Attachment 646327 Details for Bug 877417 – Selinux annoyances.

Selinux annoyances.

selinux.txt (text/plain), 2.71 KB, created by Ali Akcaagac on 2012-11-16 13:19:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ali Akcaagac

Created: 2012-11-16 13:19:49 UTC

Size: 2.71 KB

patch

obsolete

>SELinux is preventing wine-preloader from mmap_zero access on the memprotect .
>
>*****  Plugin mmap_zero (53.1 confidence) suggests  **************************
>
>If you do not think wine-preloader should need to mmap low memory in the kernel.
>Then you may be under attack by a hacker, this is a very dangerous access.
>Do
>contact your security administrator and report this issue.
>
>*****  Plugin catchall_boolean (42.6 confidence) suggests  *******************
>
>If you want to mmap_low_allowed
>Then you must tell SELinux about this by enabling the 'mmap_low_allowed' boolean.You can read 'wine_selinux' man page for more details.
>Do
>setsebool -P mmap_low_allowed 1
>
>*****  Plugin catchall (5.76 confidence) suggests  ***************************
>
>If you believe that wine-preloader should be allowed mmap_zero access on the  memprotect by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep wine-preloader /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023
>Target Context                unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023
>Target Objects                 [ memprotect ]
>Source                        wine-preloader
>Source Path                   wine-preloader
>Port                          <Unknown>
>Host                          localhost.localdomain
>Source RPM Packages           
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.10.0-159.fc17.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Enforcing
>Host Name                     localhost.localdomain
>Platform                      Linux localhost.localdomain 3.6.6-1.fc17.i686 #1
>                              SMP Mon Nov 5 22:11:18 UTC 2012 i686 i686
>Alert Count                   8
>First Seen                    2012-11-16 13:54:49 CET
>Last Seen                     2012-11-16 13:54:53 CET
>Local ID                      e8acf894-5316-4f53-ad9b-f2e779741106
>
>Raw Audit Messages
>type=AVC msg=audit(1353070493.10:133): avc:  denied  { mmap_zero } for  pid=1553 comm="wine-preloader" scontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:wine_t:s0-s0:c0.c1023 tclass=memprotect
>
>
>Hash: wine-preloader,wine_t,wine_t,memprotect,mmap_zero
>
>audit2allow
>
>#============= wine_t ==============
>#!!!! This avc can be allowed using the boolean 'mmap_low_allowed'
>
>allow wine_t self:memprotect mmap_zero;
>
>audit2allow -R
>
>#============= wine_t ==============
>#!!!! This avc can be allowed using the boolean 'mmap_low_allowed'
>
>allow wine_t self:memprotect mmap_zero;
>
>

Actions: View

Attachments on bug 877417: 646327