Attachment 282071 Details for Bug 416671 – SElinux log entry for vmware policy violation

SElinux log entry for vmware policy violation

selinux_alert.txt (text/plain), 2.46 KB, created by Bill Crooke on 2007-12-08 18:28:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Bill Crooke

Created: 2007-12-08 18:28:28 UTC

Size: 2.46 KB

patch

obsolete

>Summary
>    SELinux is preventing vmnet-netifup (vmware_host_t) "read write" access to
>    device <Unknown>.
>
>Detailed Description
>    SELinux has denied the vmnet-netifup (vmware_host_t) "read write" access to
>    device <Unknown>. <Unknown> is mislabeled, this device has the default label
>    of the /dev directory, which should not happen.  All Character and/or Block
>    Devices should have a label. You can attempt to change the label of the file
>    using restorecon -v <Unknown>. If this device remains labeled device_t, then
>    this is a bug in SELinux policy. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against the selinux-policy
>    package. If you look at the other similar devices labels, ls -lZ
>    /dev/SIMILAR, and find a type that would work for <Unknown>, you can use
>    chcon -t SIMILAR_TYPE <Unknown>, If this fixes the problem, you can make
>    this permanent by executing semanage fcontext -a -t SIMILAR_TYPE <Unknown>
>    If the restorecon changes the context, this indicates that the application
>    that created the device, created it without using SELinux APIs.  If you can
>    figure out which application created the device, please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this application.
>
>Allowing Access
>    Attempt restorecon -v <Unknown> or chcon -t SIMILAR_TYPE <Unknown>
>
>Additional Information        
>
>Source Context                system_u:system_r:vmware_host_t:s0
>Target Context                system_u:object_r:device_t:s0
>Target Objects                None [ chr_file ]
>Affected RPM Packages         
>Policy RPM                    selinux-policy-3.0.8-62.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.device
>Host Name                     wrc-dt64.thecrookes.com
>Platform                      Linux wrc-dt64.thecrookes.com 2.6.23.1-49.fc8 #1
>                              SMP Thu Nov 8 21:41:26 EST 2007 i686 i686
>Alert Count                   1
>First Seen                    Sat 08 Dec 2007 10:20:27 AM PST
>Last Seen                     Sat 08 Dec 2007 10:20:27 AM PST
>Local ID                      a1c08ee3-37b2-4589-a321-c7f7e6755153
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { read write } for comm=vmnet-netifup dev=tmpfs name=vmnet1 pid=2549
>scontext=system_u:system_r:vmware_host_t:s0 tclass=chr_file
>tcontext=system_u:object_r:device_t:s0
>

Actions: View

Attachments on bug 416671: 282071