Attachment 298512 Details for Bug 438145 – output of sealert in enforcing mode

output of sealert in enforcing mode

sealert-output.txt (text/plain), 2.53 KB, created by Milos Malik on 2008-03-19 13:54:42 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Milos Malik

Created: 2008-03-19 13:54:42 UTC

Size: 2.53 KB

patch

obsolete

>
>Summary:
>
>SELinux is preventing dhclient (dhcpc_t) "name_bind" to <NeznÃ¡mÃ©>
>(inetd_child_port_t).
>
>Detailed Description:
>
>SELinux denied access requested by dhclient. It is not expected that this access
>is required by dhclient and this access may signal an intrusion attempt. It is
>also possible that the specific version or configuration of the application is
>causing it to require additional access.
>
>Allowing Access:
>
>You can generate a local policy module to allow this access - see FAQ
>(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
>SELinux protection altogether. Disabling SELinux protection is not recommended.
>Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
>against this package.
>
>Additional Information:
>
>Source Context                system_u:system_r:dhcpc_t:s0
>Target Context                system_u:object_r:inetd_child_port_t:s0
>Target Objects                None [ udp_socket ]
>Source                        dhclient
>Source Path                   /sbin/dhclient
>Port                          1
>Host                          warrant.englab.brq.redhat.com
>Source RPM Packages           dhclient-3.0.6-12.fc8
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.0.8-93.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   catchall
>Host Name                     warrant.englab.brq.redhat.com
>Platform                      Linux warrant.englab.brq.redhat.com
>                              2.6.24.3-34.fc8 #1 SMP Wed Mar 12 16:51:49 EDT
>                              2008 x86_64 x86_64
>Alert Count                   11
>First Seen                    Wed Mar 19 12:01:15 2008
>Last Seen                     Wed Mar 19 14:49:43 2008
>Local ID                      eed0b691-8a90-4068-bb23-2dda1a2a177c
>Line Numbers                  
>
>Raw Audit Messages            
>
>host=warrant.englab.brq.redhat.com type=AVC msg=audit(1205934583.332:347): avc:  denied  { name_bind } for  pid=2020 comm="dhclient" src=1 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:inetd_child_port_t:s0 tclass=udp_socket
>
>host=warrant.englab.brq.redhat.com type=SYSCALL msg=audit(1205934583.332:347): arch=c000003e syscall=49 success=no exit=-13 a0=5 a1=7fffa5f5da00 a2=10 a3=7fffa5f5d9fc items=0 ppid=11322 pid=2020 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 comm="dhclient" exe="/sbin/dhclient" subj=system_u:system_r:dhcpc_t:s0 key=(null)
>
>
>

Actions: View

Attachments on bug 438145: 298509 | 298512