Attachment 263851 Details for Bug 343851 – selinux_alert.txt for pungi when enforcing=1

selinux_alert.txt for pungi when enforcing=1

selinux_alert-3.txt (text/plain), 19.82 KB, created by John Reiser on 2007-11-19 19:18:19 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: John Reiser

Created: 2007-11-19 19:18:19 UTC

Size: 19.82 KB

patch

obsolete

>Summary
>    SELinux is preventing access to files with the label, file_t.
>
>Detailed Description
>    SELinux permission checks on files labeled file_t are being denied.  file_t
>    is the context the SELinux kernel gives to files that do not have a label.
>    This indicates a serious labeling problem. No files on an SELinux box should
>    ever be labeled file_t. If you have just added a new disk drive to the
>    system you can relabel it using the restorecon command.  Otherwise you
>    should relabel the entire files system.
>
>Allowing Access
>    You can execute the following command as root to relabel your computer
>    system: "touch /.autorelabel; reboot"
>
>Additional Information        
>
>Source Context                system_u:system_r:semanage_t:s0
>Target Context                system_u:object_r:file_t:s0
>Target Objects                /data/Fedora8/logs/i386.log [ file ]
>Affected RPM Packages         
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.file
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   1
>First Seen                    Mon 19 Nov 2007 09:40:26 AM PST
>Last Seen                     Mon 19 Nov 2007 10:48:27 AM PST
>Local ID                      17a56a57-b3f0-41ea-bfdf-221682de6491
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { append } for comm=semodule dev=sda15
>path=/data/Fedora8/logs/i386.log pid=32670
>scontext=system_u:system_r:semanage_t:s0 tclass=file
>tcontext=system_u:object_r:file_t:s0
>
>
>Summary
>    SELinux is preventing /usr/sbin/useradd (useradd_t) "read write" to
>    <Unknown> (var_log_t).
>
>Detailed Description
>    SELinux denied access requested by /usr/sbin/useradd. It is not expected
>    that this access is required by /usr/sbin/useradd and this access may signal
>    an intrusion attempt. It is also possible that the specific version or
>    configuration of the application is causing it to require additional access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for <Unknown>, restorecon -v
>    <Unknown> If this does not work, there is currently no automatic way to
>    allow this access. Instead,  you can generate a local policy module to allow
>    this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
>    Or you can disable SELinux protection altogether. Disabling SELinux
>    protection is not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:useradd_t:s0
>Target Context                system_u:object_r:var_log_t:s0
>Target Objects                None [ file ]
>Affected RPM Packages         shadow-utils-4.0.18.1-18.fc8 [application]
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.catchall_file
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   36
>First Seen                    Thu 15 Nov 2007 09:03:57 PM PST
>Last Seen                     Mon 19 Nov 2007 10:44:04 AM PST
>Local ID                      e33c0015-1c8c-483b-8398-a33abede8174
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { read write } for comm=useradd dev=sda14 egid=0 euid=0
>exe=/usr/sbin/useradd exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name=lastlog
>pid=6251 scontext=system_u:system_r:useradd_t:s0 sgid=0
>subj=system_u:system_r:useradd_t:s0 suid=0 tclass=file
>tcontext=system_u:object_r:var_log_t:s0 tty=pts0 uid=0
>
>
>Summary
>    SELinux is preventing /usr/sbin/semodule (semanage_t) "read" to <Unknown>
>    (shadow_t).
>
>Detailed Description
>    SELinux denied access requested by /usr/sbin/semodule. It is not expected
>    that this access is required by /usr/sbin/semodule and this access may
>    signal an intrusion attempt. It is also possible that the specific version
>    or configuration of the application is causing it to require additional
>    access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for <Unknown>, restorecon -v
>    <Unknown> If this does not work, there is currently no automatic way to
>    allow this access. Instead,  you can generate a local policy module to allow
>    this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
>    Or you can disable SELinux protection altogether. Disabling SELinux
>    protection is not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:semanage_t:s0
>Target Context                system_u:object_r:shadow_t:s0
>Target Objects                None [ file ]
>Affected RPM Packages         policycoreutils-2.0.31-7.fc8 [application]
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.catchall_file
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   13
>First Seen                    Thu 15 Nov 2007 09:05:52 PM PST
>Last Seen                     Mon 19 Nov 2007 10:44:03 AM PST
>Local ID                      3e677da4-25d2-4536-ac24-3c0007af1d15
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { read } for comm=semodule dev=sda14 egid=0 euid=0
>exe=/usr/sbin/semodule exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name=passwd
>pid=6242 scontext=system_u:system_r:semanage_t:s0 sgid=0
>subj=system_u:system_r:semanage_t:s0 suid=0 tclass=file
>tcontext=system_u:object_r:shadow_t:s0 tty=pts0 uid=0
