Attachment 574521 Details for Bug 809120 – sealert -l cec6e0ba-8123-4668-81da-3056221d0470

sealert -l cec6e0ba-8123-4668-81da-3056221d0470

sealert-cec6e0ba-8123-4668-81da-3056221d0470 (text/plain), 2.78 KB, created by Ralf Corsepius on 2012-04-02 14:22:07 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ralf Corsepius

Created: 2012-04-02 14:22:07 UTC

Size: 2.78 KB

patch

obsolete

>SELinux is preventing /usr/lib64/yp/ypxfr from 'read, write' accesses on the file /run/ypserv.pid.
>
>*****  Plugin leaks (50.5 confidence) suggests  ******************************
>
>If you want to ignore ypxfr trying to read write access the ypserv.pid file, because you believe it should not need this access.
>Then you should report this as a bug.  
>You can generate a local policy module to dontaudit this access.
>Do
># grep /usr/lib64/yp/ypxfr /var/log/audit/audit.log | audit2allow -D -M mypol
># semodule -i mypol.pp
>
>*****  Plugin catchall (50.5 confidence) suggests  ***************************
>
>If you believe that ypxfr should be allowed read write access on the ypserv.pid file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep ypxfr /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:ypxfr_t:s0
>Target Context                system_u:object_r:ypserv_var_run_t:s0
>Target Objects                /run/ypserv.pid [ file ]
>Source                        ypxfr
>Source Path                   /usr/lib64/yp/ypxfr
>Port                          <Unknown>
>Host                          beck
>Source RPM Packages           ypserv-2.26-9.fc16.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.10.0-80.fc16.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Enforcing
>Host Name                     beck
>Platform                      Linux beck 3.3.0-8.fc16.x86_64 #1 SMP Thu Mar 29
>                              18:37:19 UTC 2012 x86_64 x86_64
>Alert Count                   2
>First Seen                    Mon 02 Apr 2012 01:45:16 PM CEST
>Last Seen                     Mon 02 Apr 2012 01:46:46 PM CEST
>Local ID                      cec6e0ba-8123-4668-81da-3056221d0470
>
>Raw Audit Messages
>type=AVC msg=audit(1333367206.910:88): avc:  denied  { read write } for  pid=2291 comm="ypxfr" path="/run/ypserv.pid" dev="tmpfs" ino=19891 scontext=system_u:system_r:ypxfr_t:s0 tcontext=system_u:object_r:ypserv_var_run_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1333367206.910:88): arch=x86_64 syscall=execve success=yes exit=0 a0=7fff562bcbc0 a1=7fff562baaf0 a2=7fff562bd610 a3=7fff562bc910 items=0 ppid=1084 pid=2291 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=ypxfr exe=/usr/lib64/yp/ypxfr subj=system_u:system_r:ypxfr_t:s0 key=(null)
>
>Hash: ypxfr,ypxfr_t,ypserv_var_run_t,file,read,write
>
>audit2allow
>
>#============= ypxfr_t ==============
>allow ypxfr_t ypserv_var_run_t:file { read write };
>
>audit2allow -R
>
>#============= ypxfr_t ==============
>allow ypxfr_t ypserv_var_run_t:file { read write };
>
>

Actions: View

Attachments on bug 809120: 574521