Attachment 236381 Details for Bug 350711 – first selinux alert

first selinux alert

selinux_alert1.txt (text/plain), 2.96 KB, created by Jason Merrill on 2007-10-24 16:49:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jason Merrill

Created: 2007-10-24 16:49:49 UTC

Size: 2.96 KB

patch

obsolete

>Summary
>    SELinux is preventing 20video (hald_t) "write" to vbemode (var_run_t).
>
>Detailed Description
>    SELinux is preventing 20video (hald_t) "write" to vbemode (var_run_t). The
>    SELinux type %TARGET_TYPE, is a generic type for all files in the directory
>    and very few processes (SELinux Domains) are allowed to write to this
>    SELinux type.  This type of denial usual indicates a mislabeled file.  By
>    default a file created in a directory has the gets the context of the parent
>    directory, but SELinux policy has rules about the creation of directories,
>    that say if a process running in one SELinux Domain (D1) creates a file in a
>    directory with a particular SELinux File Context (F1) the file gets a
>    different File Context (F2).  The policy usually allows the SELinux Domain
>    (D1) the ability to write or append on (F2).  But if for some reason a file
>    (vbemode) was created with the wrong context, this domain will be denied.
>    The usual solution to this problem is to reset the file context on the
>    target file, restorecon -v vbemode.  If the file context does not change
>    from var_run_t, then this is probably a bug in policy.  Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against the selinux-policy
>    package. If it does change, you can try your application again to see if it
>    works.  The file context could have been mislabeled by editing the file or
>    moving the file from a different directory, if the file keeps getting
>    mislabeled, check the init scripts to see if they are doing something to
>    mislabel the file.
>
>Allowing Access
>    You can attempt to fix file context by executing restorecon -v vbemode
>
>    The following command will allow this access:
>    restorecon vbemode
>
>Additional Information        
>
>Source Context                system_u:system_r:hald_t
>Target Context                system_u:object_r:var_run_t
>Target Objects                vbemode [ file ]
>Affected RPM Packages         
>Policy RPM                    selinux-policy-2.6.4-48.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.mislabeled_file
>Host Name                     caliban.home
>Platform                      Linux caliban.home 2.6.22.9-91.fc7 #1 SMP Thu Sep
>                              27 23:10:59 EDT 2007 i686 i686
>Alert Count                   18
>First Seen                    Sun 21 Oct 2007 08:18:19 AM EDT
>Last Seen                     Wed 24 Oct 2007 08:49:48 AM EDT
>Local ID                      831b0fe0-e9d6-4848-b790-21dd91567ffb
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { write } for comm="20video" dev=dm-0 egid=0 euid=0 exe="/bin/bash"
>exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name="vbemode" pid=31834
>scontext=system_u:system_r:hald_t:s0 sgid=0 subj=system_u:system_r:hald_t:s0
>suid=0 tclass=file tcontext=system_u:object_r:var_run_t:s0 tty=(none) uid=0
>

Actions: View

Attachments on bug 350711: 236381 | 236391