Attachment 161868 Details for Bug 253526 – Log of SELinux Alerts

Log of SELinux Alerts

dhcp-ntpd-SELinux-Interaction.txt (text/plain), 21.41 KB, created by The Hermit on 2007-08-20 12:47:32 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: The Hermit

Created: 2007-08-20 12:47:32 UTC

Size: 21.41 KB

patch

obsolete

>Summary
>    SELinux is preventing ntpd (dhcpc_t) "getattr" to /var/run/ntpd.pid
>    (ntpd_var_run_t).
>
>Detailed Description
>    SELinux denied access requested by ntpd. It is not expected that this access
>    is required by ntpd and this access may signal an intrusion attempt. It is
>    also possible that the specific version or configuration of the application
>    is causing it to require additional access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for /var/run/ntpd.pid, restorecon -v
>    /var/run/ntpd.pid If this does not work, there is currently no automatic way
>    to allow this access. Instead,  you can generate a local policy module to
>    allow this access - see http://fedora.redhat.com/docs/selinux-faq-
>    fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling
>    SELinux protection is not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:dhcpc_t
>Target Context                system_u:object_r:ntpd_var_run_t
>Target Objects                /var/run/ntpd.pid [ file ]
>Affected RPM Packages         
>Policy RPM                    selinux-policy-2.6.4-33.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.catchall_file
>Host Name                     localhost.localdomain
>Platform                      Linux localhost.localdomain 2.6.22.1-41.fc7 #1 SMP
>                              Fri Jul 27 18:10:34 EDT 2007 i686 i686
>Alert Count                   5
>First Seen                    Sat 18 Aug 2007 07:24:21 PM CDT
>Last Seen                     Sun 19 Aug 2007 10:18:19 PM CDT
>Local ID                      fa2fc2fb-1a13-4029-8ee5-99f99a1dd90d
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { getattr } for comm="ntpd" dev=sda2 egid=0 euid=0 exe="/bin/bash"
>exit=0 fsgid=0 fsuid=0 gid=0 items=0 name="ntpd.pid" path="/var/run/ntpd.pid"
>pid=3999 scontext=system_u:system_r:dhcpc_t:s0 sgid=0
>subj=system_u:system_r:dhcpc_t:s0 suid=0 tclass=file
>tcontext=system_u:object_r:ntpd_var_run_t:s0 tty=(none) uid=0
>
>==================================================================================
>
>Summary
>    SELinux is preventing ntpd (dhcpc_t) "getattr" to /var/lock/subsys/ntpd
>    (var_lock_t).
>
>Detailed Description
>    SELinux denied access requested by ntpd. It is not expected that this access
>    is required by ntpd and this access may signal an intrusion attempt. It is
>    also possible that the specific version or configuration of the application
>    is causing it to require additional access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for /var/lock/subsys/ntpd,
>    restorecon -v /var/lock/subsys/ntpd If this does not work, there is
>    currently no automatic way to allow this access. Instead,  you can generate
>    a local policy module to allow this access - see
>    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
>    SELinux protection altogether. Disabling SELinux protection is not
>    recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
>    against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:dhcpc_t
>Target Context                system_u:object_r:var_lock_t
>Target Objects                /var/lock/subsys/ntpd [ file ]
>Affected RPM Packages         
>Policy RPM                    selinux-policy-2.6.4-33.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.catchall_file
>Host Name                     localhost.localdomain
>Platform                      Linux localhost.localdomain 2.6.22.1-41.fc7 #1 SMP
>                              Fri Jul 27 18:10:34 EDT 2007 i686 i686
>Alert Count                   5
>First Seen                    Sat 18 Aug 2007 07:24:21 PM CDT
>Last Seen                     Sun 19 Aug 2007 10:18:19 PM CDT
>Local ID                      131d7d8f-1a9a-4b8f-a32e-d24bc7453fd0
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { getattr } for comm="ntpd" dev=sda2 egid=0 euid=0 exe="/bin/bash"
>exit=0 fsgid=0 fsuid=0 gid=0 items=0 name="ntpd" path="/var/lock/subsys/ntpd"
>pid=3999 scontext=system_u:system_r:dhcpc_t:s0 sgid=0
>subj=system_u:system_r:dhcpc_t:s0 suid=0 tclass=file
>tcontext=system_u:object_r:var_lock_t:s0 tty=(none) uid=0
>
>==================================================================================
>
>Summary
>    SELinux is preventing ntpd (dhcpc_t) "ioctl" to /var/run/ntpd.pid
>    (ntpd_var_run_t).
>
>Detailed Description
>    SELinux denied access requested by ntpd. It is not expected that this access
>    is required by ntpd and this access may signal an intrusion attempt. It is
>    also possible that the specific version or configuration of the application
