Attachment 147697 Details for Bug 227896 – selinux alerts

selinux alerts

exim-selinux-alerts.txt (text/plain), 26.80 KB, created by Tim Lauridsen on 2007-02-08 20:31:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tim Lauridsen

Created: 2007-02-08 20:31:43 UTC

Size: 26.80 KB

patch

obsolete

>Summary
>    SELinux is preventing /usr/sbin/exim (logwatch_t) "setuid" to <Unknown>
>    (logwatch_t).
>
>Detailed Description
>    SELinux denied access requested by /usr/sbin/exim. It is not expected that
>    this access is required by /usr/sbin/exim and this access may signal an
>    intrusion attempt. It is also possible that the specific version or
>    configuration of the application is causing it to require additional access.
>
>Allowing Access
>    You can generate a local policy module to allow this access - see
>    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
>    SELinux protection altogether. Disabling SELinux protection is not
>    recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
>    against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:logwatch_t:s0-s0:c0.c1023
>Target Context                system_u:system_r:logwatch_t:s0-s0:c0.c1023
>Target Objects                None [ capability ]
>Affected RPM Packages         exim-4.63-6.fc7 [application]
>Policy RPM                    selinux-policy-2.5.2-5.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.catchall
>Host Name                     naboo
>Platform                      Linux naboo 2.6.20-1.2922.fc7 #1 SMP Sun Feb 4
>                              18:53:10 EST 2007 i686 athlon
>Alert Count                   20
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { setuid } for comm="sendmail" egid=93 euid=0 exe="/usr/sbin/exim"
>exit=-1 fsgid=93 fsuid=0 gid=93 items=0 pid=4060
>scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 sgid=93
>subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 suid=0 tclass=capability
>tcontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 tty=(none) uid=0
>
>
>Summary
>    SELinux is preventing /usr/sbin/exim (logwatch_t) "append" to main.log
>    (var_log_t).
>
>Detailed Description
>    SELinux is preventing /usr/sbin/exim (logwatch_t) "append" to main.log
>    (var_log_t). The SELinux type %TARGET_TYPE, is a generic type for all files
>    in the directory and very few processes (SELinux Domains) are allowed to
>    write to this SELinux type.  This type of denial usual indicates a
>    mislabeled file.  By default a file created in a directory has the gets the
>    context of the parent directory, but SELinux policy has rules about the
>    creation of directories, that say if a process running in one SELinux Domain
>    (D1) creates a file in a directory with a particular SELinux File Context
>    (F1) the file gets a different File Context (F2).  The policy usually allows
>    the SELinux Domain (D1) the ability to write or append on (F2).  But if for
>    some reason a file (main.log) was created with the wrong context, this
>    domain will be denied.  The usual solution to this problem is to reset the
>    file context on the target file, restorecon -v main.log.  If the file
>    context does not change from var_log_t, then this is probably a bug in
>    policy.  Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
>    against the selinux-policy package. If it does change, you can try your
>    application again to see if it works.  The file context could have been
>    mislabeled by editing the file or moving the file from a different
>    directory, if the file keeps getting mislabeled, check the init scripts to
>    see if they are doing something to mislabel the file.
>
>Allowing Access
>    You can attempt to fix file context by executing restorecon -v main.log
>
>    The following command will allow this access:
>    restorecon main.log
>
>Additional Information        
>
>Source Context                system_u:system_r:logwatch_t:s0-s0:c0.c1023
>Target Context                system_u:object_r:var_log_t:s0
>Target Objects                main.log [ file ]
>Affected RPM Packages         exim-4.63-6.fc7 [application]
>Policy RPM                    selinux-policy-2.5.2-5.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.mislabeled_file
>Host Name                     naboo
>Platform                      Linux naboo 2.6.20-1.2922.fc7 #1 SMP Sun Feb 4
>                              18:53:10 EST 2007 i686 athlon
>Alert Count                   8
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { append } for comm="sendmail" dev=sda3 egid=93 euid=0
>exe="/usr/sbin/exim" exit=-13 fsgid=93 fsuid=0 gid=93 items=0 name="main.log"
>pid=4053 scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 sgid=93
>subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 suid=0 tclass=file
>tcontext=system_u:object_r:var_log_t:s0 tty=(none) uid=0
>
>
>Summary
>    SELinux is preventing /usr/sbin/exim (logwatch_t) "create" to <Unknown>
>    (logwatch_t).
