Attachment 263841 Details for Bug 343851 – selinux_alert.txt for pungi when enforcing=0

selinux_alert.txt for pungi when enforcing=0

selinux_alert-2.txt (text/plain), 18.58 KB, created by John Reiser on 2007-11-19 19:14:10 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: John Reiser

Created: 2007-11-19 19:14:10 UTC

Size: 18.58 KB

patch

obsolete

>Summary
>    SELinux is preventing the /usr/sbin/semodule from using potentially
>    mislabeled files (<Unknown>).
>
>Detailed Description
>    SELinux has denied /usr/sbin/semodule access to potentially mislabeled
>    file(s) (<Unknown>).  This means that SELinux will not allow
>    /usr/sbin/semodule to use these files.  It is common for users to edit files
>    in their home directory or tmp directories and then move (mv) them to system
>    directories.  The problem is that the files end up with the wrong file
>    context which confined applications are not allowed to access.
>
>Allowing Access
>    If you want /usr/sbin/semodule to access this files, you need to relabel
>    them using restorecon -v <Unknown>.  You might want to relabel the entire
>    directory using restorecon -R -v <Unknown>.
>
>Additional Information        
>
>Source Context                system_u:system_r:semanage_t:s0
>Target Context                system_u:object_r:unconfined_tmp_t:s0
>Target Objects                None [ dir ]
>Affected RPM Packages         policycoreutils-2.0.31-7.fc8 [application]
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.home_tmp_bad_labels
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   1
>First Seen                    Mon 19 Nov 2007 09:40:55 AM PST
>Last Seen                     Mon 19 Nov 2007 09:40:55 AM PST
>Local ID                      61a22815-240d-4851-8a96-fcae9fb8779e
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { rename } for comm=semodule dev=sda14 egid=0 euid=0
>exe=/usr/sbin/semodule exit=0 fsgid=0 fsuid=0 gid=0 items=0 name=active pid=1869
>scontext=system_u:system_r:semanage_t:s0 sgid=0
>subj=system_u:system_r:semanage_t:s0 suid=0 tclass=dir
>tcontext=system_u:object_r:unconfined_tmp_t:s0 tty=pts1 uid=0
>
>
>Summary
>    SELinux is preventing access to files with the label, file_t.
>
>Detailed Description
>    SELinux permission checks on files labeled file_t are being denied.  file_t
>    is the context the SELinux kernel gives to files that do not have a label.
>    This indicates a serious labeling problem. No files on an SELinux box should
>    ever be labeled file_t. If you have just added a new disk drive to the
>    system you can relabel it using the restorecon command.  Otherwise you
>    should relabel the entire files system.
>
>Allowing Access
>    You can execute the following command as root to relabel your computer
>    system: "touch /.autorelabel; reboot"
>
>Additional Information        
>
>Source Context                system_u:system_r:setfiles_t:s0
>Target Context                system_u:object_r:file_t:s0
>Target Objects                /data/Fedora8/logs/i386.log [ file ]
>Affected RPM Packages         policycoreutils-2.0.31-7.fc8 [application]
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.file
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   1
>First Seen                    Mon 19 Nov 2007 09:40:55 AM PST
>Last Seen                     Mon 19 Nov 2007 09:40:55 AM PST
>Local ID                      5bfc102e-0b7c-4bca-baf0-771c595eb109
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { append } for comm=setfiles dev=sda15 egid=0 euid=0
>exe=/sbin/setfiles exit=0 fsgid=0 fsuid=0 gid=0 items=0
>path=/data/Fedora8/logs/i386.log pid=1872
>scontext=system_u:system_r:setfiles_t:s0 sgid=0
>subj=system_u:system_r:setfiles_t:s0 suid=0 tclass=file
>tcontext=system_u:object_r:file_t:s0 tty=pts1 uid=0
>
>
>Summary
>    SELinux is preventing the semodule from using potentially mislabeled files
>    (<Unknown>).
>
>Detailed Description
>    SELinux has denied semodule access to potentially mislabeled file(s)
>    (<Unknown>).  This means that SELinux will not allow semodule to use these
>    files.  It is common for users to edit files in their home directory or tmp
>    directories and then move (mv) them to system directories.  The problem is
>    that the files end up with the wrong file context which confined
>    applications are not allowed to access.
>
>Allowing Access
>    If you want semodule to access this files, you need to relabel them using
>    restorecon -v <Unknown>.  You might want to relabel the entire directory
>    using restorecon -R -v <Unknown>.
>
>Additional Information        
>
>Source Context                system_u:system_r:semanage_t:s0
>Target Context                system_u:object_r:unconfined_tmp_t:s0
>Target Objects                None [ dir ]
>Affected RPM Packages         
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.home_tmp_bad_labels
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   1
>First Seen                    Mon 19 Nov 2007 09:40:55 AM PST
>Last Seen                     Mon 19 Nov 2007 09:40:55 AM PST
>Local ID                      d6fb4192-3e7e-4bd0-a2ca-35e9a31124e6
