Attachment 881724 Details for Bug 1083491 – AVC logs.

AVC logs.

test_log-Setup-avc.log (text/x-log), 8.51 KB, created by Robin Hack on 2014-04-02 10:48:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Robin Hack

Created: 2014-04-02 10:48:49 UTC

Size: 8.51 KB

patch

obsolete

>Info: Searching AVC errors produced since 1395440405 (Fri Mar 21 18:20:05 2014)
>Searching logs...
>Running '/usr/bin/env LC_ALL=en_US.UTF-8 /sbin/ausearch -m AVC -m USER_AVC -m SELINUX_ERR -ts 03/21/2014 18:20:05 < /dev/null >/mnt/testarea/tmp.rhts-db-submit-result.RmnwBl 2>&1'
>----
>time->Fri Mar 21 18:26:17 2014
>type=PATH msg=audit(1395440777.726:85): item=0 name=(null) inode=2095498 dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:samba_var_t:s0
>type=SOCKETCALL msg=audit(1395440777.726:85): nargs=3 a0=1c a1=2aaab52f6b8 a2=6e
>type=SOCKADDR msg=audit(1395440777.726:85): saddr=00012F7661722F6E6D62642F756E657870656374656400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
>type=SYSCALL msg=audit(1395440777.726:85): arch=80000016 syscall=102 success=no exit=-13 a0=3 a1=3ffff9f7380 a2=6e a3=2aa00000004 items=1 ppid=1 pid=16795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=root:system_r:smbd_t:s0 key=(null)
>type=AVC msg=audit(1395440777.726:85): avc:  denied  { connectto } for  pid=16795 comm="smbd" path="/var/nmbd/unexpected" scontext=root:system_r:smbd_t:s0 tcontext=root:system_r:nmbd_t:s0 tclass=unix_stream_socket
>----
>time->Fri Mar 21 18:29:33 2014
>type=PATH msg=audit(1395440973.576:86): item=0 name=(null) inode=2095498 dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:samba_var_t:s0
>type=SOCKETCALL msg=audit(1395440973.576:86): nargs=3 a0=1e a1=2aaab53ec68 a2=6e
>type=SOCKADDR msg=audit(1395440973.576:86): saddr=00012F7661722F6E6D62642F756E657870656374656400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
>type=SYSCALL msg=audit(1395440973.576:86): arch=80000016 syscall=102 success=no exit=-13 a0=3 a1=3ffff9f2f70 a2=6e a3=2aa00000004 items=1 ppid=1 pid=16795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=root:system_r:smbd_t:s0 key=(null)
>type=AVC msg=audit(1395440973.576:86): avc:  denied  { connectto } for  pid=16795 comm="smbd" path="/var/nmbd/unexpected" scontext=root:system_r:smbd_t:s0 tcontext=root:system_r:nmbd_t:s0 tclass=unix_stream_socket
>----
>time->Fri Mar 21 18:29:33 2014
>type=PATH msg=audit(1395440973.746:87): item=0 name=(null) inode=2095498 dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:samba_var_t:s0
>type=SOCKETCALL msg=audit(1395440973.746:87): nargs=3 a0=1e a1=2aaab53d5f8 a2=6e
>type=SOCKADDR msg=audit(1395440973.746:87): saddr=00012F7661722F6E6D62642F756E657870656374656400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
>type=SYSCALL msg=audit(1395440973.746:87): arch=80000016 syscall=102 success=no exit=-13 a0=3 a1=3ffff9f31a0 a2=6e a3=2aa00000004 items=1 ppid=1 pid=16795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=root:system_r:smbd_t:s0 key=(null)
>type=AVC msg=audit(1395440973.746:87): avc:  denied  { connectto } for  pid=16795 comm="smbd" path="/var/nmbd/unexpected" scontext=root:system_r:smbd_t:s0 tcontext=root:system_r:nmbd_t:s0 tclass=unix_stream_socket
>----
>time->Fri Mar 21 18:31:13 2014
>type=PATH msg=audit(1395441073.746:89): item=0 name=(null) inode=2095498 dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:samba_var_t:s0
>type=SOCKETCALL msg=audit(1395441073.746:89): nargs=3 a0=1e a1=2aaab53d578 a2=6e
>type=SOCKADDR msg=audit(1395441073.746:89): saddr=00012F7661722F6E6D62642F756E657870656374656400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
>type=SYSCALL msg=audit(1395441073.746:89): arch=80000016 syscall=102 success=no exit=-13 a0=3 a1=3ffff9f31a0 a2=6e a3=2aa00000004 items=1 ppid=1 pid=16795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=root:system_r:smbd_t:s0 key=(null)