>
>Detailed Description
>    SELinux denied access requested by /usr/sbin/exim. It is not expected that
>    this access is required by /usr/sbin/exim and this access may signal an
>    intrusion attempt. It is also possible that the specific version or
>    configuration of the application is causing it to require additional access.
>
>Allowing Access
>    You can generate a local policy module to allow this access - see
>    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
>    SELinux protection altogether. Disabling SELinux protection is not
>    recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
>    against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:logwatch_t:s0-s0:c0.c1023
>Target Context                system_u:system_r:logwatch_t:s0-s0:c0.c1023
>Target Objects                None [ unix_dgram_socket ]
>Affected RPM Packages         exim-4.63-6.fc7 [application]
>Policy RPM                    selinux-policy-2.5.2-5.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.catchall
>Host Name                     naboo
>Platform                      Linux naboo 2.6.20-1.2922.fc7 #1 SMP Sun Feb 4
>                              18:53:10 EST 2007 i686 athlon
>Alert Count                   12
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { create } for comm="sendmail" egid=93 euid=0 exe="/usr/sbin/exim"
>exit=-13 fsgid=93 fsuid=0 gid=93 items=0 pid=4009
>scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 sgid=93
>subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 suid=0 tclass=unix_dgram_socket
>tcontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 tty=(none) uid=0
>
>
>Summary
>    SELinux prevented /usr/sbin/exim from using the terminal console.
>
>Detailed Description
>    SELinux prevented /usr/sbin/exim from using the terminal console. In most
>    cases daemons do not need to interact with the terminal, usually these avc
>    messages can be ignored.  All of the confined daemons should have dontaudit
>    rules around using the terminal.  Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this selinux-
>    policy.  If you would like to allow all daemons to interact with the
>    terminal, you can turn on the allow_daemons_use_tty boolean.
>
>Allowing Access
>    Changing the "allow_daemons_use_tty" boolean to true will allow this access:
>    "setsebool -P allow_daemons_use_tty=1."
>
>    The following command will allow this access:
>    setsebool -P allow_daemons_use_tty=1
>
>Additional Information        
>
>Source Context                system_u:system_r:logwatch_t:s0-s0:c0.c1023
>Target Context                system_u:object_r:console_device_t:s0
>Target Objects                console [ chr_file ]
>Affected RPM Packages         exim-4.63-6.fc7 [application]
>Policy RPM                    selinux-policy-2.5.2-5.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.allow_daemons_use_tty
>Host Name                     naboo
>Platform                      Linux naboo 2.6.20-1.2922.fc7 #1 SMP Sun Feb 4
>                              18:53:10 EST 2007 i686 athlon
>Alert Count                   12
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { write } for comm="sendmail" dev=tmpfs egid=93 euid=0
>exe="/usr/sbin/exim" exit=-13 fsgid=93 fsuid=0 gid=93 items=0 name="console"
>pid=4009 scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 sgid=93
>subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 suid=0 tclass=chr_file
>tcontext=system_u:object_r:console_device_t:s0 tty=(none) uid=0
>
>
>Summary
>    SELinux is preventing /usr/sbin/exim (logwatch_t) "append" to panic.log
>    (cron_log_t).