>    is causing it to require additional access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for /var/run/ntpd.pid, restorecon -v
>    /var/run/ntpd.pid If this does not work, there is currently no automatic way
>    to allow this access. Instead,  you can generate a local policy module to
>    allow this access - see http://fedora.redhat.com/docs/selinux-faq-
>    fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling
>    SELinux protection is not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:dhcpc_t
>Target Context                system_u:object_r:ntpd_var_run_t
>Target Objects                /var/run/ntpd.pid [ file ]
>Affected RPM Packages         
>Policy RPM                    selinux-policy-2.6.4-33.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.catchall_file
>Host Name                     localhost.localdomain
>Platform                      Linux localhost.localdomain 2.6.22.1-41.fc7 #1 SMP
>                              Fri Jul 27 18:10:34 EDT 2007 i686 i686
>Alert Count                   5
>First Seen                    Sat 18 Aug 2007 07:24:21 PM CDT
>Last Seen                     Sun 19 Aug 2007 10:18:19 PM CDT
>Local ID                      d927af65-61b7-4e2e-89e1-3874bf6de888
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { ioctl } for comm="ntpd" dev=sda2 egid=0 euid=0 exe="/bin/bash"
>exit=-25 fsgid=0 fsuid=0 gid=0 items=0 name="ntpd.pid" path="/var/run/ntpd.pid"
>pid=3999 scontext=system_u:system_r:dhcpc_t:s0 sgid=0
>subj=system_u:system_r:dhcpc_t:s0 suid=0 tclass=file
>tcontext=system_u:object_r:ntpd_var_run_t:s0 tty=(none) uid=0
>
>==================================================================================
>
>Summary
>    SELinux is preventing ntpd (dhcpc_t) "read" to ntpd.pid (ntpd_var_run_t).
>
>Detailed Description
>    SELinux denied access requested by ntpd. It is not expected that this access
>    is required by ntpd and this access may signal an intrusion attempt. It is
>    also possible that the specific version or configuration of the application
>    is causing it to require additional access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for ntpd.pid, restorecon -v ntpd.pid
>    If this does not work, there is currently no automatic way to allow this
>    access. Instead,  you can generate a local policy module to allow this
>    access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you
>    can disable SELinux protection altogether. Disabling SELinux protection is
>    not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:dhcpc_t
>Target Context                system_u:object_r:ntpd_var_run_t
>Target Objects                ntpd.pid [ file ]
>Affected RPM Packages         
>Policy RPM                    selinux-policy-2.6.4-33.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.catchall_file
>Host Name                     localhost.localdomain
>Platform                      Linux localhost.localdomain 2.6.22.1-41.fc7 #1 SMP
>                              Fri Jul 27 18:10:34 EDT 2007 i686 i686
>Alert Count                   5
>First Seen                    Sat 18 Aug 2007 07:24:21 PM CDT
>Last Seen                     Sun 19 Aug 2007 10:18:19 PM CDT
>Local ID                      ea296254-aeb1-4d74-98d8-f5f1b2aa63a1
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { read } for comm="ntpd" dev=sda2 egid=0 euid=0 exe="/bin/bash"
>exit=3 fsgid=0 fsuid=0 gid=0 items=0 name="ntpd.pid" pid=3999
>scontext=system_u:system_r:dhcpc_t:s0 sgid=0 subj=system_u:system_r:dhcpc_t:s0
>suid=0 tclass=file tcontext=system_u:object_r:ntpd_var_run_t:s0 tty=(none) uid=0
>
>==================================================================================
>
>Summary
>    SELinux is preventing /bin/rm (dhcpc_t) "unlink" to ntpd.pid
>    (ntpd_var_run_t).
>
>Detailed Description
>    SELinux denied access requested by /bin/rm. It is not expected that this
>    access is required by /bin/rm and this access may signal an intrusion
>    attempt. It is also possible that the specific version or configuration of
>    the application is causing it to require additional access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for ntpd.pid, restorecon -v ntpd.pid
>    If this does not work, there is currently no automatic way to allow this
>    access. Instead,  you can generate a local policy module to allow this
>    access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you
>    can disable SELinux protection altogether. Disabling SELinux protection is
>    not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:dhcpc_t
>Target Context                system_u:object_r:ntpd_var_run_t
>Target Objects                ntpd.pid [ file ]
>Affected RPM Packages         coreutils-6.9-3.fc7 [application]
>Policy RPM                    selinux-policy-2.6.4-33.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.catchall_file
>Host Name                     localhost.localdomain
