Attachment 295375 Details for Bug 433407 – Alerts from device file access

Alerts from device file access

alerts.automount (text/plain), 10.44 KB, created by Ian Kent on 2008-02-20 03:25:04 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ian Kent

Created: 2008-02-20 03:25:04 UTC

Size: 10.44 KB

patch

obsolete

>Summary
>    SELinux is preventing /usr/sbin/automount (automount_t) "ioctl" access to
>    device /dev/autofs.
>
>Detailed Description
>    SELinux has denied the /usr/sbin/automount (automount_t) "ioctl" access to
>    device /dev/autofs. /dev/autofs is mislabeled, this device has the default
>    label of the /dev directory, which should not happen.  All Character and/or
>    Block Devices should have a label. You can attempt to change the label of
>    the file using restorecon -v /dev/autofs. If this device remains labeled
>    device_t, then this is a bug in SELinux policy. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against the selinux-policy
>    package. If you look at the other similar devices labels, ls -lZ
>    /dev/SIMILAR, and find a type that would work for /dev/autofs, you can use
>    chcon -t SIMILAR_TYPE /dev/autofs, If this fixes the problem, you can make
>    this permanent by executing semanage fcontext -a -t SIMILAR_TYPE /dev/autofs
>    If the restorecon changes the context, this indicates that the application
>    that created the device, created it without using SELinux APIs.  If you can
>    figure out which application created the device, please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this application.
>
>Allowing Access
>    Attempt restorecon -v /dev/autofs or chcon -t SIMILAR_TYPE /dev/autofs
>
>Additional Information        
>
>Source Context                system_u:system_r:automount_t:s0
>Target Context                system_u:object_r:device_t:s0
>Target Objects                /dev/autofs [ chr_file ]
>Affected RPM Packages         autofs-5.0.3-1 [application]
>Policy RPM                    selinux-policy-3.0.8-81.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.device
>Host Name                     raven.themaw.net
>Platform                      Linux raven.themaw.net 2.6.23.15-137.fc8 #1 SMP
>                              Sun Feb 10 17:48:34 EST 2008 i686 athlon
>Alert Count                   2
>First Seen                    Wed Feb 20 10:56:34 2008
>Last Seen                     Wed Feb 20 10:57:19 2008
>Local ID                      41152681-8aef-46cb-a512-6c28b61de52d
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { ioctl } for comm=automount dev=tmpfs egid=0 euid=0
>exe=/usr/sbin/automount exit=-11 fsgid=0 fsuid=0 gid=0 items=0 path=/dev/autofs
>pid=9330 scontext=system_u:system_r:automount_t:s0 sgid=0
>subj=system_u:system_r:automount_t:s0 suid=0 tclass=chr_file
>tcontext=system_u:object_r:device_t:s0 tty=(none) uid=0
>
>
>Summary
>    SELinux is preventing /usr/sbin/automount (automount_t) "read" access to
>    device <Unknown>.
>
>Detailed Description
>    SELinux has denied the /usr/sbin/automount (automount_t) "read" access to
>    device <Unknown>. <Unknown> is mislabeled, this device has the default label
>    of the /dev directory, which should not happen.  All Character and/or Block
>    Devices should have a label. You can attempt to change the label of the file
>    using restorecon -v <Unknown>. If this device remains labeled device_t, then
>    this is a bug in SELinux policy. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against the selinux-policy
>    package. If you look at the other similar devices labels, ls -lZ
>    /dev/SIMILAR, and find a type that would work for <Unknown>, you can use
>    chcon -t SIMILAR_TYPE <Unknown>, If this fixes the problem, you can make
>    this permanent by executing semanage fcontext -a -t SIMILAR_TYPE <Unknown>
>    If the restorecon changes the context, this indicates that the application
>    that created the device, created it without using SELinux APIs.  If you can
>    figure out which application created the device, please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this application.
>
>Allowing Access
>    Attempt restorecon -v <Unknown> or chcon -t SIMILAR_TYPE <Unknown>
>
>Additional Information        
>
>Source Context                system_u:system_r:automount_t:s0
>Target Context                system_u:object_r:device_t:s0
>Target Objects                None [ chr_file ]
>Affected RPM Packages         autofs-5.0.3-1 [application]
>Policy RPM                    selinux-policy-3.0.8-81.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.device
>Host Name                     raven.themaw.net
>Platform                      Linux raven.themaw.net 2.6.23.15-137.fc8 #1 SMP
>                              Sun Feb 10 17:48:34 EST 2008 i686 athlon
>Alert Count                   2
>First Seen                    Wed Feb 20 10:56:55 2008
>Last Seen                     Wed Feb 20 11:01:40 2008
>Local ID                      b351473b-abb0-4107-9419-b8becc25200b
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { read } for comm=automount dev=tmpfs egid=0 euid=0
>exe=/usr/sbin/automount exit=3 fsgid=0 fsuid=0 gid=0 items=0 name=autofs
>pid=9541 scontext=system_u:system_r:automount_t:s0 sgid=0
