Attachment 680355 Details for Bug 896624 – Output from sealert -a audit.log > audit.log.sealert.txt

Output from sealert -a audit.log > audit.log.sealert.txt

audit.log.sealert.txt (text/plain), 19.07 KB, created by Roman Rakus on 2013-01-17 16:28:57 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Roman Rakus

Created: 2013-01-17 16:28:57 UTC

Size: 19.07 KB

patch

obsolete

>found 8 alerts in audit.log
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from read access on the file /var/log/wtmp.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed read access on the wtmp file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_t:s0
>Target Context                system_u:object_r:wtmp_t:s0
>Target Objects                /var/log/wtmp [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           initscripts-9.42.1-1.fc18.x86_64
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   2
>First Seen                    2013-01-17 15:43:08 CET
>Last Seen                     2013-01-17 15:43:11 CET
>Local ID                      5a5af858-73cf-4de4-8a3d-9aa0ded60a2f
>
>Raw Audit Messages
>type=AVC msg=audit(1358433791.660:4473): avc:  denied  { read } for  pid=25596 comm="cimprovagt" name="wtmp" dev="vda3" ino=146104 scontext=system_u:system_r:pegasus_t:s0 tcontext=system_u:object_r:wtmp_t:s0 tclass=file
>
>
>type=AVC msg=audit(1358433791.660:4473): avc:  denied  { open } for  pid=25596 comm="cimprovagt" path="/var/log/wtmp" dev="vda3" ino=146104 scontext=system_u:system_r:pegasus_t:s0 tcontext=system_u:object_r:wtmp_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358433791.660:4473): arch=x86_64 syscall=open success=yes exit=ECHILD a0=7f94f408a240 a1=80000 a2=7f94f408a240 a3=8 items=0 ppid=1 pid=25596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_t,wtmp_t,file,read
>
>audit2allow
>audit2allow -RBDB2053 Freeing read locks for locker 0x2ac9: 26195/140013679163328
>BDB2053 Freeing read locks for locker 0x2aca: 26195/140013679163328
>BDB2053 Freeing read locks for locker 0x2acb: 26195/140013679163328
>BDB2053 Freeing read locks for locker 0x2acc: 26195/140013679163328
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from write access on the file /etc/passwd-.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed write access on the passwd- file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_t:s0
>Target Context                system_u:object_r:passwd_file_t:s0
>Target Objects                /etc/passwd- [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   2
>First Seen                    2013-01-17 15:43:09 CET
>Last Seen                     2013-01-17 15:43:15 CET
>Local ID                      1af843cf-2058-446d-b655-215980142ae8
>
>Raw Audit Messages
>type=AVC msg=audit(1358433795.848:4532): avc:  denied  { write } for  pid=25596 comm="cimprovagt" name="passwd-" dev="vda3" ino=22906 scontext=system_u:system_r:pegasus_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358433795.848:4532): arch=x86_64 syscall=open success=yes exit=ENOTBLK a0=7f94f403bfd0 a1=41 a2=81a4 a3=d items=0 ppid=1 pid=25596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_t,passwd_file_t,file,write
>
>audit2allow
>audit2allow -R
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from setattr access on the file /etc/passwd-.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed setattr access on the passwd- file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_t:s0
>Target Context                system_u:object_r:passwd_file_t:s0
>Target Objects                /etc/passwd- [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   2
>First Seen                    2013-01-17 15:43:09 CET
>Last Seen                     2013-01-17 15:43:15 CET
>Local ID                      e90fb153-a6fd-4f6b-b78c-08421e22bf04
>
>Raw Audit Messages
>type=AVC msg=audit(1358433795.857:4533): avc:  denied  { setattr } for  pid=25596 comm="cimprovagt" name="passwd-" dev="vda3" ino=22906 scontext=system_u:system_r:pegasus_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358433795.857:4533): arch=x86_64 syscall=fchown success=yes exit=0 a0=f a1=0 a2=0 a3=28 items=0 ppid=1 pid=25596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_t,passwd_file_t,file,setattr
>
>audit2allow
>audit2allow -R
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from setattr access on the file /etc/shadow-.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed setattr access on the shadow- file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_t:s0
>Target Context                system_u:object_r:shadow_t:s0
>Target Objects                /etc/shadow- [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   2
>First Seen                    2013-01-17 15:43:09 CET
>Last Seen                     2013-01-17 15:43:17 CET
>Local ID                      f7e16b97-6f17-4348-ba66-84b25dccd37d
>
>Raw Audit Messages
>type=AVC msg=audit(1358433797.675:4571): avc:  denied  { setattr } for  pid=25638 comm="cimprovagt" name="shadow-" dev="vda3" ino=58 scontext=system_u:system_r:pegasus_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358433797.675:4571): arch=x86_64 syscall=fchown success=yes exit=0 a0=12 a1=0 a2=0 a3=28 items=0 ppid=1 pid=25638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_t,shadow_t,file,setattr
>
>audit2allow
>audit2allow -R