>Platform                      Linux localhost.localdomain 2.6.22.1-41.fc7 #1 SMP
>                              Fri Jul 27 18:10:34 EDT 2007 i686 i686
>Alert Count                   5
>First Seen                    Sat 18 Aug 2007 07:24:21 PM CDT
>Last Seen                     Sun 19 Aug 2007 10:18:19 PM CDT
>Local ID                      0c2d9672-0ae6-45db-ae17-1c3bbd3ca484
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { unlink } for comm="rm" dev=sda2 egid=0 euid=0 exe="/bin/rm" exit=0
>fsgid=0 fsuid=0 gid=0 items=0 name="ntpd.pid" pid=4005
>scontext=system_u:system_r:dhcpc_t:s0 sgid=0 subj=system_u:system_r:dhcpc_t:s0
>suid=0 tclass=file tcontext=system_u:object_r:ntpd_var_run_t:s0 tty=(none) uid=0
>
>==================================================================================
>
>Summary
>    SELinux is preventing ntpd (dhcpc_t) "signal" to <Unknown> (ntpd_t).
>
>Detailed Description
>    SELinux denied access requested by ntpd. It is not expected that this access
>    is required by ntpd and this access may signal an intrusion attempt. It is
>    also possible that the specific version or configuration of the application
>    is causing it to require additional access.
>
>Allowing Access
>    You can generate a local policy module to allow this access - see
>    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
>    SELinux protection altogether. Disabling SELinux protection is not
>    recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
>    against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:dhcpc_t
>Target Context                system_u:system_r:ntpd_t
>Target Objects                None [ process ]
>Affected RPM Packages         
>Policy RPM                    selinux-policy-2.6.4-33.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.catchall
>Host Name                     localhost.localdomain
>Platform                      Linux localhost.localdomain 2.6.22.1-41.fc7 #1 SMP
>                              Fri Jul 27 18:10:34 EDT 2007 i686 i686
>Alert Count                   5
>First Seen                    Sat 18 Aug 2007 07:24:21 PM CDT
>Last Seen                     Sun 19 Aug 2007 10:18:19 PM CDT
>Local ID                      72b9e5f7-0a56-4da8-a83f-790bfaa1e6e3
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { signal } for comm="ntpd" egid=0 euid=0 exe="/bin/bash" exit=0
>fsgid=0 fsuid=0 gid=0 items=0 pid=3999 scontext=system_u:system_r:dhcpc_t:s0
>sgid=0 subj=system_u:system_r:dhcpc_t:s0 suid=0 tclass=process
>tcontext=system_u:system_r:ntpd_t:s0 tty=(none) uid=0
>
>==================================================================================
>
>Summary
>    SELinux is preventing /bin/rm (dhcpc_t) "unlink" to ntpd (var_lock_t).
>
>Detailed Description
>    SELinux denied access requested by /bin/rm. It is not expected that this
>    access is required by /bin/rm and this access may signal an intrusion
>    attempt. It is also possible that the specific version or configuration of
>    the application is causing it to require additional access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for ntpd, restorecon -v ntpd If this
>    does not work, there is currently no automatic way to allow this access.
>    Instead,  you can generate a local policy module to allow this access - see
>    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
>    SELinux protection altogether. Disabling SELinux protection is not
>    recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
>    against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:dhcpc_t
>Target Context                system_u:object_r:var_lock_t
>Target Objects                ntpd [ file ]
>Affected RPM Packages         coreutils-6.9-3.fc7 [application]
>Policy RPM                    selinux-policy-2.6.4-33.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.catchall_file
>Host Name                     localhost.localdomain
>Platform                      Linux localhost.localdomain 2.6.22.1-41.fc7 #1 SMP
>                              Fri Jul 27 18:10:34 EDT 2007 i686 i686
>Alert Count                   5
>First Seen                    Sat 18 Aug 2007 07:24:21 PM CDT
>Last Seen                     Sun 19 Aug 2007 10:18:19 PM CDT
>Local ID                      f4f534af-c0f0-40c8-8a5f-142a4b97fb42
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { unlink } for comm="rm" dev=sda2 egid=0 euid=0 exe="/bin/rm" exit=0
>fsgid=0 fsuid=0 gid=0 items=0 name="ntpd" pid=4006
>scontext=system_u:system_r:dhcpc_t:s0 sgid=0 subj=system_u:system_r:dhcpc_t:s0
>suid=0 tclass=file tcontext=system_u:object_r:var_lock_t:s0 tty=(none) uid=0
>
>==================================================================================
>
>Summary
>    SELinux is preventing /bin/touch (dhcpc_t) "write" to ntpd (var_lock_t).
>
>Detailed Description
>    SELinux is preventing /bin/touch (dhcpc_t) "write" to ntpd (var_lock_t). The