>subj=system_u:system_r:automount_t:s0 suid=0 tclass=chr_file
>tcontext=system_u:object_r:device_t:s0 tty=pts3 uid=0
>
>
>Summary
>    SELinux is preventing /usr/sbin/automount (automount_t) "ioctl" access to
>    device /dev/autofs.
>
>Detailed Description
>    SELinux has denied the /usr/sbin/automount (automount_t) "ioctl" access to
>    device /dev/autofs. /dev/autofs is mislabeled, this device has the default
>    label of the /dev directory, which should not happen.  All Character and/or
>    Block Devices should have a label. You can attempt to change the label of
>    the file using restorecon -v /dev/autofs. If this device remains labeled
>    device_t, then this is a bug in SELinux policy. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against the selinux-policy
>    package. If you look at the other similar devices labels, ls -lZ
>    /dev/SIMILAR, and find a type that would work for /dev/autofs, you can use
>    chcon -t SIMILAR_TYPE /dev/autofs, If this fixes the problem, you can make
>    this permanent by executing semanage fcontext -a -t SIMILAR_TYPE /dev/autofs
>    If the restorecon changes the context, this indicates that the application
>    that created the device, created it without using SELinux APIs.  If you can
>    figure out which application created the device, please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this application.
>
>Allowing Access
>    Attempt restorecon -v /dev/autofs or chcon -t SIMILAR_TYPE /dev/autofs
>
>Additional Information        
>
>Source Context                system_u:system_r:automount_t:s0
>Target Context                system_u:object_r:device_t:s0
>Target Objects                /dev/autofs [ chr_file ]
>Affected RPM Packages         autofs-5.0.3-1 [application]
>Policy RPM                    selinux-policy-3.0.8-81.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.device
>Host Name                     raven.themaw.net
>Platform                      Linux raven.themaw.net 2.6.23.15-137.fc8 #1 SMP
>                              Sun Feb 10 17:48:34 EST 2008 i686 athlon
>Alert Count                   2
>First Seen                    Wed Feb 20 10:56:34 2008
>Last Seen                     Wed Feb 20 10:57:19 2008
>Local ID                      41152681-8aef-46cb-a512-6c28b61de52d
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { ioctl } for comm=automount dev=tmpfs egid=0 euid=0
>exe=/usr/sbin/automount exit=-11 fsgid=0 fsuid=0 gid=0 items=0 path=/dev/autofs
>pid=9330 scontext=system_u:system_r:automount_t:s0 sgid=0
>subj=system_u:system_r:automount_t:s0 suid=0 tclass=chr_file
>tcontext=system_u:object_r:device_t:s0 tty=(none) uid=0
>
>
>Summary
>    SELinux is preventing /usr/sbin/automount (automount_t) "read" access to
>    device <Unknown>.
>
>Detailed Description
>    SELinux has denied the /usr/sbin/automount (automount_t) "read" access to
>    device <Unknown>. <Unknown> is mislabeled, this device has the default label
>    of the /dev directory, which should not happen.  All Character and/or Block
>    Devices should have a label. You can attempt to change the label of the file
>    using restorecon -v <Unknown>. If this device remains labeled device_t, then
>    this is a bug in SELinux policy. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against the selinux-policy
>    package. If you look at the other similar devices labels, ls -lZ
>    /dev/SIMILAR, and find a type that would work for <Unknown>, you can use
>    chcon -t SIMILAR_TYPE <Unknown>, If this fixes the problem, you can make
>    this permanent by executing semanage fcontext -a -t SIMILAR_TYPE <Unknown>
>    If the restorecon changes the context, this indicates that the application
>    that created the device, created it without using SELinux APIs.  If you can
>    figure out which application created the device, please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this application.
>
>Allowing Access
>    Attempt restorecon -v <Unknown> or chcon -t SIMILAR_TYPE <Unknown>
>
>Additional Information        
>
>Source Context                system_u:system_r:automount_t:s0
>Target Context                system_u:object_r:device_t:s0
>Target Objects                None [ chr_file ]
>Affected RPM Packages         autofs-5.0.3-1 [application]
>Policy RPM                    selinux-policy-3.0.8-81.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.device
>Host Name                     raven.themaw.net
>Platform                      Linux raven.themaw.net 2.6.23.15-137.fc8 #1 SMP
>                              Sun Feb 10 17:48:34 EST 2008 i686 athlon
>Alert Count                   2
>First Seen                    Wed Feb 20 10:56:55 2008
>Last Seen                     Wed Feb 20 11:01:40 2008
>Local ID                      b351473b-abb0-4107-9419-b8becc25200b
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { read } for comm=automount dev=tmpfs egid=0 euid=0
>exe=/usr/sbin/automount exit=3 fsgid=0 fsuid=0 gid=0 items=0 name=autofs
>pid=9541 scontext=system_u:system_r:automount_t:s0 sgid=0
>subj=system_u:system_r:automount_t:s0 suid=0 tclass=chr_file
>tcontext=system_u:object_r:device_t:s0 tty=pts3 uid=0
>
>

Actions: View

Attachments on bug 433407: 295375 | 295376