>
>
>Summary
>    SELinux is preventing semanage (semanage_t) "write" to /dev/null (device_t).
>
>Detailed Description
>    SELinux denied access requested by semanage. It is not expected that this
>    access is required by semanage and this access may signal an intrusion
>    attempt. It is also possible that the specific version or configuration of
>    the application is causing it to require additional access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for /dev/null, restorecon -v
>    /dev/null If this does not work, there is currently no automatic way to
>    allow this access. Instead,  you can generate a local policy module to allow
>    this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
>    Or you can disable SELinux protection altogether. Disabling SELinux
>    protection is not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:semanage_t:s0
>Target Context                system_u:object_r:device_t:s0
>Target Objects                /dev/null [ file ]
>Affected RPM Packages         
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.catchall_file
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   12
>First Seen                    Thu 15 Nov 2007 09:05:25 PM PST
>Last Seen                     Mon 19 Nov 2007 10:44:03 AM PST
>Local ID                      23ac7221-c2a6-4c5a-aad0-1ae1ffbbf987
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { write } for comm=semanage dev=sda14 egid=0 euid=0
>exe=/usr/bin/python exit=0 fsgid=0 fsuid=0 gid=0 items=0 path=/dev/null pid=6246
>scontext=system_u:system_r:semanage_t:s0 sgid=0
>subj=system_u:system_r:semanage_t:s0 suid=0 tclass=file
>tcontext=system_u:object_r:device_t:s0 tty=pts0 uid=0
>
>
>Summary
>    SELinux is preventing semanage (semanage_t) "getattr" to <Unknown> (fs_t).
>
>Detailed Description
>    SELinux denied access requested by semanage. It is not expected that this
>    access is required by semanage and this access may signal an intrusion
>    attempt. It is also possible that the specific version or configuration of
>    the application is causing it to require additional access.
>
>Allowing Access
>    You can generate a local policy module to allow this access - see
>    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
>    SELinux protection altogether. Disabling SELinux protection is not
>    recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
>    against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:semanage_t:s0
>Target Context                system_u:object_r:fs_t:s0
>Target Objects                None [ filesystem ]
>Affected RPM Packages         
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.catchall
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   28
>First Seen                    Thu 15 Nov 2007 09:05:25 PM PST
>Last Seen                     Mon 19 Nov 2007 10:44:03 AM PST
>Local ID                      a7d9b575-2685-4085-94b8-7765d0e42655
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { getattr } for comm=semanage dev=sda14 egid=0 euid=0
>exe=/usr/bin/python exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name=/ pid=6248
>scontext=system_u:system_r:semanage_t:s0 sgid=0
>subj=system_u:system_r:semanage_t:s0 suid=0 tclass=filesystem
>tcontext=system_u:object_r:fs_t:s0 tty=pts0 uid=0
>
>
>Summary
>    SELinux is preventing /sbin/setfiles (setfiles_t) "write" to /dev/null
>    (device_t).
>
>Detailed Description
>    SELinux denied access requested by /sbin/setfiles. It is not expected that
>    this access is required by /sbin/setfiles and this access may signal an
>    intrusion attempt. It is also possible that the specific version or
>    configuration of the application is causing it to require additional access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for /dev/null, restorecon -v
>    /dev/null If this does not work, there is currently no automatic way to
>    allow this access. Instead,  you can generate a local policy module to allow
>    this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
>    Or you can disable SELinux protection altogether. Disabling SELinux
>    protection is not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:setfiles_t:s0
>Target Context                system_u:object_r:device_t:s0
>Target Objects                /dev/null [ file ]
>Affected RPM Packages         policycoreutils-2.0.31-7.fc8 [application]
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.catchall_file
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   8
>First Seen                    Thu 15 Nov 2007 09:05:19 PM PST
>Last Seen                     Mon 19 Nov 2007 10:44:03 AM PST
>Local ID                      81f5e857-f795-4d75-b9be-2a12613ad0ab
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { write } for comm=restorecon dev=sda14 egid=0 euid=0
>exe=/sbin/setfiles exit=0 fsgid=0 fsuid=0 gid=0 items=0 path=/dev/null pid=6249
>scontext=system_u:system_r:setfiles_t:s0 sgid=0
>subj=system_u:system_r:setfiles_t:s0 suid=0 tclass=file
>tcontext=system_u:object_r:device_t:s0 tty=pts0 uid=0
>
>
>Summary
>    SELinux is preventing /usr/sbin/useradd (useradd_t) "write" to /dev/null
>    (device_t).
>
>Detailed Description
>    SELinux denied access requested by /usr/sbin/useradd. It is not expected
>    that this access is required by /usr/sbin/useradd and this access may signal
