:51): avc: denied { write } for pid=3800 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
Thanks,
Antonio
15 years, 8 months
AVC Denial "services"
by Frank Murphy
su - root
chcon -t bin_t './system-config-services-mechanism.py'
chcon: cannot access `./system-config-services-mechanism.py': No such
file or directory
Summary:
SELinux is preventing the dbus-daemon-lau (system_dbusd_t) from executing
./system-config-services-mechanism.py.
Detailed Description:
SELinux has denied the dbus-daemon-lau from executing
./system-config-services-mechanism.py. If dbus-daemon-lau is supposed to be able
to execute ./system-config-services-mechanism.py, this could be a labeling
problem. Most confined domains are allowed to execute files labeled bin_t. So
you could change the labeling on this file to bin_t and retry the application.
If this dbus-daemon-lau is not supposed to execute
./system-config-services-mechanism.py, this could signal a intrusion attempt.
Allowing Access:
If you want to allow dbus-daemon-lau to execute
./system-config-services-mechanism.py: chcon -t bin_t
'./system-config-services-mechanism.py' If this fix works, please update the
file context on disk, with the following command: semanage fcontext -a -t bin_t
'./system-config-services-mechanism.py' Please specify the full path to the
executable, Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this selinux-policy
to make sure this becomes the default labeling.
Additional Information:
Source Context system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
Target Context system_u:object_r:usr_t:s0
Target Objects ./system-config-services-mechanism.py [ file ]
Source dbus-daemon-lau
Source Path /lib/dbus-1/dbus-daemon-launch-helper
Port <Unknown>
Host rawhide-02
Source RPM Packages dbus-1.2.3-1.fc10
Target RPM Packages
Policy RPM selinux-policy-3.5.1-4.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name execute
Host Name rawhide-02
Platform Linux rawhide-02 2.6.27-0.238.rc2.fc10.i686 #1 SMP
Thu Aug 7 08:00:04 EDT 2008 i686 i686
Alert Count 1
First Seen Sat 30 Aug 2008 08:22:57 IST
Last Seen Sat 30 Aug 2008 08:22:57 IST
Local ID ffddfd97-63b1-4809-aee4-c10e29d86722
Line Numbers
Raw Audit Messages
host=rawhide-02 type=AVC msg=audit(1220080977.294:17): avc: denied {
execute } for pid=3564 comm="dbus-daemon-lau"
name="system-config-services-mechanism.py" dev=dm-0 ino=2605067
scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:usr_t:s0 tclass=file
host=rawhide-02 type=SYSCALL msg=audit(1220080977.294:17):
arch=40000003 syscall=11 success=no exit=-13 a0=9774018 a1=9773d60
a2=9773008 a3=b8d9bc items=0 ppid=3563 pid=3564 auid=4294967295 uid=0
gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
ses=4294967295 comm="dbus-daemon-lau"
exe="/lib/dbus-1/dbus-daemon-launch-helper"
subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)
15 years, 8 months
AVC denials when using RH Cluster Suite's qdiskd and ping heuristic
by Sean E. Millichamp
I have been experimenting with using a quorum disk with the RH cluster
suite product (qdiskd in the cman RPM). One of the requirements of
using qdiskd is that you must specify at least one command that can be
run to test the health of the node.
A typical command to use for this heuristic is ping, although any
command that returns a 0/non-0 exit status is acceptable.
When I configure a simple ping test with qdisk I get:
type=AVC msg=audit(1219960233.627:4561): avc: denied { read write } for pid=23174 comm="ping" path="/dev/sda4" dev=tmpfs ino=1051 scontext=root:system_r:ping_t:s0 tcontext=system_u:object_
r:fixed_disk_device_t:s0 tclass=blk_file
type=AVC msg=audit(1219960233.627:4561): avc: denied { read write } for pid=23174 comm="ping" path="/dev/sdb4" dev=tmpfs ino=985 scontext=root:system_r:ping_t:s0 tcontext=system_u:object_r
:fixed_disk_device_t:s0 tclass=blk_file
type=SYSCALL msg=audit(1219960233.627:4561): arch=c000003e syscall=59 success=yes exit=0 a0=1f3575a0 a1=1f357610 a2=1f356150 a3=3 items=0 ppid=23163 pid=23174 auid=0 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=189 comm="ping" exe="/bin/ping" subj=root:system_r:ping_t:s0 key=(null)
The test is: "/bin/ping -c1 -t1 x.x.x.x" where x.x.x.x is a
known-reachable IP. This works without AVC denials from the command
line.
