Attachment 476389 Details for Bug 674316 – sealert results

sealert results

amanda_alert.txt (text/plain), 2.39 KB, created by Mike Leech on 2011-02-01 12:53:09 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mike Leech

Created: 2011-02-01 12:53:09 UTC

Size: 2.39 KB

patch

obsolete

>
>Summary:
>
>SELinux is preventing /bin/ps "getattr" access on /proc/.
>
>Detailed Description:
>
>[SELinux is in permissive mode. This access was not denied.]
>
>SELinux denied access requested by ps. It is not expected that this access is
>required by ps and this access may signal an intrusion attempt. It is also
>possible that the specific version or configuration of the application is
>causing it to require additional access.
>
>Allowing Access:
>
>You can generate a local policy module to allow this access - see FAQ
>(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
>report.
>
>Additional Information:
>
>Source Context                unconfined_u:system_r:amanda_t:s0-s0:c0.c1023
>Target Context                system_u:system_r:kernel_t:s0
>Target Objects                /proc/<pid> [ dir ]
>Source                        ps
>Source Path                   /bin/ps
>Port                          <Unknown>
>Host                          serv0001.cs.diamond.ac.uk
>Source RPM Packages           procps-3.2.8-14.el6
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.7.19-54.el6_0.3
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Plugin Name                   catchall
>Host Name                     serv0001.cs.diamond.ac.uk
>Platform                      Linux serv0001.cs.diamond.ac.uk
>                              2.6.32-71.7.1.el6.x86_64 #1 SMP Wed Oct 27
>                              03:44:59 EDT 2010 x86_64 x86_64
>Alert Count                   216
>First Seen                    Tue Feb  1 10:36:12 2011
>Last Seen                     Tue Feb  1 11:01:02 2011
>Local ID                      6a5f896c-42e6-49ba-b260-1c9d04062d42
>Line Numbers                  
>
>Raw Audit Messages            
>
>node=serv0001.cs.diamond.ac.uk type=AVC msg=audit(1296558062.418:28836955): avc:  denied  { getattr } for  pid=19027 comm="ps" path="/proc/109" dev=proc ino=693275 scontext=unconfined_u:system_r:amanda_t:s0-s0:c0.c1023 tcontext=system_u:system_r:kernel_t:s0 tclass=dir
>
>node=serv0001.cs.diamond.ac.uk type=SYSCALL msg=audit(1296558062.418:28836955): arch=c000003e syscall=4 success=no exit=-13 a0=216f220 a1=35eec11ca0 a2=35eec11ca0 a3=216f226 items=0 ppid=19024 pid=19027 auid=0 uid=33 gid=6 euid=33 suid=33 fsuid=33 egid=6 sgid=6 fsgid=6 tty=(none) ses=11189 comm="ps" exe="/bin/ps" subj=unconfined_u:system_r:amanda_t:s0-s0:c0.c1023 key=(null)
>
>
>

Actions: View

Attachments on bug 674316: 476389 | 476392