Dear fellow selinux experts,
I am encountering a problem with setroubleshooter and avc denials for wine. It gives me a fatal error report, but I can't copy + paste like I used to, I tried to file a bugzilla report but the process hangs and it is not being sent. Is there another way to capture the report so I can send in the avc denials?
I am running xfce fully updated in rawhide. I try to dmesg but get no avcs and I can't run windows programs under wine without seeing the setroubleshoot(er) go crazy :(
Thanks,
Antonio
On Mon, Aug 17, 2009 at 4:12 PM, Antonio Olivaresolivares14031@yahoo.com wrote:
Dear fellow selinux experts,
I am encountering a problem with setroubleshooter and avc denials for wine. It gives me a fatal error report, but I can't copy + paste like I used to, I tried to file a bugzilla report but the process hangs and it is not being sent. Is there another way to capture the report so I can send in the avc denials?
I am running xfce fully updated in rawhide. I try to dmesg but get no avcs and I can't run windows programs under wine without seeing the setroubleshoot(er) go crazy :(
Thanks,
Antonio
If you are getting AVCs, you should see in /var/log/messages lines that look like:
Aug 17 13:08:42 tlondon setroubleshoot: SELinux is preventing abrt (initrc_t) "add_name" var_t. For complete SELinux messages. run sealert -l 41767f84-0e7c-4e14-a318-8f2f97877019
You should be able to run "sealert" with the arguments in the message to produce a text version of the alert that you can copy/paste into a bugzilla.
tom
--- On Mon, 8/17/09, Tom London selinux@gmail.com wrote:
From: Tom London selinux@gmail.com Subject: Re: setroubleshooter not filing bugs, is there another way To: "Antonio Olivares" olivares14031@yahoo.com Cc: fedora-selinux-list@redhat.com Date: Monday, August 17, 2009, 4:20 PM On Mon, Aug 17, 2009 at 4:12 PM, Antonio Olivaresolivares14031@yahoo.com wrote:
Dear fellow selinux experts,
I am encountering a problem with setroubleshooter and
avc denials for wine. It gives me a fatal error report, but I can't copy + paste like I used to, I tried to file a bugzilla report but the process hangs and it is not being sent. Is there another way to capture the report so I can send in the avc denials?
I am running xfce fully updated in rawhide. I try to
dmesg but get no avcs and I can't run windows programs under wine without seeing the setroubleshoot(er) go crazy :(
Thanks,
Antonio
If you are getting AVCs, you should see in /var/log/messages lines that look like:
Aug 17 13:08:42 tlondon setroubleshoot: SELinux is preventing abrt (initrc_t) "add_name" var_t. For complete SELinux messages. run sealert -l 41767f84-0e7c-4e14-a318-8f2f97877019
You should be able to run "sealert" with the arguments in the message to produce a text version of the alert that you can copy/paste into a bugzilla.
tom
Tom London
Thanks Tom for your guidance. Tomorrow as I get to work and get the alert(s) will try to capture following your advice and mail them to list.
Regards,
Antonio
On Mon, 17 Aug 2009 19:53:50 -0700 (PDT) Antonio Olivares olivares14031@yahoo.com wrote:
--- On Mon, 8/17/09, Tom London selinux@gmail.com wrote:
From: Tom London selinux@gmail.com Subject: Re: setroubleshooter not filing bugs, is there another way To: "Antonio Olivares" olivares14031@yahoo.com Cc: fedora-selinux-list@redhat.com Date: Monday, August 17, 2009, 4:20 PM On Mon, Aug 17, 2009 at 4:12 PM, Antonio Olivaresolivares14031@yahoo.com wrote:
Dear fellow selinux experts,
I am encountering a problem with setroubleshooter and
avc denials for wine. It gives me a fatal error report, but I can't copy + paste like I used to, I tried to file a bugzilla report but the process hangs and it is not being sent. Is there another way to capture the report so I can send in the avc denials?
I am running xfce fully updated in rawhide. I try to
dmesg but get no avcs and I can't run windows programs under wine without seeing the setroubleshoot(er) go crazy :(
Thanks,
Antonio
If you are getting AVCs, you should see in /var/log/messages lines that look like:
Aug 17 13:08:42 tlondon setroubleshoot: SELinux is preventing abrt (initrc_t) "add_name" var_t. For complete SELinux messages. run sealert -l 41767f84-0e7c-4e14-a318-8f2f97877019
You should be able to run "sealert" with the arguments in the message to produce a text version of the alert that you can copy/paste into a bugzilla.
tom
Tom London
Thanks Tom for your guidance. Tomorrow as I get to work and get the alert(s) will try to capture following your advice and mail them to list.
Bear in mind that if you're running auditd, the messages will be in /var/log/audit/audit.log rather than /var/log/messages.