>    an intrusion attempt. It is also possible that the specific version or
>    configuration of the application is causing it to require additional access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for /dev/null, restorecon -v
>    /dev/null If this does not work, there is currently no automatic way to
>    allow this access. Instead,  you can generate a local policy module to allow
>    this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
>    Or you can disable SELinux protection altogether. Disabling SELinux
>    protection is not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:useradd_t:s0
>Target Context                system_u:object_r:device_t:s0
>Target Objects                /dev/null [ file ]
>Affected RPM Packages         shadow-utils-4.0.18.1-18.fc8 [application]
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.catchall_file
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   25
>First Seen                    Thu 15 Nov 2007 09:03:32 PM PST
>Last Seen                     Mon 19 Nov 2007 10:44:03 AM PST
>Local ID                      1621d43a-a5bb-45de-92c7-d99adfa39443
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { write } for comm=useradd dev=sda14 egid=0 euid=0
>exe=/usr/sbin/useradd exit=0 fsgid=0 fsuid=0 gid=0 items=0 path=/dev/null
>pid=6251 scontext=system_u:system_r:useradd_t:s0 sgid=0
>subj=system_u:system_r:useradd_t:s0 suid=0 tclass=file
>tcontext=system_u:object_r:device_t:s0 tty=pts0 uid=0
>
>
>Summary
>    SELinux is preventing /usr/sbin/groupadd (groupadd_t) "write" to /dev/null
>    (device_t).
>
>Detailed Description
>    SELinux denied access requested by /usr/sbin/groupadd. It is not expected
>    that this access is required by /usr/sbin/groupadd and this access may
>    signal an intrusion attempt. It is also possible that the specific version
>    or configuration of the application is causing it to require additional
>    access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for /dev/null, restorecon -v
>    /dev/null If this does not work, there is currently no automatic way to
>    allow this access. Instead,  you can generate a local policy module to allow
>    this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
>    Or you can disable SELinux protection altogether. Disabling SELinux
>    protection is not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:groupadd_t:s0
>Target Context                system_u:object_r:device_t:s0
>Target Objects                /dev/null [ file ]
>Affected RPM Packages         shadow-utils-4.0.18.1-18.fc8 [application]
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.catchall_file
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   8
>First Seen                    Thu 15 Nov 2007 09:03:32 PM PST
>Last Seen                     Mon 19 Nov 2007 10:42:23 AM PST
>Local ID                      76dd7786-5d99-41df-b18f-a19a3921e209
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { write } for comm=groupadd dev=sda14 egid=0 euid=0
>exe=/usr/sbin/groupadd exit=0 fsgid=0 fsuid=0 gid=0 items=0 path=/dev/null
>pid=3897 scontext=system_u:system_r:groupadd_t:s0 sgid=0
>subj=system_u:system_r:groupadd_t:s0 suid=0 tclass=file
>tcontext=system_u:object_r:device_t:s0 tty=pts0 uid=0
>
>
>Summary
>    SELinux is preventing /sbin/ldconfig (ldconfig_t) "write" to /dev/null
>    (device_t).
>
>Detailed Description
>    SELinux denied access requested by /sbin/ldconfig. It is not expected that
>    this access is required by /sbin/ldconfig and this access may signal an
>    intrusion attempt. It is also possible that the specific version or
>    configuration of the application is causing it to require additional access.
>
>Allowing Access
>    Sometimes labeling problems can cause SELinux denials.  You could try to
>    restore the default system file context for /dev/null, restorecon -v
>    /dev/null If this does not work, there is currently no automatic way to
>    allow this access. Instead,  you can generate a local policy module to allow
>    this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
>    Or you can disable SELinux protection altogether. Disabling SELinux
>    protection is not recommended. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Additional Information        
>
>Source Context                system_u:system_r:ldconfig_t:s0
>Target Context                system_u:object_r:device_t:s0
>Target Objects                /dev/null [ file ]
>Affected RPM Packages         glibc-2.7-2 [application]
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.catchall_file
>Host Name                     f8-32.localdomain
>Platform                      Linux f8-32.localdomain 2.6.23.1-49.fc8 #1 SMP Thu
>                              Nov 8 21:41:26 EST 2007 i686 athlon
>Alert Count                   10
>First Seen                    Thu 15 Nov 2007 09:03:40 PM PST
>Last Seen                     Mon 19 Nov 2007 10:41:59 AM PST
>Local ID                      a1661165-1fe4-475a-8a47-dddd5e7ff655
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { write } for comm=ldconfig dev=sda14 egid=0 euid=0
>exe=/sbin/ldconfig exit=0 fsgid=0 fsuid=0 gid=0 items=0 path=/dev/null pid=3797
>scontext=system_u:system_r:ldconfig_t:s0 sgid=0
>subj=system_u:system_r:ldconfig_t:s0 suid=0 tclass=file
>tcontext=system_u:object_r:device_t:s0 tty=pts0 uid=0
>

Actions: View

Attachments on bug 343851: 263591 | 263761 | 263841 | 263851