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from write access on the file /etc/shadow-.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed write access on the shadow- file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_t:s0
>Target Context                system_u:object_r:shadow_t:s0
>Target Objects                /etc/shadow- [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   2
>First Seen                    2013-01-17 15:43:09 CET
>Last Seen                     2013-01-17 15:43:17 CET
>Local ID                      9bfc4b45-f611-4990-8f1e-d53e3e8cca4a
>
>Raw Audit Messages
>type=AVC msg=audit(1358433797.667:4570): avc:  denied  { write } for  pid=25638 comm="cimprovagt" name="shadow-" dev="vda3" ino=58 scontext=system_u:system_r:pegasus_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358433797.667:4570): arch=x86_64 syscall=open success=yes exit=EXDEV a0=7f94f001ec00 a1=41 a2=8000 a3=d items=0 ppid=1 pid=25638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_t,shadow_t,file,write
>
>audit2allow
>audit2allow -R
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from setattr access on the directory account_test_user.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed setattr access on the account_test_user directory by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_t:s0
>Target Context                system_u:object_r:home_root_t:s0
>Target Objects                account_test_user [ dir ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-17 15:43:09 CET
>Last Seen                     2013-01-17 15:43:09 CET
>Local ID                      04b33302-149c-411e-9907-11528d9cee4a
>
>Raw Audit Messages
>type=AVC msg=audit(1358433789.908:4449): avc:  denied  { setattr } for  pid=25596 comm="cimprovagt" name="account_test_user" dev="vda3" ino=210106 scontext=system_u:system_r:pegasus_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
>
>
>type=SYSCALL msg=audit(1358433789.908:4449): arch=x86_64 syscall=chown success=yes exit=0 a0=7f94f4030550 a1=3ed a2=3e9 a3=7f95007f36d0 items=0 ppid=1 pid=25596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_t,home_root_t,dir,setattr
>
>audit2allow
>audit2allow -R
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from write access on the directory /home.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed write access on the home directory by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_t:s0
>Target Context                system_u:object_r:home_root_t:s0
>Target Objects                /home [ dir ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           filesystem-3.1-2.fc18.x86_64
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-17 15:43:09 CET
>Last Seen                     2013-01-17 15:43:09 CET
>Local ID                      ecaf3895-ce06-4360-a15d-a9a3a61d7c7a
>
>Raw Audit Messages
>type=AVC msg=audit(1358433789.908:4448): avc:  denied  { write } for  pid=25596 comm="cimprovagt" name="home" dev="vda3" ino=129321 scontext=system_u:system_r:pegasus_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
>
>
>type=AVC msg=audit(1358433789.908:4448): avc:  denied  { add_name } for  pid=25596 comm="cimprovagt" name="account_test_user" scontext=system_u:system_r:pegasus_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
>
>
>type=AVC msg=audit(1358433789.908:4448): avc:  denied  { create } for  pid=25596 comm="cimprovagt" name="account_test_user" scontext=system_u:system_r:pegasus_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
>
>
>type=SYSCALL msg=audit(1358433789.908:4448): arch=x86_64 syscall=mkdir success=yes exit=0 a0=7f94f4030550 a1=1c0 a2=0 a3=7f95007f36d0 items=0 ppid=1 pid=25596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_t,home_root_t,dir,write
>
>audit2allow
>audit2allow -R
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/sbin/userdel from rmdir access on the directory account_test_user.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that userdel should be allowed rmdir access on the account_test_user directory by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep userdel /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023
>Target Context                system_u:object_r:home_root_t:s0
>Target Objects                account_test_user [ dir ]
>Source                        userdel
>Source Path                   /usr/sbin/userdel
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           shadow-utils-4.1.5.1-1.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-17 15:43:10 CET
>Last Seen                     2013-01-17 15:43:10 CET
>Local ID                      c4169b9a-98f9-47c0-a84f-94d79b52a7cf
>
>Raw Audit Messages
>type=AVC msg=audit(1358433790.4:4453): avc:  denied  { rmdir } for  pid=25654 comm="userdel" name="account_test_user" dev="vda3" ino=210106 scontext=unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
>
>
>type=SYSCALL msg=audit(1358433790.4:4453): arch=x86_64 syscall=rmdir success=yes exit=0 a0=7fcdec5416f0 a1=0 a2=56a0 a3=8028 items=0 ppid=25588 pid=25654 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=27 comm=userdel exe=/usr/sbin/userdel subj=unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023 key=(null)
>
>Hash: userdel,useradd_t,home_root_t,dir,rmdir
>
>audit2allow
>audit2allow -R
>

Actions: View

Attachments on bug 896624: 680328 | 680355 | 684235 | 685010 | 685017