Interestingly, the ping command seems to complete and return an exit
code properly to qdisk as the log message shows that it is up.
I have used audit2allow which told me I could do:
allow ping_t fixed_disk_device_t:blk_file { read write };
and silence the message, but somehow giving ping access to
fixed_disk_device_t to quiet a log message seems like it defeats the
spirit of limited access :)
I have no idea why ping (I am assuming that I am reading it correctly
and it is ping) would be trying to access /dev/sda4 or /dev/sdb4. Those
partitions are the extended partition container on my software RAID-1
boot drives. I've poked briefly at the qdiskd code and it seems to do a
normal fork/exec to invoke the ping.
Has anyone seen anything like this or have any ideas on where I should
look next? I've spent a while on it so far and I don't have a lot more
time to spend on it, but I'd like to solve it if possible and (if
needed) get a fix out somewhere.
I have been doing my testing with the RHEL versions of these tools as I
don't have a cluster of Fedora machines handy, but I couldn't find a
RHEL SELinux list and this looked like the best bet.
selinux-policy-targeted-2.4.6-137.1.el5
cman-2.0.84-2.el5
I'm still pretty new to trying to sift through SELinux policy/messages
so please be patient with me. :)
Thanks!
Sean
15 years, 8 months
Bootable copy of an FC9 system.
by Nickolas Gray
I am attempting to create a bootable copy of a running SELinux box on
FC9. I think I am close but I am coming up with a kernel panic (text
at end) Here are the steps and a brief reason. If anyone has any
suggestions where I might have made a mistake or left something out a
comment would be appreciated. The only requirement so far is that it
has to be a disk to disk copy with no CD/DVD rescue involved.
The original looks like
mbr on boot sector
/dev/sda1 ext3 /boot
/dev/sda2 LVM
VolGroup00/LogVol00 is root
VolGroup00/LogVol01 is swap
This is what I am doing.
• This seemed like an efficient way to dup the filesystems of the
source to the target.
sfdisk -d /dev/sda | sfdisk /dev/sdb
•Duplicate the MBR
dd if=/dev/sda1 of=/dev/sdb1 bs=512k
•Copy the entire /boot from a to b
dd if=/dev/sda of=/dev/sdb bs=664 count=1
•Add the /dev/sdb2 to LVM
pvcreate /dev/sdb2
create the VolGroup for /
vgcreate -s 32m VolGroup01 /dev/sdb2
Create the logical volume for / and swap
lvcreate -l 1562 -n LogVol00 VolGroup01
lvcreate -l 62 -n LogVol01 VolGroup01
Create the swap area
mkswap /dev/VolGroup01/LogVol01
Format the / filesystem
mkfs -t ext3 /dev/VolGroup01/LogVol00
Create the snapshot
lvcreate -L 20g -s -n snap /dev/VolGroup00/LogVol00
Mount the snapshot
mount /dev/VolGroup00/snap /snapshot
Mount the target
mount /dev/VolGroup01/LogVol00 /target
Rsync over the snapshot
rsync -vXxpr /snapshot/* /target
Unmount the snapshot
umount /snapshot
lvremove -f VolGroup00/snap
At this point I fixed the initrd, the fstab and grub.conf on the
target to point to VolGroup01 instead of VolGroup00.
I would think this should be it.
What I get is.
root (hd0,0)
Filesystem type is .....
kerne /vmlinuz ......
Linux bzimage.....
initrd / initrd ....
Linux initrd
Decompresing Linux ... Done
Booting the kernel
Red Hat nash version 6,0,52 starting
Reading all physical volumes this make take awhile ....
Found volume group VolGroup01 now active
ERROR: exec of init (/sbin/init) failed failed!!!! No such file or
directory
ERROR: failed in exec of /bin/echo: No such file or directory
a couple messages about not finding /bin/sleep
Kernel Panic
I am not really sure where this is getting to. I thought it was
getting to the initrd but now I am not sure.