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { rmdir } for comm=semodule dev=sda14 name=modules pid=1869
>scontext=system_u:system_r:semanage_t:s0 tclass=dir
>tcontext=system_u:object_r:unconfined_tmp_t:s0
>
>
>Summary
>    SELinux is preventing /usr/sbin/semodule (semanage_t) "getattr" to
>    /etc/passwd (shadow_t).
>
>Detailed Description
>    SELinux denied access requested by /usr/sbin/semodule. It is not expected
>    that this access is required by /usr/sbin/semodule and this access may
>    signal an intrusion attempt. It is also possible that the specific version
>    or configuration of the application is causing it to require additional
>    access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for /etc/passwd, restorecon -v
>    /etc/passwd If this does not work, there is currently no automatic way to
>    allow this access. Instead,  you can generate a local policy module to allow
>    this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
>    Or you can disable SELinux protection altogether. Disabling SELinux
>    protection is not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:semanage_t:s0
>Target Context                system_u:object_r:shadow_t:s0
>Target Objects                /etc/passwd [ file ]
>Affected RPM Packages         policycoreutils-2.0.31-7.fc8
>                              [application]setup-2.6.10-1.fc8 [target]
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.catchall_file
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   2
>First Seen                    Mon 19 Nov 2007 09:35:32 AM PST
>Last Seen                     Mon 19 Nov 2007 09:40:55 AM PST
>Local ID                      4f04ff4e-3324-4f79-9e24-b224ac095a51
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { getattr } for comm=semodule dev=sda14 egid=0 euid=0
>exe=/usr/sbin/semodule exit=0 fsgid=0 fsuid=0 gid=0 items=0 path=/etc/passwd
>pid=1869 scontext=system_u:system_r:semanage_t:s0 sgid=0
>subj=system_u:system_r:semanage_t:s0 suid=0 tclass=file
>tcontext=system_u:object_r:shadow_t:s0 tty=pts1 uid=0
>
>
>Summary
>    SELinux is preventing the /usr/sbin/semodule from using potentially
>    mislabeled files (<Unknown>).
>
>Detailed Description
>    SELinux has denied /usr/sbin/semodule access to potentially mislabeled
>    file(s) (<Unknown>).  This means that SELinux will not allow
>    /usr/sbin/semodule to use these files.  It is common for users to edit files
>    in their home directory or tmp directories and then move (mv) them to system
>    directories.  The problem is that the files end up with the wrong file
>    context which confined applications are not allowed to access.
>
>Allowing Access
>    If you want /usr/sbin/semodule to access this files, you need to relabel
>    them using restorecon -v <Unknown>.  You might want to relabel the entire
>    directory using restorecon -R -v <Unknown>.
>
>Additional Information        
>
>Source Context                system_u:system_r:semanage_t:s0
>Target Context                system_u:object_r:unconfined_tmp_t:s0
>Target Objects                None [ dir ]
>Affected RPM Packages         policycoreutils-2.0.31-7.fc8 [application]
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.home_tmp_bad_labels
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   1
>First Seen                    Mon 19 Nov 2007 09:40:26 AM PST
>Last Seen                     Mon 19 Nov 2007 09:40:26 AM PST
>Local ID                      03813823-f4ac-4432-8338-032718ebce27
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { add_name } for comm=semodule egid=0 euid=0 exe=/usr/sbin/semodule
>exit=0 fsgid=0 fsuid=0 gid=0 items=0 name=tmp pid=1869
>scontext=system_u:system_r:semanage_t:s0 sgid=0
>subj=system_u:system_r:semanage_t:s0 suid=0 tclass=dir
>tcontext=system_u:object_r:unconfined_tmp_t:s0 tty=pts1 uid=0
>
>
>Summary
>    SELinux is preventing the semodule from using potentially mislabeled files
>    (<Unknown>).
>
>Detailed Description
>    SELinux has denied semodule access to potentially mislabeled file(s)
>    (<Unknown>).  This means that SELinux will not allow semodule to use these
>    files.  It is common for users to edit files in their home directory or tmp
>    directories and then move (mv) them to system directories.  The problem is
>    that the files end up with the wrong file context which confined
>    applications are not allowed to access.
>
>Allowing Access
>    If you want semodule to access this files, you need to relabel them using
>    restorecon -v <Unknown>.  You might want to relabel the entire directory
>    using restorecon -R -v <Unknown>.
>
>Additional Information        
>
>Source Context                system_u:system_r:semanage_t:s0
>Target Context                system_u:object_r:unconfined_tmp_t:s0
>Target Objects                None [ file ]
>Affected RPM Packages         
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.home_tmp_bad_labels
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   5
>First Seen                    Thu 15 Nov 2007 09:10:21 PM PST
>Last Seen                     Mon 19 Nov 2007 09:40:26 AM PST
>Local ID                      af6a3d7f-28be-4d09-aaf3-da99d7c0df82