>
>Detailed Description
>    SELinux denied access requested by /usr/sbin/exim. It is not expected that
>    this access is required by /usr/sbin/exim and this access may signal an
>    intrusion attempt. It is also possible that the specific version or
>    configuration of the application is causing it to require additional access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for panic.log, restorecon -v
>    panic.log If this does not work, there is currently no automatic way to
>    allow this access. Instead,  you can generate a local policy module to allow
>    this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
>    Or you can disable SELinux protection altogether. Disabling SELinux
>    protection is not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:logwatch_t:s0-s0:c0.c1023
>Target Context                system_u:object_r:cron_log_t:s0
>Target Objects                panic.log [ file ]
>Affected RPM Packages         exim-4.63-6.fc7 [application]
>Policy RPM                    selinux-policy-2.5.2-5.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.catchall_file
>Host Name                     naboo
>Platform                      Linux naboo 2.6.20-1.2922.fc7 #1 SMP Sun Feb 4
>                              18:53:10 EST 2007 i686 athlon
>Alert Count                   6
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { append } for comm="sendmail" dev=sda3 egid=93 euid=0
>exe="/usr/sbin/exim" exit=-13 fsgid=93 fsuid=0 gid=93 items=0 name="panic.log"
>pid=4060 scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 sgid=93
>subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 suid=0 tclass=file
>tcontext=system_u:object_r:cron_log_t:s0 tty=(none) uid=0
>
>
>Summary
>    SELinux is preventing /usr/libexec/hald-generate-fdi-cache (hald_t) "write"
>    access to hald (var_t).
>
>Detailed Description
>    SELinux denied access requested by /usr/libexec/hald-generate-fdi-cache. It
>    is not expected that this access is required by /usr/libexec/hald-generate-
>    fdi-cache and this access may signal an intrusion attempt. It is also
>    possible that the specific version or configuration of the application is
>    causing it to require additional access. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for hald, restorecon -v hald. There
>    is currently no automatic way to allow this access. Instead, you can
>    generate a local policy module to allow this access - see
>    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 - or you can
>    disable SELinux protection entirely for the application. Disabling SELinux
>    protection is not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>    Changing the "hald_disable_trans" boolean to true will disable SELinux
>    protection this application: "setsebool -P hald_disable_trans=1."
>
>    The following command will allow this access:
>    setsebool -P hald_disable_trans=1
>
>Additional Information        
>
>Source Context                system_u:system_r:hald_t:s0
>Target Context                system_u:object_r:var_t:s0
>Target Objects                hald [ dir ]
>Affected RPM Packages         hal-0.5.9-0.git20070206.1.fc7 [application]
>Policy RPM                    selinux-policy-2.5.2-5.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.disable_trans
>Host Name                     naboo
>Platform                      Linux naboo 2.6.20-1.2922.fc7 #1 SMP Sun Feb 4
>                              18:53:10 EST 2007 i686 athlon
>Alert Count                   1
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { write } for comm="hald-generate-f" dev=sda3 egid=0 euid=0
>exe="/usr/libexec/hald-generate-fdi-cache" exit=-13 fsgid=0 fsuid=0 gid=0
>items=0 name="hald" pid=2063 scontext=system_u:system_r:hald_t:s0 sgid=0
>subj=system_u:system_r:hald_t:s0 suid=0 tclass=dir
>tcontext=system_u:object_r:var_t:s0 tty=(none) uid=0
>
>
>Summary
>    SELinux is preventing /usr/sbin/exim (logwatch_t) "setuid" to <Unknown>
>    (logwatch_t).
>
>Detailed Description
>    SELinux denied access requested by /usr/sbin/exim. It is not expected that
>    this access is required by /usr/sbin/exim and this access may signal an
>    intrusion attempt. It is also possible that the specific version or
>    configuration of the application is causing it to require additional access.
>
>Allowing Access
>    You can generate a local policy module to allow this access - see
>    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
>    SELinux protection altogether. Disabling SELinux protection is not
>    recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
>    against this package.