Paul.
You can try searching you audit by using this command:
ausearch -m avc
for today's denial messages : ausearch -m avc -ts today
Date: Tue, 18 Aug 2009 08:01:57 +0100 From: paul@city-fan.org To: olivares14031@yahoo.com CC: fedora-selinux-list@redhat.com Subject: Re: setroubleshooter not filing bugs, is there another way
On Mon, 17 Aug 2009 19:53:50 -0700 (PDT) Antonio Olivares olivares14031@yahoo.com wrote:
--- On Mon, 8/17/09, Tom London selinux@gmail.com wrote:
From: Tom London selinux@gmail.com Subject: Re: setroubleshooter not filing bugs, is there another way To: "Antonio Olivares" olivares14031@yahoo.com Cc: fedora-selinux-list@redhat.com Date: Monday, August 17, 2009, 4:20 PM On Mon, Aug 17, 2009 at 4:12 PM, Antonio Olivaresolivares14031@yahoo.com wrote:
Dear fellow selinux experts,
I am encountering a problem with setroubleshooter and
avc denials for wine. It gives me a fatal error report, but I can't copy + paste like I used to, I tried to file a bugzilla report but the process hangs and it is not being sent. Is there another way to capture the report so I can send in the avc denials?
I am running xfce fully updated in rawhide. I try to
dmesg but get no avcs and I can't run windows programs under wine without seeing the setroubleshoot(er) go crazy :(
Thanks,
Antonio
If you are getting AVCs, you should see in /var/log/messages lines that look like:
Aug 17 13:08:42 tlondon setroubleshoot: SELinux is preventing abrt (initrc_t) "add_name" var_t. For complete SELinux messages. run sealert -l 41767f84-0e7c-4e14-a318-8f2f97877019
You should be able to run "sealert" with the arguments in the message to produce a text version of the alert that you can copy/paste into a bugzilla.
tom
Tom London
Thanks Tom for your guidance. Tomorrow as I get to work and get the alert(s) will try to capture following your advice and mail them to list.
Bear in mind that if you're running auditd, the messages will be in /var/log/audit/audit.log rather than /var/log/messages.
Paul.
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
_________________________________________________________________ Windows Live Messenger: Thanks for 10 great years—enjoy free winks and emoticons. http://clk.atdmt.com/UKM/go/157562755/direct/01/
Mohammed,
Thank you very much for your advice. It also works and it gives all the denied avcs :)
You can try searching you audit by using this command:
ausearch -m avc
for today's denial messages : ausearch -m avc -ts today
[root@localhost ~]# ausearch -m avc -ts today ---- time->Tue Aug 18 07:25:56 2009 type=SYSCALL msg=audit(1250598356.895:28): arch=40000003 syscall=90 success=no exit=-13 a0=bff8b0c0 a1=0 a2=bff8b0c0 a3=5a items=0 ppid=1479 pid=1840 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="wine-preloader" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598356.895:28): avc: denied { mmap_zero } for pid=1840 comm="wine-preloader" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect ---- time->Tue Aug 18 07:25:57 2009 type=SYSCALL msg=audit(1250598357.702:29): arch=40000003 syscall=90 success=no exit=-13 a0=bfe7d630 a1=0 a2=bfe7d630 a3=5a items=0 ppid=1 pid=1848 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="wine-preloader" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598357.702:29): avc: denied { mmap_zero } for pid=1848 comm="wine-preloader" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect ---- time->Tue Aug 18 07:25:57 2009 type=SYSCALL msg=audit(1250598357.812:30): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=110000 a2=0 a3=32 items=0 ppid=1 pid=1848 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="wineboot.exe" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598357.812:30): avc: denied { mmap_zero } for pid=1848 comm="wineboot.exe" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect ---- time->Tue Aug 18 07:25:57 2009 type=SYSCALL msg=audit(1250598357.889:31): arch=40000003 syscall=90 success=no exit=-13 a0=bff8ad80 a1=0 a2=bff8ad80 a3=5a items=0 ppid=1848 pid=1849 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="wine-preloader" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598357.889:31): avc: denied { mmap_zero } for pid=1849 comm="wine-preloader" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect ---- time->Tue Aug 18 07:25:57 2009 type=SYSCALL msg=audit(1250598357.937:32): arch=40000003 syscall=90 success=no exit=-13 a0=bf9c5880 a1=0 a2=bf9c5880 a3=5a items=0 ppid=1848 pid=1850 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="wine-preloader" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598357.937:32): avc: denied { mmap_zero } for pid=1850 comm="wine-preloader" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect ---- time->Tue Aug 18 07:25:58 2009 type=SYSCALL msg=audit(1250598358.059:33): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=110000 a2=0 a3=32 items=0 ppid=1848 pid=1850 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="services.exe" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598358.059:33): avc: denied { mmap_zero } for pid=1850 comm="services.exe" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect ---- time->Tue Aug 18 07:25:58 2009 type=SYSCALL msg=audit(1250598358.696:34): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=110000 a2=0 a3=32 items=0 ppid=1 pid=1849 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="winemenubuilder" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598358.696:34): avc: denied { mmap_zero } for pid=1849 comm="winemenubuilder" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect ---- time->Tue Aug 18 07:25:59 2009 type=SYSCALL msg=audit(1250598359.058:35): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=110000 a2=0 a3=32 items=0 ppid=1479 pid=1840 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="Emu48.exe" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598359.058:35): avc: