Attachment 304627 Details for Bug 444670 – SELinux AVCs - Enforcing Mode

SELinux AVCs - Enforcing Mode

se-podsleuth-enforcing (text/plain), 4.38 KB, created by Nigel Jones on 2008-05-06 11:58:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nigel Jones

Created: 2008-05-06 11:58:01 UTC

Size: 4.38 KB

patch

obsolete

>After reattaching iPod when getenforce returns "Enforcing"
>
>May  6 23:44:57 rawhide kernel: usb 1-1: USB disconnect, address 8
>May  6 23:45:00 rawhide kernel: usb 1-1: new high speed USB device using ehci_hcd and address 9
>May  6 23:45:01 rawhide kernel: usb 1-1: configuration #1 chosen from 2 choices
>May  6 23:45:01 rawhide kernel: scsi10 : SCSI emulation for USB Mass Storage devices
>May  6 23:45:01 rawhide kernel: usb 1-1: New USB device found, idVendor=05ac, idProduct=1260
>May  6 23:45:01 rawhide kernel: usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
>May  6 23:45:01 rawhide kernel: usb 1-1: Product: iPod
>May  6 23:45:01 rawhide kernel: usb 1-1: Manufacturer: Apple
>May  6 23:45:01 rawhide kernel: usb 1-1: SerialNumber: [Valid Serial Number]
>May  6 23:45:06 rawhide kernel: scsi 10:0:0:0: Direct-Access     Apple    iPod             1.62 PQ: 0 ANSI: 0
>May  6 23:45:06 rawhide kernel: sd 10:0:0:0: [sdc] 1982464 2048-byte hardware sectors (4060 MB)
>May  6 23:45:06 rawhide kernel: sd 10:0:0:0: [sdc] Write Protect is off
>May  6 23:45:06 rawhide kernel: sd 10:0:0:0: [sdc] Assuming drive cache: write through
>May  6 23:45:06 rawhide kernel: sd 10:0:0:0: [sdc] 1982464 2048-byte hardware sectors (4060 MB)
>May  6 23:45:06 rawhide kernel: sd 10:0:0:0: [sdc] Write Protect is off
>May  6 23:45:06 rawhide kernel: sd 10:0:0:0: [sdc] Assuming drive cache: write through
>May  6 23:45:06 rawhide kernel:  sdc: sdc1 sdc2
>May  6 23:45:06 rawhide kernel: sd 10:0:0:0: [sdc] Attached SCSI removable disk
>May  6 23:45:06 rawhide kernel: sd 10:0:0:0: Attached scsi generic sg2 type 0
>May  6 23:45:06 rawhide setroubleshoot: SELinux is preventing mono (hald_t) "getsched" to <Unknown> (hald_t). For complete SELinux messages. run sealert -l c71d367c-61db-45cd-a1dc-cf135835660d
>May  6 23:45:06 rawhide setroubleshoot: SELinux is preventing mono (hald_t) "getsched" to <Unknown> (hald_t). For complete SELinux messages. run sealert -l c71d367c-61db-45cd-a1dc-cf135835660d
>
>[root@rawhide ~]#  sealert -l c71d367c-61db-45cd-a1dc-cf135835660d
>
>Summary:
>
>SELinux is preventing mono (hald_t) "getsched" to <Unknown> (hald_t).
>
>Detailed Description:
>
>SELinux denied access requested by mono. It is not expected that this access is
>required by mono and this access may signal an intrusion attempt. It is also
>possible that the specific version or configuration of the application is
>causing it to require additional access.
>
>Allowing Access:
>
>You can generate a local policy module to allow this access - see FAQ
>(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
>SELinux protection altogether. Disabling SELinux protection is not recommended.
>Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
>against this package.
>
>Additional Information:
>
>Source Context                system_u:system_r:hald_t:s0
>Target Context                system_u:system_r:hald_t:s0
>Target Objects                None [ process ]
>Source                        mono
>Source Path                   /usr/bin/mono
>Port                          <Unknown>
>Host                          rawhide.dev.jnet.net.nz
>Source RPM Packages           mono-core-1.9-7.fc9
>Target RPM Packages
>Policy RPM                    selinux-policy-3.3.1-35.fc9
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   catchall
>Host Name                     rawhide.dev.jnet.net.nz
>Platform                      Linux rawhide.dev.jnet.net.nz 2.6.25-1.fc9.x86_64
>                              #1 SMP Thu Apr 17 01:11:31 EDT 2008 x86_64 x86_64
>Alert Count                   16
>First Seen                    Tue Apr 29 23:12:31 2008
>Last Seen                     Tue May  6 23:45:06 2008
>Local ID                      c71d367c-61db-45cd-a1dc-cf135835660d
>Line Numbers
>
>Raw Audit Messages
>
>host=rawhide.dev.jnet.net.nz type=AVC msg=audit(1210074306.891:80): avc:  denied  { getsched } for  pid=3259 comm="mono" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>
>host=rawhide.dev.jnet.net.nz type=SYSCALL msg=audit(1210074306.891:80): arch=c000003e syscall=145 success=no exit=-13 a0=cbb a1=7fba31923ba8 a2=d a3=3c86b66fac items=0 ppid=3257 pid=3259 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mono" exe="/usr/bin/mono" subj=system_u:system_r:hald_t:s0 key=(null)

Actions: View

Attachments on bug 444670: 304202 | 304627 | 304628 | 304639 | 304759 | 304774 | 304776 | 304847 | 305021 | 305238