Attachment 945428 Details for Bug 1151030 – AVCs caught in permissive mode

AVCs caught in permissive mode

permissive-AVCs.txt (text/plain), 7.78 KB, created by Milos Malik on 2014-10-09 19:14:57 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Milos Malik

Created: 2014-10-09 19:14:57 UTC

Size: 7.78 KB

patch

obsolete

>----
>type=SYSCALL msg=audit(10/09/2014 21:08:59.300:267) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x4 a1=0x7fff697dfbc0 a2=0x21 a3=0x7fff697df930 items=0 ppid=32698 pid=32699 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=nmcli exe=/usr/bin/nmcli subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null) 
>type=AVC msg=audit(10/09/2014 21:08:59.300:267) : avc:  denied  { connectto } for  pid=32699 comm=nmcli path=/run/NetworkManager/private scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:system_r:NetworkManager_t:s0 tclass=unix_stream_socket 
>type=AVC msg=audit(10/09/2014 21:08:59.300:267) : avc:  denied  { write } for  pid=32699 comm=nmcli name=private dev="tmpfs" ino=118850 scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=sock_file 
>----
>type=SYSCALL msg=audit(10/09/2014 21:09:01.522:269) : arch=x86_64 syscall=socket success=yes exit=3 a0=netlink a1=SOCK_RAW a2=igp a3=0x7fffc7f1d920 items=0 ppid=32729 pid=32730 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=crontab exe=/usr/bin/crontab subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null) 
>type=AVC msg=audit(10/09/2014 21:09:01.522:269) : avc:  denied  { create } for  pid=32730 comm=crontab scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tclass=netlink_audit_socket 
>----
>type=SYSCALL msg=audit(10/09/2014 21:09:01.506:268) : arch=x86_64 syscall=write success=yes exit=95 a0=0x3 a1=0x7fb0ef09ff20 a2=0x5f a3=0x7fffc7f1c950 items=0 ppid=32729 pid=32730 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=crontab exe=/usr/bin/crontab subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null) 
>type=AVC msg=audit(10/09/2014 21:09:01.506:268) : avc:  denied  { compute_av } for  pid=32730 comm=crontab scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=security 
>----
>type=SYSCALL msg=audit(10/09/2014 21:09:01.522:270) : arch=x86_64 syscall=sendto success=yes exit=144 a0=0x3 a1=0x7fffc7f17050 a2=0x90 a3=0x0 items=0 ppid=32729 pid=32730 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=crontab exe=/usr/bin/crontab subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null) 
>type=AVC msg=audit(10/09/2014 21:09:01.522:270) : avc:  denied  { audit_write } for  pid=32730 comm=crontab capability=audit_write  scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tclass=capability 
>type=AVC msg=audit(10/09/2014 21:09:01.522:270) : avc:  denied  { nlmsg_relay } for  pid=32730 comm=crontab scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tclass=netlink_audit_socket 
>----
>type=SYSCALL msg=audit(10/09/2014 21:09:06.016:274) : arch=x86_64 syscall=open success=yes exit=3 a0=0x7f3c2e6d1902 a1=O_RDONLY|O_CREAT a2=0600 a3=0x7fff4aab2470 items=0 ppid=943 pid=944 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=exportfs exe=/usr/sbin/exportfs subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null) 
>type=AVC msg=audit(10/09/2014 21:09:06.016:274) : avc:  denied  { create } for  pid=944 comm=exportfs name=.etab.lock scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lib_nfs_t:s0 tclass=file 
>type=AVC msg=audit(10/09/2014 21:09:06.016:274) : avc:  denied  { add_name } for  pid=944 comm=exportfs name=.etab.lock scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lib_nfs_t:s0 tclass=dir 
>type=AVC msg=audit(10/09/2014 21:09:06.016:274) : avc:  denied  { write } for  pid=944 comm=exportfs name=nfs dev="dm-1" ino=67368638 scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lib_nfs_t:s0 tclass=dir 
>----
>type=SYSCALL msg=audit(10/09/2014 21:09:06.588:275) : arch=x86_64 syscall=access success=yes exit=0 a0=0x7f689edfbc90 a1=X_OK|W_OK|R_OK a2=0x7f689ce59040 a3=0x8 items=0 ppid=974 pid=975 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=semodule exe=/usr/sbin/semodule subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null) 
>type=AVC msg=audit(10/09/2014 21:09:06.588:275) : avc:  denied  { write } for  pid=975 comm=semodule name=modules dev="dm-1" ino=135686689 scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:semanage_store_t:s0 tclass=dir 
>----
>type=SYSCALL msg=audit(10/09/2014 21:09:05.615:273) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x4 a1=0x7fffa6e52ba0 a2=0x21 a3=0x7fffa6e52910 items=0 ppid=898 pid=899 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=nmcli exe=/usr/bin/nmcli subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null) 
>type=AVC msg=audit(10/09/2014 21:09:05.615:273) : avc:  denied  { write } for  pid=899 comm=nmcli name=private dev="tmpfs" ino=118850 scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=sock_file 
>----
>type=SYSCALL msg=audit(10/09/2014 21:09:09.596:277) : arch=x86_64 syscall=write success=yes exit=81 a0=0x3 a1=0x1857290 a2=0x51 a3=0x7fff1674b070 items=0 ppid=980 pid=981 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=selinuxexeccon exe=/usr/sbin/selinuxexeccon subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null) 
>type=AVC msg=audit(10/09/2014 21:09:09.596:277) : avc:  denied  { compute_create } for  pid=981 comm=selinuxexeccon scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=security 
>----
>type=SYSCALL msg=audit(10/09/2014 21:09:09.719:278) : arch=x86_64 syscall=access success=yes exit=0 a0=0x36da8f0 a1=X_OK|W_OK|R_OK a2=0x7fbd84c1b040 a3=0x8 items=0 ppid=982 pid=983 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=semanage exe=/usr/bin/python2.7 subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null) 
>type=AVC msg=audit(10/09/2014 21:09:09.719:278) : avc:  denied  { write } for  pid=983 comm=semanage name=modules dev="dm-1" ino=135686689 scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:semanage_store_t:s0 tclass=dir 
>----
>type=SYSCALL msg=audit(10/09/2014 21:09:09.433:276) : arch=x86_64 syscall=write success=yes exit=57 a0=0x3 a1=0x10b8d10 a2=0x39 a3=0x7fff2a35f9d0 items=0 ppid=976 pid=977 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=selinuxdefcon exe=/usr/sbin/selinuxdefcon subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null) 
>type=AVC msg=audit(10/09/2014 21:09:09.433:276) : avc:  denied  { compute_user } for  pid=977 comm=selinuxdefcon scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=security 
>----
>type=SYSCALL msg=audit(10/09/2014 21:09:09.773:279) : arch=x86_64 syscall=socket success=yes exit=3 a0=netlink a1=SOCK_RAW a2=igp a3=0x0 items=0 ppid=982 pid=983 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=semanage exe=/usr/bin/python2.7 subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null) 
>type=AVC msg=audit(10/09/2014 21:09:09.773:279) : avc:  denied  { create } for  pid=983 comm=semanage scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tclass=netlink_audit_socket

Actions: View

Attachments on bug 1151030: 945427 | 945428 | 945457