Attachment 605025 Details for Bug 848939 – avc denials in permissive mode

avc denials in permissive mode

puppetmaster-passenger.log (text/x-log), 18.21 KB, created by Orion Poplawski on 2012-08-16 21:14:08 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Orion Poplawski

Created: 2012-08-16 21:14:08 UTC

Size: 18.21 KB

patch

obsolete

>type=AVC msg=audit(1345150374.702:75): avc:  denied  { create } for  pid=2719 comm="ruby" name="ext" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=dir
>type=AVC msg=audit(1345150374.702:76): avc:  denied  { create } for  pid=2719 comm="ruby" name=".permission_test" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file
>type=AVC msg=audit(1345150374.702:76): avc:  denied  { write } for  pid=2719 comm="ruby" path="/usr/share/gems/gems/passenger-3.0.14/ext/ruby/native/.permission_test" dev="vda2" ino=11727 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file
>type=AVC msg=audit(1345150374.702:77): avc:  denied  { unlink } for  pid=2719 comm="ruby" name=".permission_test" dev="vda2" ino=11727 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file
>type=AVC msg=audit(1345151005.627:101): avc:  denied  { create } for  pid=2989 comm="ruby" name=".permission_test" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file
>type=AVC msg=audit(1345151005.627:101): avc:  denied  { write } for  pid=2989 comm="ruby" path="/usr/share/gems/gems/passenger-3.0.14/ext/ruby/native/.permission_test" dev="vda2" ino=11722 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file
>type=AVC msg=audit(1345151005.627:102): avc:  denied  { unlink } for  pid=2989 comm="ruby" name=".permission_test" dev="vda2" ino=11722 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file
>type=AVC msg=audit(1345151545.015:117): avc:  denied  { search } for  pid=21105 comm="ruby" name="puppet" dev="vda2" ino=392393 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_etc_t:s0 tclass=dir
>type=AVC msg=audit(1345151545.015:117): avc:  denied  { getattr } for  pid=21105 comm="ruby" path="/etc/puppet/modules" dev="vda2" ino=393326 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_etc_t:s0 tclass=dir
>type=AVC msg=audit(1345151545.015:118): avc:  denied  { read } for  pid=21105 comm="ruby" name="modules" dev="vda2" ino=393326 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_etc_t:s0 tclass=dir
>type=AVC msg=audit(1345151545.015:118): avc:  denied  { open } for  pid=21105 comm="ruby" path="/etc/puppet/modules" dev="vda2" ino=393326 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_etc_t:s0 tclass=dir
>type=AVC msg=audit(1345151545.316:119): avc:  denied  { getattr } for  pid=21105 comm="ruby" path="/etc/puppet/puppet.conf" dev="vda2" ino=393462 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_etc_t:s0 tclass=file
>type=AVC msg=audit(1345151545.316:120): avc:  denied  { read } for  pid=21105 comm="ruby" name="puppet.conf" dev="vda2" ino=393462 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_etc_t:s0 tclass=file
>type=AVC msg=audit(1345151545.316:120): avc:  denied  { open } for  pid=21105 comm="ruby" path="/etc/puppet/puppet.conf" dev="vda2" ino=393462 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_etc_t:s0 tclass=file
>type=AVC msg=audit(1345151545.316:121): avc:  denied  { ioctl } for  pid=21105 comm="ruby" path="/etc/puppet/puppet.conf" dev="vda2" ino=393462 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_etc_t:s0 tclass=file
>type=AVC msg=audit(1345151545.367:122): avc:  denied  { search } for  pid=21105 comm="ruby" name="puppet" dev="vda2" ino=130427 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_log_t:s0 tclass=dir
>type=AVC msg=audit(1345151545.369:123): avc:  denied  { search } for  pid=21105 comm="ruby" name="puppet" dev="tmpfs" ino=11590 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_var_run_t:s0 tclass=dir
>type=AVC msg=audit(1345151545.410:124): avc:  denied  { getattr } for  pid=21105 comm="ruby" path="/var/log/puppet" dev="vda2" ino=130427 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_log_t:s0 tclass=dir
>type=AVC msg=audit(1345151545.418:125): avc:  denied  { getattr } for  pid=21105 comm="ruby" path="/run/puppet" dev="tmpfs" ino=11590 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_var_run_t:s0 tclass=dir
>type=AVC msg=audit(1345151545.644:126): avc:  denied  { write } for  pid=21105 comm="ruby" name="puppet" dev="vda2" ino=130427 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_log_t:s0 tclass=dir
>type=AVC msg=audit(1345151545.644:126): avc:  denied  { add_name } for  pid=21105 comm="ruby" name="masterhttp.log" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_log_t:s0 tclass=dir
>type=AVC msg=audit(1345151545.644:126): avc:  denied  { create } for  pid=21105 comm="ruby" name="masterhttp.log" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_log_t:s0 tclass=file
>type=AVC msg=audit(1345151545.644:126): avc:  denied  { write open } for  pid=21105 comm="ruby" path="/var/log/puppet/masterhttp.log" dev="vda2" ino=158520 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_log_t:s0 tclass=file
>type=AVC msg=audit(1345151546.055:127): avc:  denied  { read } for  pid=21105 comm="ruby" name="files" dev="vda2" ino=133553 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=dir
>type=AVC msg=audit(1345151547.849:128): avc:  denied  { name_bind } for  pid=21132 comm="ruby" src=15600 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=udp_socket