>
>Additional Information        
>
>Source Context                user_u:system_r:logwatch_t:s0-s0:c0.c1023
>Target Context                user_u:system_r:logwatch_t:s0-s0:c0.c1023
>Target Objects                None [ capability ]
>Affected RPM Packages         exim-4.63-6.fc7 [application]
>Policy RPM                    selinux-policy-2.5.2-5.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.catchall
>Host Name                     naboo
>Platform                      Linux naboo 2.6.20-1.2922.fc7 #1 SMP Sun Feb 4
>                              18:53:10 EST 2007 i686 athlon
>Alert Count                   5
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { setuid } for comm="sendmail" egid=93 euid=0 exe="/usr/sbin/exim"
>exit=-1 fsgid=93 fsuid=0 gid=93 items=0 pid=12791
>scontext=user_u:system_r:logwatch_t:s0-s0:c0.c1023 sgid=93
>subj=user_u:system_r:logwatch_t:s0-s0:c0.c1023 suid=0 tclass=capability
>tcontext=user_u:system_r:logwatch_t:s0-s0:c0.c1023 tty=(none) uid=0
>
>
>Summary
>    SELinux is preventing /usr/sbin/exim (logwatch_t) "append" to main.log
>    (var_log_t).
>
>Detailed Description
>    SELinux is preventing /usr/sbin/exim (logwatch_t) "append" to main.log
>    (var_log_t). The SELinux type %TARGET_TYPE, is a generic type for all files
>    in the directory and very few processes (SELinux Domains) are allowed to
>    write to this SELinux type.  This type of denial usual indicates a
>    mislabeled file.  By default a file created in a directory has the gets the
>    context of the parent directory, but SELinux policy has rules about the
>    creation of directories, that say if a process running in one SELinux Domain
>    (D1) creates a file in a directory with a particular SELinux File Context
>    (F1) the file gets a different File Context (F2).  The policy usually allows
>    the SELinux Domain (D1) the ability to write or append on (F2).  But if for
>    some reason a file (main.log) was created with the wrong context, this
>    domain will be denied.  The usual solution to this problem is to reset the
>    file context on the target file, restorecon -v main.log.  If the file
>    context does not change from var_log_t, then this is probably a bug in
>    policy.  Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
>    against the selinux-policy package. If it does change, you can try your
>    application again to see if it works.  The file context could have been
>    mislabeled by editing the file or moving the file from a different
>    directory, if the file keeps getting mislabeled, check the init scripts to
>    see if they are doing something to mislabel the file.
>
>Allowing Access
>    You can attempt to fix file context by executing restorecon -v main.log
>
>    The following command will allow this access:
>    restorecon main.log
>
>Additional Information        
>
>Source Context                user_u:system_r:logwatch_t:s0-s0:c0.c1023
>Target Context                system_u:object_r:var_log_t:s0
>Target Objects                main.log [ file ]
>Affected RPM Packages         exim-4.63-6.fc7 [application]
>Policy RPM                    selinux-policy-2.5.2-5.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.mislabeled_file
>Host Name                     naboo
>Platform                      Linux naboo 2.6.20-1.2922.fc7 #1 SMP Sun Feb 4
>                              18:53:10 EST 2007 i686 athlon
>Alert Count                   2
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { append } for comm="sendmail" dev=sda3 egid=93 euid=0
>exe="/usr/sbin/exim" exit=-13 fsgid=93 fsuid=0 gid=93 items=0 name="main.log"
>pid=12790 scontext=user_u:system_r:logwatch_t:s0-s0:c0.c1023 sgid=93
>subj=user_u:system_r:logwatch_t:s0-s0:c0.c1023 suid=0 tclass=file
>tcontext=system_u:object_r:var_log_t:s0 tty=(none) uid=0
>
>
>Summary
>    SELinux is preventing /usr/sbin/exim (logwatch_t) "append" to panic.log
>    (cron_log_t).
