Attachment 302687 Details for Bug 442823 – SElinux AVC and ll of files as root and user

SElinux AVC and ll of files as root and user

selinux_polkit.txt (text/plain), 6.42 KB, created by Flóki Pálsson on 2008-04-17 01:36:13 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Flóki Pálsson

Created: 2008-04-17 01:36:13 UTC

Size: 6.42 KB

patch

obsolete

>SElinux
>
>SummarySELinux is preventing polkit-resolve- (hald_t) "getattr" to <Unknown> (hald_t). Detailed DescriptionSELinux denied access requested by polkit-resolve-. It is not expected that this access is required by polkit-resolve- and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing AccessYou can generate a local policy module to allow this access - see FAQ Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report against this package. Additional InformationSource Context:Â Â system_u:system_r:hald_t:s0Target Context:Â Â system_u:system_r:hald_t:s0Target Objects:Â Â None [ process ]Source:Â Â polkit-resolve-Source Path:Â Â /usr/libexec/polkit-resolve-exe-helperPort:Â Â <Unknown>Host:Â Â localhost.localdomainSource RPM Packages:Â Â PolicyKit-0.8-0.git20080404.3.fc9Target RPM Packages:Â Â Policy RPM:Â Â selinux-policy-3.3.1-33.fc9Selinux Enabled:Â Â TruePolicy Type:Â Â targetedMLS Enabled:Â Â TrueEnforcing Mode:Â Â EnforcingPlugin Name:Â Â catchallHost Name:Â Â localhost.localdomainPlatform:Â Â Linux localhost.localdomain 2.6.25-0.218.rc8.git7.fc9.x86_64 #1 SMP Wed Apr 9 19:55:19 EDT 2008 x86_64 x86_64Alert Count:Â Â 40First Seen:Â Â miÃ° 16.apr 2008, 07:58:25 GMTLast Seen:Â Â fim 17.apr 2008, 00:33:04 GMTLocal ID:Â Â 03edab37-0bcd-443e-9101-a9b957e25ea7Line Numbers:Â Â Raw Audit Messages :host=localhost.localdomain type=AVC msg=audit(1208392384.188:15): avc: denied { getattr } for pid=2764 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process host=localhost.localdomain type=SYSCALL msg=audit(1208392384.188:15): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=18442a0 a2=fff a3=0 items=0 ppid=2028 pid=2764 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null) 
>
>
>--------------------
>
>[root@localhost ~]# cd /media
>[root@localhost media]# ll
>total 0
>[root@localhost media]# 
>
>-------------------
>
>[root@localhost media]# fdisk -l
>
>Disk /dev/sda: 120.0 GB, 120033041920 bytes
>255 heads, 63 sectors/track, 14593 cylinders
>Units = cylinders of 16065 * 512 = 8225280 bytes
>Disk identifier: 0xffffffff
>
>   Device Boot      Start         End      Blocks   Id  System
>/dev/sda1   *           1       10000    80324968+  83  Linux
>/dev/sda2           10001       14593    36893272+  83  Linux
>
>Disk /dev/sdb: 200.0 GB, 200049647616 bytes
>255 heads, 63 sectors/track, 24321 cylinders
>Units = cylinders of 16065 * 512 = 8225280 bytes
>Disk identifier: 0x241cb171
>
>   Device Boot      Start         End      Blocks   Id  System
>/dev/sdb1   *           1          25      200781   83  Linux
>/dev/sdb2              26       24321   195157620   8e  Linux LVM
>
>Disk /dev/sdc: 40.0 GB, 40060403712 bytes
>255 heads, 63 sectors/track, 4870 cylinders
>Units = cylinders of 16065 * 512 = 8225280 bytes
>Disk identifier: 0x0001acc4
>
>   Device Boot      Start         End      Blocks   Id  System
>/dev/sdc1   *           1          25      200781   83  Linux
>/dev/sdc2              26        4870    38917462+  8e  Linux LVM
>
