Attachment 159854 Details for Bug 249161 – /var/log/messages, sealert output

/var/log/messages, sealert output

buglog (text/plain), 3.98 KB, created by Mark Knoop on 2007-07-24 15:01:02 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mark Knoop

Created: 2007-07-24 15:01:02 UTC

Size: 3.98 KB

patch

obsolete

>[ /var/log/messages ]
>Jul 24 15:24:11 localhost kernel: usb 6-4: new high speed USB device using ehci_hcd and address 4
>Jul 24 15:24:12 localhost kernel: usb 6-4: configuration #1 chosen from 1 choice
>Jul 24 15:24:12 localhost kernel: scsi9 : SCSI emulation for USB Mass Storage devices
>Jul 24 15:24:14 localhost setroubleshoot:      SELinux is preventing pam_console_app (pam_console_t) "getattr" to / (fs_t).      For complete SELinux messages. run sealert -l aa7e50be-2074-4373-a95b-dc72a06c9982
>Jul 24 15:24:17 localhost kernel: scsi 9:0:0:0: Direct-Access     Generic  STORAGE DEVICE   9144 PQ: 0 ANSI: 0
>Jul 24 15:24:17 localhost kernel: sd 9:0:0:0: [sdh] 494080 512-byte hardware sectors (253 MB)
>Jul 24 15:24:17 localhost kernel: sd 9:0:0:0: [sdh] Write Protect is off
>Jul 24 15:24:17 localhost kernel: sd 9:0:0:0: [sdh] Assuming drive cache: write through
>Jul 24 15:24:17 localhost kernel: sd 9:0:0:0: [sdh] 494080 512-byte hardware sectors (253 MB)
>Jul 24 15:24:17 localhost kernel: sd 9:0:0:0: [sdh] Write Protect is off
>Jul 24 15:24:17 localhost kernel: sd 9:0:0:0: [sdh] Assuming drive cache: write through
>Jul 24 15:24:17 localhost kernel:  sdh: sdh1
>Jul 24 15:24:17 localhost kernel: sd 9:0:0:0: [sdh] Attached SCSI removable disk
>Jul 24 15:24:17 localhost kernel: sd 9:0:0:0: Attached scsi generic sg8 type 0
>Jul 24 15:46:48 localhost kernel: usb 6-4: USB disconnect, address 4
>
>Jul 24 15:47:03 localhost kernel: sd 2:0:0:2: [sdf] 494080 512-byte hardware sectors (253 MB)
>Jul 24 15:47:03 localhost kernel: sd 2:0:0:2: [sdf] Write Protect is off
>Jul 24 15:47:03 localhost kernel: sd 2:0:0:2: [sdf] Assuming drive cache: write through
>Jul 24 15:47:03 localhost kernel: sd 2:0:0:2: [sdf] 494080 512-byte hardware sectors (253 MB)
>Jul 24 15:47:03 localhost kernel: sd 2:0:0:2: [sdf] Write Protect is off
>Jul 24 15:47:03 localhost kernel: sd 2:0:0:2: [sdf] Assuming drive cache: write through
>Jul 24 15:47:03 localhost kernel:  sdf: sdf1
>Jul 24 15:47:04 localhost hald: mounted /dev/sdf1 on behalf of uid 500
>
>
># sealert -l aa7e50be-2074-4373-a95b-dc72a06c9982
>Summary
>    SELinux is preventing pam_console_app (pam_console_t) "getattr" to / (fs_t).
>
>Detailed Description
>    SELinux denied access requested by pam_console_app. It is not expected that
>    this access is required by pam_console_app and this access may signal an
>    intrusion attempt. It is also possible that the specific version or
>    configuration of the application is causing it to require additional access.
>
>Allowing Access
>    You can generate a local policy module to allow this access - see
>    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
>    SELinux protection altogether. Disabling SELinux protection is not
>    recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
>    against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:pam_console_t:SystemLow-
>                              SystemHigh
>Target Context                system_u:object_r:fs_t
>Target Objects                / [ filesystem ]
>Affected RPM Packages         filesystem-2.4.6-1.fc7 [target]
>Policy RPM                    selinux-policy-2.6.4-28.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.catchall
>Host Name                     localhost.localdomain
>Platform                      Linux localhost.localdomain 2.6.22.1-27.fc7PAE #1 SMP Tue
>                              Jul 17 17:02:09 EDT 2007 i686 i686
>Alert Count                   13
>First Seen                    Wed Mar 21 19:58:54 2007
>Last Seen                     Tue Jul 24 15:24:12 2007
>Local ID                      aa7e50be-2074-4373-a95b-dc72a06c9982
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { getattr } for comm="pam_console_app" dev=dm-2 name="/" pid=10086
>scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tclass=filesystem
>tcontext=system_u:object_r:fs_t:s0
>

Actions: View

Attachments on bug 249161: 159854