On Wed, 2007-04-11 at 20:53 +0300, Jouni Viikari wrote:
Hi,
After the latest selinux updates I get a lot of these messages at my
log:
SELinux is preventing /bin/ping (ping_t) "search" to locale (locale_t)
or audit log:
denied { search } for pid=16255 comm="ping" name="locale" dev=dm-0
ino=3113039 scontext=system_u:system_r:ping_t:s0
tcontext=system_u:object_r:locale_t:s0 tclass=dir
type=SYSCALL msg=audit(1176300990.257:65255): arch=40000003 syscall=5
success=no exit=-13 a0=bf91d6e0 a1=0 a2=1b6 a3=8816018 items=0
ppid=18973 pid=18974 auid=4294967295 uid=507 gid=507 euid=0 suid
=0 fsuid=0 egid=507 sgid=507 fsgid=507 tty=(none) comm="ping"
exe="/bin/ping" subj=system_u:system_r:ping_t:s0 key=(null)
type=AVC msg=audit(1176300990.257:65256): avc: denied { search } for
pid=18974 comm="ping" name="locale" dev=dm-0 ino=3113039
scontext=system_u:system_r:ping_t:s0 tcontext=system_u:object_r:loca
le_t:s0 tclass=dir
The last line repeats itself many times.
The pings are run by Big Brother which as a one task pings my network to
see all is up.
Is this a local problem here, selinux problem or ping problem?
I'd say it is a selinux policy problem (should allow ping to read locale
data). You can work around it by creating a local policy module with
audit2allow and installing it via semodule until it is fixed in the
policy. Not sure why it would only show up after an update.
--
Stephen Smalley
National Security Agency