Thanks Nick
15 years, 8 months
policy rpm %post script encounters avc violations
by Johnson, Richard
When installing a policy rpm, one cannot log the install activity w/o
generating avc errors. For example:
rpm -i lsb-ft-asn-selinux > /var/log/rpm-update.log
produces the following violation:
type=SYSCALL msg=audit(1219774608.030:789): arch=c000003e syscall=59
success=yes exit=0 a0=be952e0 a1=be93390 a2=be958f0 a3=8 items=0
ppid=2848 pid=2875 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=ttyS1 ses=2 comm="restorecon" exe="/sbin/restorecon"
subj=root:system_r:restorecon_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1219774608.030:789): avc: denied { write } for
pid=2875 comm="restorecon" path="/var/log/rpm-update.log" dev=md2
ino=2694055 scontext=root:system_r:restorecon_t:s0-s0:c0.c1023
tcontext=root:object_r:var_log_t:s0 tclass=file
The problems seems to stem from recording the %post script's attempts to
relabel files affected by the policy, specifically:
/sbin/restorecon -F -R -v /opt/ft/sbin/sra_alarm;
/sbin/restorecon -F -R -v /etc/opt/ft/asn;
/sbin/restorecon -F -R -v /var/opt/ft/asn;
/sbin/restorecon -F -R -v /var/opt/ft/log;
Is there any way to preserve the logging w/o disabling selinux for the
duration of the install?
FWIW, the rpm commands are executed from a bash script.
15 years, 8 months
selinux and readahead
by Antonio Olivares
Dear all,
I have encountered the following setroubleshoot warning:
Summary:
SELinux is preventing readahead (readahead_t) "read" to inotify (inotifyfs_t).
Detailed Description:
SELinux denied access requested by readahead. It is not expected that this
access is required by readahead and this access may signal an intrusion attempt.
It is also possible that the specific version or configuration of the
application is causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for inotify,
restorecon -v 'inotify'
If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context system_u:system_r:readahead_t:SystemLow-SystemHigh
Target Context system_u:object_r:inotifyfs_t
Target Objects inotify [ dir ]
Source readahead
Source Path /usr/sbin/readahead
Port <Unknown>
Host localhost.localdomain
Source RPM Packages readahead-1.4.4-1.fc10
Target RPM Packages
Policy RPM selinux-policy-3.5.1-4.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.27-0.244.rc2.git1.fc10.i686 #1 SMP Fri Aug 8
13:26:20 EDT 2008 i686 i686
Alert Count 2
First Seen Thu 21 Aug 2008 04:04:26 AM CDT
Last Seen Thu 21 Aug 2008 04:04:28 AM CDT
Local ID c67dc8d2-0096-4510-9075-cbea7074ffa2
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1219309468.106:155): avc: denied { read } for pid=7574 comm="readahead" path="inotify" dev=inotifyfs ino=1 scontext=system_u:system_r:readahead_t:s0-s0:c0.c1023 tcontext=system_u:object_r:inotifyfs_t:s0 tclass=dir
host=localhost.localdomain type=SYSCALL msg=audit(1219309468.106:155): arch=40000003 syscall=11 success=yes exit=0 a0=9f292d0 a1=9f29368 a2=9f295c0 a3=0 items=0 ppid=7564 pid=7574 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=24 comm="readahead" exe="/usr/sbin/readahead" subj=system_u:system_r:readahead_t:s0-s0:c0.c1023 key=(null)
I do not know if readahead should be denied or not? What do you recommend that I do?
Regards,
Antonio
15 years, 8 months
Samba Policy - Type Enforcement File
by prakash hallalli
Hi All
I have installed selinux on fedora 8, I was using targeted policy
which is the default policy in fedora.
I have searched the policy module file ( File Context (FC) Type Enforcement
(TE) and an Interface file (IF) ) Because i have configured samba server,
so i need to change some permissions in samba.te file, but i couldn't find
these file. Please help me where can i get these file and which package i
have to install.
Thanks
praksh,h,k
15 years, 8 months