Attachment 253441 Details for Bug 373751 – selinux alert

selinux alert

selinux_alert.txt (text/plain), 2.45 KB, created by Russell Strong on 2007-11-09 20:52:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Russell Strong

Created: 2007-11-09 20:52:36 UTC

Size: 2.45 KB

patch

obsolete

>Summary
>    SELinux is preventing rpc.mountd (nfsd_t) "getattr" access to device
>    /dev/dmmidi1.
>
>Detailed Description
>    SELinux has denied the rpc.mountd (nfsd_t) "getattr" access to device
>    /dev/dmmidi1. /dev/dmmidi1 is mislabeled, this device has the default label
>    of the /dev directory, which should not happen.  All Character and/or Block
>    Devices should have a label. You can attempt to change the label of the file
>    using restorecon -v /dev/dmmidi1. If this device remains labeled device_t,
>    then this is a bug in SELinux policy. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against the selinux-policy
>    package. If you look at the other similar devices labels, ls -lZ
>    /dev/SIMILAR, and find a type that would work for /dev/dmmidi1, you can use
>    chcon -t SIMILAR_TYPE /dev/dmmidi1, If this fixes the problem, you can make
>    this permanent by executing semanage fcontext -a -t SIMILAR_TYPE
>    /dev/dmmidi1 If the restorecon changes the context, this indicates that the
>    application that created the device, created it without using SELinux APIs.
>    If you can figure out which application created the device, please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this application.
>
>Allowing Access
>    Attempt restorecon -v /dev/dmmidi1 or chcon -t SIMILAR_TYPE /dev/dmmidi1
>
>Additional Information        
>
>Source Context                unconfined_u:system_r:nfsd_t:s0
>Target Context                system_u:object_r:device_t:s0
>Target Objects                /dev/dmmidi1 [ chr_file ]
>Affected RPM Packages         
>Policy RPM                    selinux-policy-3.0.8-44.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.device
>Host Name                     brain.localnet
>Platform                      Linux brain.localnet 2.6.23.1-42.fc8 #1 SMP Tue
>                              Oct 30 13:55:12 EDT 2007 i686 i686
>Alert Count                   3
>First Seen                    Sat 10 Nov 2007 06:34:36 AM EST
>Last Seen                     Sat 10 Nov 2007 06:40:22 AM EST
>Local ID                      cb89ce56-fbfb-423a-b8f6-9b463416e20f
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { getattr } for comm=rpc.mountd dev=tmpfs path=/dev/dmmidi1 pid=4725
>scontext=unconfined_u:system_r:nfsd_t:s0 tclass=chr_file
>tcontext=system_u:object_r:device_t:s0
>

Actions: View

Attachments on bug 373751: 253441