>    SELinux type %TARGET_TYPE, is a generic type for all files in the directory
>    and very few processes (SELinux Domains) are allowed to write to this
>    SELinux type.  This type of denial usual indicates a mislabeled file.  By
>    default a file created in a directory has the gets the context of the parent
>    directory, but SELinux policy has rules about the creation of directories,
>    that say if a process running in one SELinux Domain (D1) creates a file in a
>    directory with a particular SELinux File Context (F1) the file gets a
>    different File Context (F2).  The policy usually allows the SELinux Domain
>    (D1) the ability to write or append on (F2).  But if for some reason a file
>    (ntpd) was created with the wrong context, this domain will be denied.  The
>    usual solution to this problem is to reset the file context on the target
>    file, restorecon -v ntpd.  If the file context does not change from
>    var_lock_t, then this is probably a bug in policy.  Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against the selinux-policy
>    package. If it does change, you can try your application again to see if it
>    works.  The file context could have been mislabeled by editing the file or
>    moving the file from a different directory, if the file keeps getting
>    mislabeled, check the init scripts to see if they are doing something to
>    mislabel the file.
>
>Allowing Access
>    You can attempt to fix file context by executing restorecon -v ntpd
>
>    The following command will allow this access:
>    restorecon ntpd
>
>Additional Information        
>
>Source Context                system_u:system_r:dhcpc_t
>Target Context                system_u:object_r:var_lock_t
>Target Objects                ntpd [ file ]
>Affected RPM Packages         coreutils-6.9-3.fc7 [application]
>Policy RPM                    selinux-policy-2.6.4-33.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.mislabeled_file
>Host Name                     localhost.localdomain
>Platform                      Linux localhost.localdomain 2.6.22.1-41.fc7 #1 SMP
>                              Fri Jul 27 18:10:34 EDT 2007 i686 i686
>Alert Count                   5
>First Seen                    Sat 18 Aug 2007 07:24:22 PM CDT
>Last Seen                     Sun 19 Aug 2007 10:18:19 PM CDT
>Local ID                      93e95675-6892-477e-b64e-d51169ecceee
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { write } for comm="touch" dev=sda2 egid=0 euid=0 exe="/bin/touch"
>exit=0 fsgid=0 fsuid=0 gid=0 items=0 name="ntpd" pid=4013
>scontext=system_u:system_r:dhcpc_t:s0 sgid=0 subj=system_u:system_r:dhcpc_t:s0
>suid=0 tclass=file tcontext=system_u:object_r:var_lock_t:s0 tty=(none) uid=0
>
>==================================================================================
>
>Summary
>    SELinux is preventing /bin/touch (dhcpc_t) "create" to ntpd (var_lock_t).
>
>Detailed Description
>    SELinux denied access requested by /bin/touch. It is not expected that this
>    access is required by /bin/touch and this access may signal an intrusion
>    attempt. It is also possible that the specific version or configuration of
>    the application is causing it to require additional access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for ntpd, restorecon -v ntpd If this
>    does not work, there is currently no automatic way to allow this access.
>    Instead,  you can generate a local policy module to allow this access - see
>    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
>    SELinux protection altogether. Disabling SELinux protection is not
>    recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
>    against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:dhcpc_t
>Target Context                system_u:object_r:var_lock_t
>Target Objects                ntpd [ file ]
>Affected RPM Packages         coreutils-6.9-3.fc7 [application]
>Policy RPM                    selinux-policy-2.6.4-33.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.catchall_file
>Host Name                     localhost.localdomain
>Platform                      Linux localhost.localdomain 2.6.22.1-41.fc7 #1 SMP
>                              Fri Jul 27 18:10:34 EDT 2007 i686 i686
>Alert Count                   5
>First Seen                    Sat 18 Aug 2007 07:24:22 PM CDT
>Last Seen                     Sun 19 Aug 2007 10:18:19 PM CDT
>Local ID                      9ff357c8-b8b1-49c0-8212-f350d3df5e3a
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { create } for comm="touch" egid=0 euid=0 exe="/bin/touch" exit=0
>fsgid=0 fsuid=0 gid=0 items=0 name="ntpd" pid=4013
>scontext=system_u:system_r:dhcpc_t:s0 sgid=0 subj=system_u:system_r:dhcpc_t:s0
>suid=0 tclass=file tcontext=system_u:object_r:var_lock_t:s0 tty=(none) uid=0
>
>
>
>
>
>
>
>
>

Actions: View

Attachments on bug 253526: 161868