>type=AVC msg=audit(1345151547.861:129): avc:  denied  { write } for  pid=21132 comm="ruby" name="orca.cora.nwra.com.yaml" dev="vda2" ino=158435 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=file
>type=AVC msg=audit(1345151548.420:130): avc:  denied  { search } for  pid=21143 comm="rpm" name="rpm" dev="vda2" ino=129637 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
>type=AVC msg=audit(1345151548.420:131): avc:  denied  { getattr } for  pid=21143 comm="rpm" path="/var/lib/rpm" dev="vda2" ino=129637 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
>type=AVC msg=audit(1345151548.420:132): avc:  denied  { open } for  pid=21143 comm="rpm" path="/var/lib/rpm/Packages" dev="vda2" ino=129641 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
>type=AVC msg=audit(1345151549.002:133): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=7657 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file
>type=AVC msg=audit(1345151549.002:133): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/1/stat" dev="proc" ino=7657 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file
>type=AVC msg=audit(1345151549.002:134): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=7660 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=file
>type=AVC msg=audit(1345151549.002:134): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/2/stat" dev="proc" ino=7660 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=file
>type=AVC msg=audit(1345151549.004:135): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=8680 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tclass=file
>type=AVC msg=audit(1345151549.004:135): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/359/stat" dev="proc" ino=8680 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tclass=file
>type=AVC msg=audit(1345151549.004:136): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=8704 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=file
>type=AVC msg=audit(1345151549.004:136): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/362/stat" dev="proc" ino=8704 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=file
>type=AVC msg=audit(1345151549.005:137): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=11230 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:irqbalance_t:s0 tclass=file
>type=AVC msg=audit(1345151549.005:137): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/520/stat" dev="proc" ino=11230 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:irqbalance_t:s0 tclass=file
>type=AVC msg=audit(1345151549.005:138): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=11766 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:auditd_t:s0 tclass=file
>type=AVC msg=audit(1345151549.005:138): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/542/stat" dev="proc" ino=11766 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:auditd_t:s0 tclass=file
>type=AVC msg=audit(1345151549.005:139): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=11812 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:systemd_logind_t:s0 tclass=file
>type=AVC msg=audit(1345151549.005:139): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/547/stat" dev="proc" ino=11812 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:systemd_logind_t:s0 tclass=file
>type=AVC msg=audit(1345151549.005:140): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=11237 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:mcelog_t:s0 tclass=file
>type=AVC msg=audit(1345151549.005:140): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/562/stat" dev="proc" ino=11237 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:mcelog_t:s0 tclass=file
>type=AVC msg=audit(1345151549.005:141): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=11965 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:gssd_t:s0 tclass=file
>type=AVC msg=audit(1345151549.005:141): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/563/stat" dev="proc" ino=11965 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:gssd_t:s0 tclass=file
>type=AVC msg=audit(1345151549.005:142): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=11252 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:apmd_t:s0 tclass=file
>type=AVC msg=audit(1345151549.005:142): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/565/stat" dev="proc" ino=11252 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:apmd_t:s0 tclass=file
>type=AVC msg=audit(1345151549.006:143): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=12019 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=file
>type=AVC msg=audit(1345151549.006:143): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/582/stat" dev="proc" ino=12019 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=file
>type=AVC msg=audit(1345151549.006:144): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=12420 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=file
>type=AVC msg=audit(1345151549.006:144): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/588/stat" dev="proc" ino=12420 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=file
>type=AVC msg=audit(1345151549.006:145): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=12174 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=file
>type=AVC msg=audit(1345151549.006:145): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/674/stat" dev="proc" ino=12174 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=file