denied { mmap_zero } for pid=1840 comm="Emu48.exe" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect ---- time->Tue Aug 18 07:26:03 2009 type=SYSCALL msg=audit(1250598363.514:36): arch=40000003 syscall=90 success=no exit=-13 a0=bfa73ab0 a1=0 a2=bfa73ab0 a3=5a items=0 ppid=1 pid=1861 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="wine-preloader" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598363.514:36): avc: denied { mmap_zero } for pid=1861 comm="wine-preloader" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect ---- time->Tue Aug 18 07:26:03 2009 type=SYSCALL msg=audit(1250598363.591:37): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=110000 a2=0 a3=32 items=0 ppid=1 pid=1861 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="explorer.exe" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598363.591:37): avc: denied { mmap_zero } for pid=1861 comm="explorer.exe" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect
Regards,
Antonio
On 08/18/2009 08:33 AM, Antonio Olivares wrote:
Mohammed,
Thank you very much for your advice. It also works and it gives all the denied avcs :)
You can try searching you audit by using this command:
ausearch -m avc
for today's denial messages : ausearch -m avc -ts today
[root@localhost ~]# ausearch -m avc -ts today
time->Tue Aug 18 07:25:56 2009 type=SYSCALL msg=audit(1250598356.895:28): arch=40000003 syscall=90 success=no exit=-13 a0=bff8b0c0 a1=0 a2=bff8b0c0 a3=5a items=0 ppid=1479 pid=1840 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="wine-preloader" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598356.895:28): avc: denied { mmap_zero } for pid=1840 comm="wine-preloader" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect
time->Tue Aug 18 07:25:57 2009 type=SYSCALL msg=audit(1250598357.702:29): arch=40000003 syscall=90 success=no exit=-13 a0=bfe7d630 a1=0 a2=bfe7d630 a3=5a items=0 ppid=1 pid=1848 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="wine-preloader" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598357.702:29): avc: denied { mmap_zero } for pid=1848 comm="wine-preloader" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect
time->Tue Aug 18 07:25:57 2009 type=SYSCALL msg=audit(1250598357.812:30): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=110000 a2=0 a3=32 items=0 ppid=1 pid=1848 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="wineboot.exe" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598357.812:30): avc: denied { mmap_zero } for pid=1848 comm="wineboot.exe" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect
time->Tue Aug 18 07:25:57 2009 type=SYSCALL msg=audit(1250598357.889:31): arch=40000003 syscall=90 success=no exit=-13 a0=bff8ad80 a1=0 a2=bff8ad80 a3=5a items=0 ppid=1848 pid=1849 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="wine-preloader" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598357.889:31): avc: denied { mmap_zero } for pid=1849 comm="wine-preloader" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect
time->Tue Aug 18 07:25:57 2009 type=SYSCALL msg=audit(1250598357.937:32): arch=40000003 syscall=90 success=no exit=-13 a0=bf9c5880 a1=0 a2=bf9c5880 a3=5a items=0 ppid=1848 pid=1850 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="wine-preloader" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598357.937:32): avc: denied { mmap_zero } for pid=1850 comm="wine-preloader" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect
time->Tue Aug 18 07:25:58 2009 type=SYSCALL msg=audit(1250598358.059:33): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=110000 a2=0 a3=32 items=0 ppid=1848 pid=1850 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="services.exe" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598358.059:33): avc: denied { mmap_zero } for pid=1850 comm="services.exe" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect
time->Tue Aug 18 07:25:58 2009 type=SYSCALL msg=audit(1250598358.696:34): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=110000 a2=0 a3=32 items=0 ppid=1 pid=1849 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="winemenubuilder" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598358.696:34): avc: denied { mmap_zero } for pid=1849 comm="winemenubuilder" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect
time->Tue Aug 18 07:25:59 2009 type=SYSCALL msg=audit(1250598359.058:35): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=110000 a2=0 a3=32 items=0 ppid=1479 pid=1840 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="Emu48.exe" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598359.058:35): avc: denied { mmap_zero } for pid=1840 comm="Emu48.exe" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect
time->Tue Aug 18 07:26:03 2009 type=SYSCALL msg=audit(1250598363.514:36): arch=40000003 syscall=90 success=no exit=-13 a0=bfa73ab0 a1=0 a2=bfa73ab0 a3=5a items=0 ppid=1 pid=1861 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="wine-preloader" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598363.514:36): avc: denied { mmap_zero } for pid=1861 comm="wine-preloader" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect
time->Tue Aug 18 07:26:03 2009 type=SYSCALL msg=audit(1250598363.591:37): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=110000 a2=0 a3=32 items=0 ppid=1 pid=1861 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="explorer.exe" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1250598363.591:37): avc: denied { mmap_zero } for pid=1861 comm="explorer.exe" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect
Regards,
Antonio
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
And if you run this output through audit2allow -w in rawhide, you will get the following.