>
>Detailed Description
>    SELinux denied access requested by /usr/sbin/exim. It is not expected that
>    this access is required by /usr/sbin/exim and this access may signal an
>    intrusion attempt. It is also possible that the specific version or
>    configuration of the application is causing it to require additional access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for panic.log, restorecon -v
>    panic.log If this does not work, there is currently no automatic way to
>    allow this access. Instead,  you can generate a local policy module to allow
>    this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
>    Or you can disable SELinux protection altogether. Disabling SELinux
>    protection is not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Additional Information        
>
>Source Context                user_u:system_r:logwatch_t:s0-s0:c0.c1023
>Target Context                system_u:object_r:cron_log_t:s0
>Target Objects                panic.log [ file ]
>Affected RPM Packages         exim-4.63-6.fc7 [application]
>Policy RPM                    selinux-policy-2.5.2-5.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.catchall_file
>Host Name                     naboo
>Platform                      Linux naboo 2.6.20-1.2922.fc7 #1 SMP Sun Feb 4
>                              18:53:10 EST 2007 i686 athlon
>Alert Count                   2
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { append } for comm="sendmail" dev=sda3 egid=93 euid=0
>exe="/usr/sbin/exim" exit=-13 fsgid=93 fsuid=0 gid=93 items=0 name="panic.log"
>pid=12791 scontext=user_u:system_r:logwatch_t:s0-s0:c0.c1023 sgid=93
>subj=user_u:system_r:logwatch_t:s0-s0:c0.c1023 suid=0 tclass=file
>tcontext=system_u:object_r:cron_log_t:s0 tty=(none) uid=0
>
>
>Summary
>    SELinux is preventing /usr/sbin/exim (logwatch_t) "create" to <Unknown>
>    (logwatch_t).
>
>Detailed Description
>    SELinux denied access requested by /usr/sbin/exim. It is not expected that
>    this access is required by /usr/sbin/exim and this access may signal an
>    intrusion attempt. It is also possible that the specific version or
>    configuration of the application is causing it to require additional access.
>
>Allowing Access
>    You can generate a local policy module to allow this access - see
>    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
>    SELinux protection altogether. Disabling SELinux protection is not
>    recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
>    against this package.
>
>Additional Information        
>
>Source Context                user_u:system_r:logwatch_t:s0-s0:c0.c1023
>Target Context                user_u:system_r:logwatch_t:s0-s0:c0.c1023
>Target Objects                None [ unix_dgram_socket ]
>Affected RPM Packages         exim-4.63-6.fc7 [application]
>Policy RPM                    selinux-policy-2.5.2-5.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.catchall
>Host Name                     naboo
>Platform                      Linux naboo 2.6.20-1.2922.fc7 #1 SMP Sun Feb 4
>                              18:53:10 EST 2007 i686 athlon
>Alert Count                   3
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { create } for comm="sendmail" egid=93 euid=0 exe="/usr/sbin/exim"
>exit=-13 fsgid=93 fsuid=0 gid=93 items=0 pid=12699
>scontext=user_u:system_r:logwatch_t:s0-s0:c0.c1023 sgid=93
>subj=user_u:system_r:logwatch_t:s0-s0:c0.c1023 suid=0 tclass=unix_dgram_socket
>tcontext=user_u:system_r:logwatch_t:s0-s0:c0.c1023 tty=(none) uid=0
>
>
>Summary
>    SELinux prevented /usr/sbin/exim from using the terminal console.
>
>Detailed Description
>    SELinux prevented /usr/sbin/exim from using the terminal console. In most
>    cases daemons do not need to interact with the terminal, usually these avc
>    messages can be ignored.  All of the confined daemons should have dontaudit
>    rules around using the terminal.  Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this selinux-
>    policy.  If you would like to allow all daemons to interact with the
>    terminal, you can turn on the allow_daemons_use_tty boolean.
