Attachment 303633 Details for Bug 443982 – selinux alerts i encounter

selinux alerts i encounter

selinux_alert1.txt (text/plain), 5.17 KB, created by Martin Jürgens on 2008-04-24 14:10:50 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Jürgens

Created: 2008-04-24 14:10:50 UTC

Size: 5.17 KB

patch

obsolete

>
>Zusammenfassung:
>
>SELinux is preventing the qemu from using potentially mislabeled files
>(./CentOS-5.1-i386-bin-DVD.iso).
>
>Detaillierte Beschreibung:
>
>[SELinux is in permissive mode, the operation would have been denied but was
>permitted due to permissive mode.]
>
>SELinux has denied qemu access to potentially mislabeled file(s)
>(./CentOS-5.1-i386-bin-DVD.iso). This means that SELinux will not allow qemu to
>use these files. It is common for users to edit files in their home directory or
>tmp directories and then move (mv) them to system directories. The problem is
>that the files end up with the wrong file context which confined applications
>are not allowed to access.
>
>Zugriff erlauben:
>
>If you want qemu to access this files, you need to relabel them using restorecon
>-v './CentOS-5.1-i386-bin-DVD.iso'. You might want to relabel the entire
>directory using restorecon -R -v '.'.
>
>ZusÃ¤tzliche Informationen:
>
>Quellkontext                  system_u:system_r:qemu_t:s0
>Zielkontext                   system_u:object_r:user_home_t:s0
>Zielobjekte                   ./CentOS-5.1-i386-bin-DVD.iso [ file ]
>Source                        qemu
>Source Path                   /usr/bin/qemu
>Port                          <Unbekannt>
>Host                          medora
>Source RPM Packages           qemu-0.9.1-5.fc9
>Target RPM Packages           
>RPM-Richtlinie                selinux-policy-3.3.1-35.fc9
>SELinux aktiviert             True
>Richtlinienversion            targeted
>MLS aktiviert                 True
>Enforcing-Modus               Permissive
>Plugin-Name                   home_tmp_bad_labels
>Hostname                      medora
>Plattform                     Linux medora 2.6.25-1.fc9.i686 #1 SMP Thu Apr 17
>                              01:47:10 EDT 2008 i686 athlon
>Anzahl der Alarme             1
>Zuerst gesehen                Do 24 Apr 2008 16:09:52 CEST
>Zuletzt gesehen               Do 24 Apr 2008 16:09:52 CEST
>Lokale ID                     60a76866-b5c1-4e21-a1ef-300112cb79c7
>Zeilennummern                 
>
>Raw-Audit-Meldungen           
>
>host=medora type=AVC msg=audit(1209046192.935:75): avc:  denied  { read } for  pid=5021 comm="qemu" name="CentOS-5.1-i386-bin-DVD.iso" dev=sda1 ino=15712259 scontext=system_u:system_r:qemu_t:s0 tcontext=system_u:object_r:user_home_t:s0 tclass=file
>
>host=medora type=SYSCALL msg=audit(1209046192.935:75): arch=40000003 syscall=5 success=yes exit=4 a0=bfc434b0 a1=8000 a2=0 a3=8000 items=0 ppid=2177 pid=5021 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="qemu" exe="/usr/bin/qemu" subj=system_u:system_r:qemu_t:s0 key=(null)
>
>
>
>
>Zusammenfassung:
>
>SELinux is preventing the qemu from using potentially mislabeled files
>(/home/martin/CentOS.img).
>
>Detaillierte Beschreibung:
>
>[SELinux is in permissive mode, the operation would have been denied but was
>permitted due to permissive mode.]
>
>SELinux has denied qemu access to potentially mislabeled file(s)
>(/home/martin/CentOS.img). This means that SELinux will not allow qemu to use
>these files. It is common for users to edit files in their home directory or tmp
>directories and then move (mv) them to system directories. The problem is that
>the files end up with the wrong file context which confined applications are not
>allowed to access.
>
>Zugriff erlauben:
>
>If you want qemu to access this files, you need to relabel them using restorecon
>-v '/home/martin/CentOS.img'. You might want to relabel the entire directory
>using restorecon -R -v '/home/martin'.
>
>ZusÃ¤tzliche Informationen:
>
>Quellkontext                  system_u:system_r:qemu_t:s0
>Zielkontext                   unconfined_u:object_r:user_home_t:s0
>Zielobjekte                   /home/martin/CentOS.img [ file ]
>Source                        qemu
>Source Path                   /usr/bin/qemu
>Port                          <Unbekannt>
>Host                          medora
>Source RPM Packages           qemu-0.9.1-5.fc9
>Target RPM Packages           
>RPM-Richtlinie                selinux-policy-3.3.1-35.fc9
>SELinux aktiviert             True
>Richtlinienversion            targeted
>MLS aktiviert                 True
>Enforcing-Modus               Permissive
>Plugin-Name                   home_tmp_bad_labels
>Hostname                      medora
>Plattform                     Linux medora 2.6.25-1.fc9.i686 #1 SMP Thu Apr 17
>                              01:47:10 EDT 2008 i686 athlon
>Anzahl der Alarme             2
>Zuerst gesehen                Do 24 Apr 2008 16:09:08 CEST
>Zuletzt gesehen               Do 24 Apr 2008 16:09:52 CEST
>Lokale ID                     9a9ff707-8093-4b6e-bc11-17b7cbe6ba37
>Zeilennummern                 
>
>Raw-Audit-Meldungen           
>
>host=medora type=AVC msg=audit(1209046192.892:71): avc:  denied  { getattr } for  pid=5021 comm="qemu" path="/home/martin/CentOS.img" dev=sda1 ino=22429726 scontext=system_u:system_r:qemu_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
>
>host=medora type=SYSCALL msg=audit(1209046192.892:71): arch=40000003 syscall=195 success=yes exit=0 a0=bfc434b0 a1=bfc40af0 a2=d8eff4 a3=bfc434b0 items=0 ppid=2177 pid=5021 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="qemu" exe="/usr/bin/qemu" subj=system_u:system_r:qemu_t:s0 key=(null)
>
>

Actions: View

Attachments on bug 443982: 303633