>type=AVC msg=audit(1395441073.746:89): avc:  denied  { connectto } for  pid=16795 comm="smbd" path="/var/nmbd/unexpected" scontext=root:system_r:smbd_t:s0 tcontext=root:system_r:nmbd_t:s0 tclass=unix_stream_socket
>----
>time->Fri Mar 21 18:31:13 2014
>type=PATH msg=audit(1395441073.576:88): item=0 name=(null) inode=2095498 dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:samba_var_t:s0
>type=SOCKETCALL msg=audit(1395441073.576:88): nargs=3 a0=1e a1=2aaab53d648 a2=6e
>type=SOCKADDR msg=audit(1395441073.576:88): saddr=00012F7661722F6E6D62642F756E657870656374656400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
>type=SYSCALL msg=audit(1395441073.576:88): arch=80000016 syscall=102 success=no exit=-13 a0=3 a1=3ffff9f2f70 a2=6e a3=2aa00000004 items=1 ppid=1 pid=16795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=root:system_r:smbd_t:s0 key=(null)
>type=AVC msg=audit(1395441073.576:88): avc:  denied  { connectto } for  pid=16795 comm="smbd" path="/var/nmbd/unexpected" scontext=root:system_r:smbd_t:s0 tcontext=root:system_r:nmbd_t:s0 tclass=unix_stream_socket
>----
>time->Fri Mar 21 18:32:53 2014
>type=PATH msg=audit(1395441173.776:91): item=0 name=(null) inode=2095498 dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:samba_var_t:s0
>type=SOCKETCALL msg=audit(1395441173.776:91): nargs=3 a0=1e a1=2aaab53ee68 a2=6e
>type=SOCKADDR msg=audit(1395441173.776:91): saddr=00012F7661722F6E6D62642F756E657870656374656400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
>type=SYSCALL msg=audit(1395441173.776:91): arch=80000016 syscall=102 success=no exit=-13 a0=3 a1=3ffff9f31a0 a2=6e a3=2aa00000004 items=1 ppid=1 pid=16795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=root:system_r:smbd_t:s0 key=(null)
>type=AVC msg=audit(1395441173.776:91): avc:  denied  { connectto } for  pid=16795 comm="smbd" path="/var/nmbd/unexpected" scontext=root:system_r:smbd_t:s0 tcontext=root:system_r:nmbd_t:s0 tclass=unix_stream_socket
>----
>time->Fri Mar 21 18:32:53 2014
>type=PATH msg=audit(1395441173.606:90): item=0 name=(null) inode=2095498 dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:samba_var_t:s0
>type=SOCKETCALL msg=audit(1395441173.606:90): nargs=3 a0=1e a1=2aaab53d578 a2=6e
>type=SOCKADDR msg=audit(1395441173.606:90): saddr=00012F7661722F6E6D62642F756E657870656374656400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
>type=SYSCALL msg=audit(1395441173.606:90): arch=80000016 syscall=102 success=no exit=-13 a0=3 a1=3ffff9f2f70 a2=6e a3=2aa00000004 items=1 ppid=1 pid=16795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=root:system_r:smbd_t:s0 key=(null)
>type=AVC msg=audit(1395441173.606:90): avc:  denied  { connectto } for  pid=16795 comm="smbd" path="/var/nmbd/unexpected" scontext=root:system_r:smbd_t:s0 tcontext=root:system_r:nmbd_t:s0 tclass=unix_stream_socket
>Fail: AVC messages found.
>Checking for errors...
>Using stronger AVC checks.
>	Define empty RHTS_OPTION_STRONGER_AVC parameter if this causes any problems.
>Running 'cat /mnt/testarea/tmp.rhts-db-submit-result.RmnwBl | /sbin/ausearch -m AVC -m SELINUX_ERR'
>Fail: AVC messages found.
>Running 'cat %s | /sbin/ausearch -m USER_AVC >/mnt/testarea/tmp.rhts-db-submit-result.UesLdU 2>&1'
>Info: No AVC messages found.
>/bin/grep 'avc: ' /mnt/testarea/dmesg.log | /bin/grep --invert-match TESTOUT.log
>No AVC messages found in dmesg
>Running '/usr/sbin/sestatus'
>SELinux status:                 enabled
>SELinuxfs mount:                /selinux
>Current mode:                   enforcing
>Mode from config file:          enforcing
>Policy version:                 21
>Policy from config file:        targeted
>Running 'rpm -q selinux-policy || true'
>selinux-policy-2.4.6-346.el5

Actions: View

Attachments on bug 1083491: 881724