-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 12/15/2010 12:32 AM, Daniel B. Thurman wrote:
On 12/14/2010 02:45 PM, Daniel J Walsh wrote:
> On 12/14/2010 05:02 PM, Daniel B. Thurman wrote:
>
>> Not sure what this means, but it sound omimous...
>> Using the latest updates.
>
>> ==================================================
>> Summary:
>
>> Your system may be seriously compromised! /usr/bin/nautilus (deleted)
>> attempted
>> to mmap low kernel memory.
>
>> Detailed Description:
>
>> SELinux has denied the nautilus the ability to mmap low area of the
> kernel
>> address space. The ability to mmap a low area of the address space, as
>> configured by /proc/sys/kernel/mmap_min_addr. Preventing such
> mappings helps
>> protect against exploiting null deref bugs in the kernel. All
>> applications that
>> need this access should have already had policy written for them. If a
>> compromised application tries modify the kernel this AVC would be
> generated.
>> This is a serious issue. Your system may very well be compromised.
>
>> Allowing Access:
>
>> Contact your security administrator and report this issue.
>
>> Additional Information:
>
>> Source Context
>> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
>> 023
>> Target Context
>> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
>> 023
>> Target Objects None [ memprotect ]
>> Source nautilus
>> Source Path /usr/bin/nautilus (deleted)
>> Port <Unknown>
>> Host (removed)
>> Source RPM Packages
>> Target RPM Packages
>> Policy RPM selinux-policy-3.7.19-74.fc13
>> Selinux Enabled True
>> Policy Type targeted
>> Enforcing Mode Enforcing
>> Plugin Name mmap_zero
>> Host Name (removed)
>> Platform Linux <
host>.<domain>.com
>> 2.6.34.7-61.fc13.i686 #1 SMP
>> Tue Oct 19 04:42:47 UTC 2010 i686 i686
>> Alert Count 1186
>> First Seen Thu 09 Dec 2010 12:08:59 PM PST
>> Last Seen Thu 09 Dec 2010 12:13:09 PM PST
>> Local ID aba9eed1-e6cf-48cb-80c4-88ccf2d90f43
>> Line Numbers
>
>> Raw Audit Messages
>
>>
node=<host>.<domain>.com type=AVC msg=audit(1291925589.462:92406):
avc:
>> denied { mmap_zero } for pid=26679 comm="nautilus"
>> scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>> tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>> tclass=memprotect
>
>>
node=<host>.<domain>.com type=SYSCALL
msg=audit(1291925589.462:92406):
>> arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=a000 a2=3 a3=22
>> items=0 ppid=2663 pid=26679 auid=500 uid=500 gid=500 euid=500 suid=500
>> fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="nautilus"
>> exe=2F7573722F62696E2F6E617574696C7573202864656C6574656429
>> subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>
>
>> --
>> selinux mailing list
>> selinux(a)lists.fedoraproject.org
>>
https://admin.fedoraproject.org/mailman/listinfo/selinux
>
>
> THis is bad. I have no idea why it would need this and it should be
> denied. Did you try to execute a wine app?
>
>
Uh, I don't remember if I did, is there a way to tell if I did?
I have another related one, should I post it together with this
one or open a new post? It is a Nautilus problem as well.
use this thread. nautilus (most likely) should not be doing this
somethings wrong here, question remains is it a bug in nautilus or an
intrusion attempt (nautilus compromised), in my personal opinion.
--
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAk0H/0wACgkQMlxVo39jgT8otwCgxNlLxSb1xVWKBAQEHotPa18H
ifUAoKxvm91XOeO5kSfLVA2EMsISkcnd
=sFKW
-----END PGP SIGNATURE-----