>
>Allowing Access
>    Changing the "allow_daemons_use_tty" boolean to true will allow this access:
>    "setsebool -P allow_daemons_use_tty=1."
>
>    The following command will allow this access:
>    setsebool -P allow_daemons_use_tty=1
>
>Additional Information        
>
>Source Context                user_u:system_r:logwatch_t:s0-s0:c0.c1023
>Target Context                system_u:object_r:console_device_t:s0
>Target Objects                console [ chr_file ]
>Affected RPM Packages         exim-4.63-6.fc7 [application]
>Policy RPM                    selinux-policy-2.5.2-5.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.allow_daemons_use_tty
>Host Name                     naboo
>Platform                      Linux naboo 2.6.20-1.2922.fc7 #1 SMP Sun Feb 4
>                              18:53:10 EST 2007 i686 athlon
>Alert Count                   3
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { write } for comm="sendmail" dev=tmpfs egid=93 euid=0
>exe="/usr/sbin/exim" exit=-13 fsgid=93 fsuid=0 gid=93 items=0 name="console"
>pid=12699 scontext=user_u:system_r:logwatch_t:s0-s0:c0.c1023 sgid=93
>subj=user_u:system_r:logwatch_t:s0-s0:c0.c1023 suid=0 tclass=chr_file
>tcontext=system_u:object_r:console_device_t:s0 tty=(none) uid=0
>
>
>Summary
>    SELinux is preventing /usr/sbin/exim (logwatch_t) "write" to exim
>    (var_log_t).
>
>Detailed Description
>    SELinux is preventing /usr/sbin/exim (logwatch_t) "write" to exim
>    (var_log_t). The SELinux type %TARGET_TYPE, is a generic type for all files
>    in the directory and very few processes (SELinux Domains) are allowed to
>    write to this SELinux type.  This type of denial usual indicates a
>    mislabeled file.  By default a file created in a directory has the gets the
>    context of the parent directory, but SELinux policy has rules about the
>    creation of directories, that say if a process running in one SELinux Domain
>    (D1) creates a file in a directory with a particular SELinux File Context
>    (F1) the file gets a different File Context (F2).  The policy usually allows
>    the SELinux Domain (D1) the ability to write or append on (F2).  But if for
>    some reason a file (exim) was created with the wrong context, this domain
>    will be denied.  The usual solution to this problem is to reset the file
>    context on the target file, restorecon -v exim.  If the file context does
>    not change from var_log_t, then this is probably a bug in policy.  Please
>    file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against the
>    selinux-policy package. If it does change, you can try your application
>    again to see if it works.  The file context could have been mislabeled by
>    editing the file or moving the file from a different directory, if the file
>    keeps getting mislabeled, check the init scripts to see if they are doing
>    something to mislabel the file.
>
>Allowing Access
>    You can attempt to fix file context by executing restorecon -v exim
>
>    The following command will allow this access:
>    restorecon exim
>
>Additional Information        
>
>Source Context                system_u:system_r:logwatch_t:s0-s0:c0.c1023
>Target Context                system_u:object_r:var_log_t:s0
>Target Objects                exim [ dir ]
>Affected RPM Packages         exim-4.63-6.fc7 [application]
>Policy RPM                    selinux-policy-2.5.2-2.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.mislabeled_file
>Host Name                     localhost
>Platform                      Linux localhost 2.6.19-1.2914.fc7 #1 SMP Fri Jan
>                              26 18:42:25 EST 2007 i686 athlon
>Alert Count                   1
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { write } for comm="sendmail" dev=sda3 egid=93 euid=0
>exe="/usr/sbin/exim" exit=-13 fsgid=93 fsuid=0 gid=93 items=0 name="exim"
>pid=4643 scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 sgid=93
>subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 suid=0 tclass=dir
>tcontext=system_u:object_r:var_log_t:s0 tty=(none) uid=0
>
>

Actions: View

Attachments on bug 227896: 147697 | 147847