type=AVC msg=audit(1250598356.895:28): avc: denied { mmap_zero } for pid=1840 comm="wine-preloader" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect
Was caused by: The boolean mmap_low_allowed was set incorrectly. Description: Allow certain domains to map low memory in the kernel
Allow access by executing: # setsebool -P mmap_low_allowed 1
Sadly this is not what setroubleshoot told you. I will fix setroubleshoot to give this suggestion.
Thanks Tom for your guidance. Tomorrow as I get
to work and get the
alert(s) will try to capture following your advice and
mail them to
list.
Bear in mind that if you're running auditd, the messages will be in /var/log/audit/audit.log rather than /var/log/messages.
Paul.
Thanks Paul :)
Tom's advice worked. Here's the denied avc
[olivares@localhost ~]$ su - Password: [root@localhost ~]# tail -f /var/log/messages Aug 18 07:26:02 localhost kernel: [drm] TV-14: set mode NTSC 480i 0 Aug 18 07:26:02 localhost kernel: [drm] TV-14: set mode NTSC 480i 0 Aug 18 07:26:02 localhost kernel: [drm] TV-14: set mode NTSC 480i 0 Aug 18 07:26:02 localhost kernel: [drm] TV-14: set mode NTSC 480i 0 Aug 18 07:26:03 localhost setroubleshoot: Your system may be seriously compromised! For complete SELinux messages. run sealert -l 70b576a6-6313-4753-9403-22ac883c585a Aug 18 07:26:03 localhost setroubleshoot: Your system may be seriously compromised! For complete SELinux messages. run sealert -l 70b576a6-6313-4753-9403-22ac883c585a Aug 18 07:26:04 localhost kernel: [drm] TV-14: set mode NTSC 480i 0 Aug 18 07:26:04 localhost kernel: [drm] TV-14: set mode NTSC 480i 0 Aug 18 07:26:04 localhost kernel: [drm] TV-14: set mode NTSC 480i 0 Aug 18 07:26:05 localhost kernel: [drm] TV-14: set mode NTSC 480i 0 ^C [root@localhost ~]# [root@localhost ~]# [root@localhost ~]# sealert -l 70b576a6-6313-4753-9403-22ac883c585a
Summary:
Your system may be seriously compromised!
Detailed Description:
SELinux has denied the explorer.exe the ability to mmap low area of the kernel address space. The ability to mmap a low area of the address space, as configured by /proc/sys/kernel/mmap_min_addr. Preventing such mappings helps protect against exploiting null deref bugs in the kernel. All applications that need this access should have already had policy written for them. If a compromised application tries modify the kernel this AVC would be generated. This is a serious issue. Your system may very well be compromised.
Allowing Access:
Contact your security administrator and report this issue.
Additional Information:
Source Context unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 Target Context unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 Target Objects None [ memprotect ] Source wine-preloader Source Path /usr/bin/wine-preloader Port <Unknown> Host localhost.localdomain Source RPM Packages wine-core-1.1.26-1.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.26-8.fc12 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name mmap_zero Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.31-0.125.4.2.rc5.git2.fc12.i686 #1 SMP Tue Aug 11 21:20:05 EDT 2009 i686 i686 Alert Count 86 First Seen Wed Aug 12 17:09:09 2009 Last Seen Tue Aug 18 07:26:03 2009 Local ID 70b576a6-6313-4753-9403-22ac883c585a Line Numbers
Raw Audit Messages
node=localhost.localdomain type=AVC msg=audit(1250598363.591:37): avc: denied { mmap_zero } for pid=1861 comm="explorer.exe" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect
node=localhost.localdomain type=SYSCALL msg=audit(1250598363.591:37): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=110000 a2=0 a3=32 items=0 ppid=1 pid=1861 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="explorer.exe" exe="/usr/bin/wine-preloader" subj=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 key=(null)
Thanks,
Antonio
__________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
selinux@lists.fedoraproject.org