Attachment 308414 Details for Bug 430702 – SELinux is preventing validate (system_chkpwd_t) "append" to /var/log/httpd/error_log (httpd_log_t)

SELinux is preventing validate (system_chkpwd_t) "append" to /var/log/httpd/error_log (httpd_log_t)

selinux_alert.txt (text/plain), 5.82 KB, created by manoj on 2008-06-05 06:41:42 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: manoj

Created: 2008-06-05 06:41:42 UTC

Size: 5.82 KB

patch

obsolete

>
>Summary:
>
>SELinux is preventing validate (system_chkpwd_t) "append" to
>/var/log/httpd/error_log (httpd_log_t).
>
>Detailed Description:
>
>SELinux denied access requested by validate. It is not expected that this access
>is required by validate and this access may signal an intrusion attempt. It is
>also possible that the specific version or configuration of the application is
>causing it to require additional access.
>
>Allowing Access:
>
>Sometimes labeling problems can cause SELinux denials. You could try to restore
>the default system file context for /var/log/httpd/error_log,
>
>restorecon -v '/var/log/httpd/error_log'
>
>If this does not work, there is currently no automatic way to allow this access.
>Instead, you can generate a local policy module to allow this access - see FAQ
>(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
>SELinux protection altogether. Disabling SELinux protection is not recommended.
>Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
>against this package.
>
>Additional Information:
>
>Source Context                root:system_r:system_chkpwd_t
>Target Context                root:object_r:httpd_log_t
>Target Objects                /var/log/httpd/error_log [ file ]
>Source                        validate
>Source Path                   /usr/sbin/validate
>Port                          <Unknown>
>Host                          Rhel5u1.manojsuse.com
>Source RPM Packages           xandros-libapache2-mod-auth-shadow-2.0.x.7-4
>Target RPM Packages           
>Policy RPM                    selinux-policy-2.4.6-137.el5
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   catchall_file
>Host Name                     Rhel5u1.manojsuse.com
>Platform                      Linux Rhel5u1.manojsuse.com 2.6.18-92.el5 #1 SMP
>                              Tue Apr 29 13:16:12 EDT 2008 i686 athlon
>Alert Count                   3
>First Seen                    Thu 05 Jun 2008 10:31:21 AM IST
>Last Seen                     Thu 05 Jun 2008 10:31:21 AM IST
>Local ID                      65e1b1fe-4e41-4950-941e-3f710384e0f0
>Line Numbers                  
>
>Raw Audit Messages            
>
>host=Rhel5u1.manojsuse.com type=AVC msg=audit(1212642081.322:294): avc:  denied  { append } for  pid=16489 comm="validate" path="/var/log/httpd/error_log" dev=sda1 ino=1444442 scontext=root:system_r:system_chkpwd_t:s0 tcontext=root:object_r:httpd_log_t:s0 tclass=file
>
>host=Rhel5u1.manojsuse.com type=AVC msg=audit(1212642081.322:294): avc:  denied  { append } for  pid=16489 comm="validate" path="/var/log/httpd/error_log" dev=sda1 ino=1444442 scontext=root:system_r:system_chkpwd_t:s0 tcontext=root:object_r:httpd_log_t:s0 tclass=file
>
>host=Rhel5u1.manojsuse.com type=AVC msg=audit(1212642081.322:294): avc:  denied  { append } for  pid=16489 comm="validate" path="/var/log/httpd/ssl_error_log" dev=sda1 ino=1444443 scontext=root:system_r:system_chkpwd_t:s0 tcontext=root:object_r:httpd_log_t:s0 tclass=file
>
>host=Rhel5u1.manojsuse.com type=AVC msg=audit(1212642081.322:294): avc:  denied  { append } for  pid=16489 comm="validate" path="/var/log/httpd/nss_error_log" dev=sda1 ino=1444444 scontext=root:system_r:system_chkpwd_t:s0 tcontext=root:object_r:httpd_log_t:s0 tclass=file
>
>host=Rhel5u1.manojsuse.com type=AVC msg=audit(1212642081.322:294): avc:  denied  { append } for  pid=16489 comm="validate" path="/var/log/httpd/a1.com_error_log" dev=sda1 ino=1444455 scontext=root:system_r:system_chkpwd_t:s0 tcontext=root:object_r:httpd_log_t:s0 tclass=file
>
>host=Rhel5u1.manojsuse.com type=AVC msg=audit(1212642081.322:294): avc:  denied  { append } for  pid=16489 comm="validate" path="/var/log/httpd/access_log" dev=sda1 ino=1444445 scontext=root:system_r:system_chkpwd_t:s0 tcontext=root:object_r:httpd_log_t:s0 tclass=file
>
>host=Rhel5u1.manojsuse.com type=AVC msg=audit(1212642081.322:294): avc:  denied  { append } for  pid=16489 comm="validate" path="/var/log/httpd/ssl_access_log" dev=sda1 ino=1444446 scontext=root:system_r:system_chkpwd_t:s0 tcontext=root:object_r:httpd_log_t:s0 tclass=file
>
>host=Rhel5u1.manojsuse.com type=AVC msg=audit(1212642081.322:294): avc:  denied  { append } for  pid=16489 comm="validate" path="/var/log/httpd/ssl_request_log" dev=sda1 ino=1444447 scontext=root:system_r:system_chkpwd_t:s0 tcontext=root:object_r:httpd_log_t:s0 tclass=file
>
>host=Rhel5u1.manojsuse.com type=AVC msg=audit(1212642081.322:294): avc:  denied  { append } for  pid=16489 comm="validate" path="/var/log/httpd/nss_access_log" dev=sda1 ino=1444448 scontext=root:system_r:system_chkpwd_t:s0 tcontext=root:object_r:httpd_log_t:s0 tclass=file
>
>host=Rhel5u1.manojsuse.com type=AVC msg=audit(1212642081.322:294): avc:  denied  { append } for  pid=16489 comm="validate" path="/var/log/httpd/a1.com_access_log" dev=sda1 ino=1444456 scontext=root:system_r:system_chkpwd_t:s0 tcontext=root:object_r:httpd_log_t:s0 tclass=file
>
>host=Rhel5u1.manojsuse.com type=AVC msg=audit(1212642081.322:294): avc:  denied  { read write } for  pid=16489 comm="validate" path=2F746D702F2E4E5350522D41464D2D31353637312D396439306131382E30202864656C6574656429 dev=sda1 ino=1181282 scontext=root:system_r:system_chkpwd_t:s0 tcontext=root:object_r:httpd_tmp_t:s0 tclass=file
>
>host=Rhel5u1.manojsuse.com type=AVC msg=audit(1212642081.322:294): avc:  denied  { read } for  pid=16489 comm="validate" path="eventpoll:[64253]" dev=eventpollfs ino=64253 scontext=root:system_r:system_chkpwd_t:s0 tcontext=root:system_r:httpd_t:s0 tclass=file
>
>host=Rhel5u1.manojsuse.com type=SYSCALL msg=audit(1212642081.322:294): arch=40000003 syscall=11 success=yes exit=0 a0=bfeb136f a1=bfeb02f8 a2=9dcb7e8 a3=a165830 items=0 ppid=16416 pid=16489 auid=0 uid=48 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=1 comm="validate" exe="/usr/sbin/validate" subj=root:system_r:system_chkpwd_t:s0 key=(null)
>
>

Actions: View

Attachments on bug 430702: 293431 | 293432 | 296844 | 301484 | 308414