>type=AVC msg=audit(1345151549.007:146): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=15240 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:dhcpc_t:s0 tclass=file
>type=AVC msg=audit(1345151549.007:146): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/721/stat" dev="proc" ino=15240 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:dhcpc_t:s0 tclass=file
>type=AVC msg=audit(1345151549.007:147): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=13692 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=file
>type=AVC msg=audit(1345151549.007:147): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/805/stat" dev="proc" ino=13692 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=file
>type=AVC msg=audit(1345151549.007:148): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=13732 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:rpcbind_t:s0 tclass=file
>type=AVC msg=audit(1345151549.007:148): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/808/stat" dev="proc" ino=13732 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:rpcbind_t:s0 tclass=file
>type=AVC msg=audit(1345151549.007:149): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=13835 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:inetd_t:s0-s0:c0.c1023 tclass=file
>type=AVC msg=audit(1345151549.007:149): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/810/stat" dev="proc" ino=13835 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:inetd_t:s0-s0:c0.c1023 tclass=file
>type=AVC msg=audit(1345151549.007:150): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=15454 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:automount_t:s0 tclass=file
>type=AVC msg=audit(1345151549.007:150): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/814/stat" dev="proc" ino=15454 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:automount_t:s0 tclass=file
>type=AVC msg=audit(1345151549.007:151): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=14585 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:rpcd_t:s0 tclass=file
>type=AVC msg=audit(1345151549.007:151): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/834/stat" dev="proc" ino=14585 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:rpcd_t:s0 tclass=file
>type=AVC msg=audit(1345151549.008:152): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=15256 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:puppet_t:s0 tclass=file
>type=AVC msg=audit(1345151549.008:152): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/885/stat" dev="proc" ino=15256 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:puppet_t:s0 tclass=file
>type=AVC msg=audit(1345151549.008:153): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=14919 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:getty_t:s0 tclass=file
>type=AVC msg=audit(1345151549.008:153): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/908/stat" dev="proc" ino=14919 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:getty_t:s0 tclass=file
>type=AVC msg=audit(1345151549.008:154): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=15260 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file
>type=AVC msg=audit(1345151549.008:154): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/923/stat" dev="proc" ino=15260 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file
>type=AVC msg=audit(1345151549.008:155): avc:  denied  { read } for  pid=21153 comm="ps" name="stat" dev="proc" ino=40251 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 tclass=file
>type=AVC msg=audit(1345151549.008:155): avc:  denied  { open } for  pid=21153 comm="ps" path="/proc/2928/stat" dev="proc" ino=40251 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 tclass=file
>type=AVC msg=audit(1345151563.410:156): avc:  denied  { write } for  pid=21132 comm="ruby" name="orca.cora.nwra.com" dev="vda2" ino=133961 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=dir
>type=AVC msg=audit(1345151563.410:156): avc:  denied  { add_name } for  pid=21132 comm="ruby" name="201208162112.yaml20120816-21132-s585s7.lock" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=dir
>type=AVC msg=audit(1345151563.410:156): avc:  denied  { create } for  pid=21132 comm="ruby" name="201208162112.yaml20120816-21132-s585s7.lock" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=dir
>type=AVC msg=audit(1345151563.410:157): avc:  denied  { create } for  pid=21132 comm="ruby" name="201208162112.yaml20120816-21132-s585s7" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=file
>type=AVC msg=audit(1345151563.410:158): avc:  denied  { remove_name } for  pid=21132 comm="ruby" name="201208162112.yaml20120816-21132-s585s7.lock" dev="vda2" ino=158521 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=dir
>type=AVC msg=audit(1345151563.410:158): avc:  denied  { rmdir } for  pid=21132 comm="ruby" name="201208162112.yaml20120816-21132-s585s7.lock" dev="vda2" ino=158521 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=dir
>type=AVC msg=audit(1345151563.411:159): avc:  denied  { setattr } for  pid=21132 comm="ruby" name="201208162112.yaml20120816-21132-s585s7" dev="vda2" ino=158522 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=file
>type=AVC msg=audit(1345151563.492:160): avc:  denied  { rename } for  pid=21132 comm="ruby" name="201208162112.yaml20120816-21132-s585s7" dev="vda2" ino=158522 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=file

Actions: View

Attachments on bug 848939: 605025 | 606667 | 626105 | 856689