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { write } for comm=semodule dev=sda14 name=netfilter_contexts.tmp
>pid=1869 scontext=system_u:system_r:semanage_t:s0 tclass=file
>tcontext=system_u:object_r:unconfined_tmp_t:s0
>
>
>Summary
>    SELinux is preventing the semodule from using potentially mislabeled files
>    (<Unknown>).
>
>Detailed Description
>    SELinux has denied semodule access to potentially mislabeled file(s)
>    (<Unknown>).  This means that SELinux will not allow semodule to use these
>    files.  It is common for users to edit files in their home directory or tmp
>    directories and then move (mv) them to system directories.  The problem is
>    that the files end up with the wrong file context which confined
>    applications are not allowed to access.
>
>Allowing Access
>    If you want semodule to access this files, you need to relabel them using
>    restorecon -v <Unknown>.  You might want to relabel the entire directory
>    using restorecon -R -v <Unknown>.
>
>Additional Information        
>
>Source Context                system_u:system_r:semanage_t:s0
>Target Context                system_u:object_r:unconfined_tmp_t:s0
>Target Objects                None [ file ]
>Affected RPM Packages         
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.home_tmp_bad_labels
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   1
>First Seen                    Mon 19 Nov 2007 09:40:26 AM PST
>Last Seen                     Mon 19 Nov 2007 09:40:26 AM PST
>Local ID                      6c61a97e-b7f0-4beb-a379-668e7b4bc7c4
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { create } for comm=semodule name=netfilter_contexts.tmp pid=1869
>scontext=system_u:system_r:semanage_t:s0 tclass=file
>tcontext=system_u:object_r:unconfined_tmp_t:s0
>
>
>Summary
>    SELinux is preventing /usr/sbin/useradd (useradd_t) "ioctl" to /dev/null
>    (device_t).
>
>Detailed Description
>    SELinux denied access requested by /usr/sbin/useradd. It is not expected
>    that this access is required by /usr/sbin/useradd and this access may signal
>    an intrusion attempt. It is also possible that the specific version or
>    configuration of the application is causing it to require additional access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for /dev/null, restorecon -v
>    /dev/null If this does not work, there is currently no automatic way to
>    allow this access. Instead,  you can generate a local policy module to allow
>    this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
>    Or you can disable SELinux protection altogether. Disabling SELinux
>    protection is not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:useradd_t:s0
>Target Context                system_u:object_r:device_t:s0
>Target Objects                /dev/null [ file ]
>Affected RPM Packages         shadow-utils-4.0.18.1-18.fc8 [application]
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.catchall_file
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   2
>First Seen                    Mon 19 Nov 2007 09:33:14 AM PST
>Last Seen                     Mon 19 Nov 2007 09:35:56 AM PST
>Local ID                      df32f57d-189c-4349-8ce3-287550799d76
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { ioctl } for comm=useradd dev=sda14 egid=0 euid=0
>exe=/usr/sbin/useradd exit=-25 fsgid=0 fsuid=0 gid=0 items=0 path=/dev/null
>pid=6522 scontext=system_u:system_r:useradd_t:s0 sgid=0
>subj=system_u:system_r:useradd_t:s0 suid=0 tclass=file
>tcontext=system_u:object_r:device_t:s0 tty=pts1 uid=0
>
>
>Summary
>    SELinux is preventing groupadd (groupadd_t) "ioctl" to /dev/null (device_t).
>
>Detailed Description
>    SELinux denied access requested by groupadd. It is not expected that this
>    access is required by groupadd and this access may signal an intrusion
>    attempt. It is also possible that the specific version or configuration of
>    the application is causing it to require additional access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for /dev/null, restorecon -v
>    /dev/null If this does not work, there is currently no automatic way to
>    allow this access. Instead,  you can generate a local policy module to allow
>    this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
>    Or you can disable SELinux protection altogether. Disabling SELinux
>    protection is not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:groupadd_t:s0
>Target Context                system_u:object_r:device_t:s0
>Target Objects                /dev/null [ file ]
>Affected RPM Packages         
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.catchall_file
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   1
>First Seen                    Mon 19 Nov 2007 09:33:14 AM PST
>Last Seen                     Mon 19 Nov 2007 09:33:14 AM PST
>Local ID                      b95a738f-f83c-4168-a9e0-fe1e67035cfc
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { ioctl } for comm=groupadd dev=sda14 path=/dev/null pid=4007
>scontext=system_u:system_r:groupadd_t:s0 tclass=file
>tcontext=system_u:object_r:device_t:s0
>

Actions: View

Attachments on bug 343851: 263591 | 263761 | 263841 | 263851