>Disk /dev/dm-0: 197.7 GB, 197702713344 bytes
>255 heads, 63 sectors/track, 24035 cylinders
>Units = cylinders of 16065 * 512 = 8225280 bytes
>Disk identifier: 0x00000000
>
>Disk /dev/dm-0 doesn't contain a valid partition table
>
>Disk /dev/dm-1: 2080 MB, 2080374784 bytes
>255 heads, 63 sectors/track, 252 cylinders
>Units = cylinders of 16065 * 512 = 8225280 bytes
>Disk identifier: 0x30307800
>
>Disk /dev/dm-1 doesn't contain a valid partition table
>
>Disk /dev/dm-2: 37.7 GB, 37715181568 bytes
>255 heads, 63 sectors/track, 4585 cylinders
>Units = cylinders of 16065 * 512 = 8225280 bytes
>Disk identifier: 0x00000000
>
>Disk /dev/dm-2 doesn't contain a valid partition table
>
>Disk /dev/dm-3: 2080 MB, 2080374784 bytes
>255 heads, 63 sectors/track, 252 cylinders
>Units = cylinders of 16065 * 512 = 8225280 bytes
>Disk identifier: 0x30307800
>
>Disk /dev/dm-3 doesn't contain a valid partition table
>[root@localhost media]# 
>
>-------------------------------------------------------------------------
>
>---------------------------------------------
>
>[root@localhost /]# ll -Z
>drwxr-xr-x  root root system_u:object_r:bin_t:s0       bin
>drwxr-xr-x  root root system_u:object_r:boot_t:s0      boot
>drwxr-xr-x  root root system_u:object_r:device_t:s0    dev
>drwxr-xr-x  root root system_u:object_r:etc_t:s0       etc
>drwxr-xr-x  root root system_u:object_r:home_root_t:s0 home
>drwxr-xr-x  root root system_u:object_r:lib_t:s0       lib
>drwxr-xr-x  root root system_u:object_r:lib_t:s0       lib64
>drwx------  root root system_u:object_r:lost_found_t:s0 lost+found
>drwxr-xrwx  root root system_u:object_r:mnt_t:s0       media
>drwxr-xr-x  root root system_u:object_r:autofs_t:s0    misc
>drwxr-xr-x  root root system_u:object_r:mnt_t:s0       mnt
>drwxr-xr-x  root root system_u:object_r:autofs_t:s0    net
>drwxr-xr-x  root root system_u:object_r:usr_t:s0       opt
>dr-xr-xr-x  root root system_u:object_r:proc_t:s0      proc
>drwxr-x---  root root system_u:object_r:admin_home_t:s0 root
>drwxr-xr-x  root root system_u:object_r:bin_t:s0       sbin
>drwxr-xr-x  root root system_u:object_r:security_t:s0  selinux
>drwxr-xr-x  root root system_u:object_r:var_t:s0       srv
>drwxr-xr-x  root root system_u:object_r:sysfs_t:s0     sys
>drwxrwxrwt  root root system_u:object_r:tmp_t:s0       tmp
>drwxr-xr-x  root root system_u:object_r:usr_t:s0       usr
>drwxr-xr-x  root root system_u:object_r:var_t:s0       var
>[root@localhost /]# 
>-----------------------------
>su - 
>[root@localhost /]# cd /media
>[root@localhost media]# ll -Z
>[root@localhost media]# 
>
>
>=======
>logdinn as root
>[root@localhost ~]# cd /media
>[root@localhost media]# ll -Z
>drwxr-xrwx  root root system_u:object_r:boot_t:s0      _boot1
>drwxr-xrwx  root root system_u:object_r:default_t:s0   _tonlist
>drwxr-xrwx  root root system_u:object_r:default_t:s0   _ymislegt
>[root@localhost media]# 
>[root@localhost media]# 
>
>--------------------
>after loging out user floki and login in as root an then log in as user floki
>[floki@localhost ~]$ cd /media
>[floki@localhost media]$ ll -Z
>drwxr-xrwx  root root system_u:object_r:boot_t:s0      _boot1
>drwxr-xrwx  root root system_u:object_r:default_t:s0   _tonlist
>drwxr-xrwx  root root system_u:object_r:default_t:s0   _ymislegt
>[floki@localhost media]$ 
>
>
>
>

Actions: View

Attachments on bug 442823: 302687 | 302688