-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Ali Nebi wrote:
Hi,
i want to ask about 2 strange audit messages. The messages are these:
Nov 5 14:14:24 asgard kernel: audit(1194268464.097:309): avc: denied
{ search } for pid=22933 comm="sh" name="src" dev=dm-0 ino=5244065
scontext=root:system_r:httpd_t:s0 tcontext=system_u:object_r:src_t:s0
tclass=dir
Nov 5 14:14:24 asgard kernel: audit(1194268464.124:310): avc: denied
{ getattr } for pid=22933 comm="sh" name="SPECS" dev=dm-0
ino=5865755
scontext=root:system_r:httpd_t:s0 tcontext=system_u:object_r:src_t:s0
tclass=dir
i don't know what is the reason sh to try to make something in /usr/src
and /usr/src/redhat/SPEC
we have not set some script that to have task to do something in these
directories. is it possible to be some hack attack ? also i see that
scontext is this: scontext=root:system_r:httpd_t:s0 is it possible to
understand where is the file that try to use "sh" ?
Also the audits:
Nov 5 12:03:07 casamerica kernel: audit(1194260587.185:40): avc:
denied { read write } for pid=26690 comm="listinfo" name=""
dev=sockfs
ino=1414447 scontext=system_u:system_r:mailman_cgi_t:s0
tcontext=system_u:system_r:httpd_t:s0 tclass=unix_stream_socket
i have some similar messages related with mailmain, what is the best
that i can do to solve these messages?
Thanks in advanced!
--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
I guess that you are running some mod_(php, perl)? script that is trying
to look at /usr/src/redhat/SPEC. This is all the info we get from the
kernel. I don't know if this is a problem or not.
The other avc is a leaked file descriptor in httpd and could be
dontaudited, in mailmail_cgi_t. It can safely be ignored.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org
iD8DBQFHMIayrlYvE4MpobMRAvJqAKCpxJhX79gb5AyWWaMDarWDIdFmXwCg4mj8
uV8jei4Xzvv8ybkhX5g1OgA=
=NaRf
-----END PGP SIGNATURE-----