Attachment 945457 Details for Bug 1151030 – AVCs caught in permissive mode (original tshark crash)

AVCs caught in permissive mode (original tshark crash)

file_1151030.txt (text/plain), 11.60 KB, created by Martin Žember on 2014-10-10 01:27:40 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Žember

Created: 2014-10-10 01:27:40 UTC

Size: 11.60 KB

patch

obsolete

># ausearch -m avc -ts recent
>----
>time->Fri Oct 10 03:16:30 2014
>type=SYSCALL msg=audit(1412903790.433:23823): arch=c000003e syscall=42 success=yes exit=0 a0=4 a1=7fff255a3520 a2=21 a3=7fff255a3290 items=0 ppid=27262 pid=27263 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="nmcli" exe="/usr/bin/nmcli" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1412903790.433:23823): avc:  denied  { connectto } for  pid=27263 comm="nmcli" path="/run/NetworkManager/private" scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:system_r:NetworkManager_t:s0 tclass=unix_stream_socket
>type=AVC msg=audit(1412903790.433:23823): avc:  denied  { write } for  pid=27263 comm="nmcli" name="private" dev="tmpfs" ino=20797 scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=sock_file
>----
>time->Fri Oct 10 03:16:32 2014
>type=SYSCALL msg=audit(1412903792.266:23825): arch=c000003e syscall=41 success=yes exit=3 a0=10 a1=3 a2=9 a3=7fff100d9600 items=0 ppid=27316 pid=27317 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="crontab" exe="/usr/bin/crontab" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1412903792.266:23825): avc:  denied  { create } for  pid=27317 comm="crontab" scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tclass=netlink_audit_socket
>----
>time->Fri Oct 10 03:16:32 2014
>type=SYSCALL msg=audit(1412903792.252:23824): arch=c000003e syscall=1 success=yes exit=95 a0=3 a1=7f55332ebe70 a2=5f a3=7fff100d8630 items=0 ppid=27316 pid=27317 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="crontab" exe="/usr/bin/crontab" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1412903792.252:23824): avc:  denied  { compute_av } for  pid=27317 comm="crontab" scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=security
>----
>time->Fri Oct 10 03:16:32 2014
>type=SYSCALL msg=audit(1412903792.266:23826): arch=c000003e syscall=44 success=yes exit=156 a0=3 a1=7fff100d2d30 a2=9c a3=0 items=0 ppid=27316 pid=27317 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="crontab" exe="/usr/bin/crontab" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1412903792.266:23826): avc:  denied  { audit_write } for  pid=27317 comm="crontab" capability=29  scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tclass=capability
>type=AVC msg=audit(1412903792.266:23826): avc:  denied  { nlmsg_relay } for  pid=27317 comm="crontab" scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tclass=netlink_audit_socket
>----
>time->Fri Oct 10 03:16:32 2014
>type=SYSCALL msg=audit(1412903792.269:23829): arch=c000003e syscall=92 success=yes exit=0 a0=22fd500 a1=0 a2=7 a3=0 items=0 ppid=27242 pid=27243 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sosreport" exe="/usr/bin/python2.7" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1412903792.269:23829): avc:  denied  { chown } for  pid=27243 comm="sosreport" capability=0  scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tclass=capability
>----
>time->Fri Oct 10 03:16:38 2014
>type=SYSCALL msg=audit(1412903798.207:23830): arch=c000003e syscall=42 success=yes exit=0 a0=4 a1=7fffa09e8740 a2=21 a3=7fffa09e84b0 items=0 ppid=28174 pid=28175 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="nmcli" exe="/usr/bin/nmcli" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1412903798.207:23830): avc:  denied  { connectto } for  pid=28175 comm="nmcli" path="/run/NetworkManager/private" scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:system_r:NetworkManager_t:s0 tclass=unix_stream_socket
>type=AVC msg=audit(1412903798.207:23830): avc:  denied  { write } for  pid=28175 comm="nmcli" name="private" dev="tmpfs" ino=20797 scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=sock_file
>----
>time->Fri Oct 10 03:16:40 2014
>type=SYSCALL msg=audit(1412903800.036:23831): arch=c000003e syscall=2 success=yes exit=3 a0=7f602b5a4902 a1=40 a2=180 a3=7fff9f81c6e0 items=0 ppid=28345 pid=28346 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="exportfs" exe="/usr/sbin/exportfs" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1412903800.036:23831): avc:  denied  { create } for  pid=28346 comm="exportfs" name=".etab.lock" scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lib_nfs_t:s0 tclass=file
>type=AVC msg=audit(1412903800.036:23831): avc:  denied  { add_name } for  pid=28346 comm="exportfs" name=".etab.lock" scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lib_nfs_t:s0 tclass=dir
>type=AVC msg=audit(1412903800.036:23831): avc:  denied  { write } for  pid=28346 comm="exportfs" name="nfs" dev="dm-1" ino=2883749 scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lib_nfs_t:s0 tclass=dir
>----
>time->Fri Oct 10 03:16:42 2014
>type=SYSCALL msg=audit(1412903802.955:23832): arch=c000003e syscall=21 success=yes exit=0 a0=7fade6241c90 a1=7 a2=7fade39ba040 a3=8 items=0 ppid=28506 pid=28507 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="semodule" exe="/usr/sbin/semodule" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1412903802.955:23832): avc:  denied  { write } for  pid=28507 comm="semodule" name="modules" dev="dm-1" ino=2383877 scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:semanage_store_t:s0 tclass=dir
>----
>time->Fri Oct 10 03:16:45 2014
>type=SYSCALL msg=audit(1412903805.204:23834): arch=c000003e syscall=1 success=yes exit=49 a0=3 a1=13ca080 a2=31 a3=7fff6b1f20f0 items=0 ppid=28517 pid=28518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="selinuxconlist" exe="/usr/sbin/selinuxconlist" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1412903805.204:23834): avc:  denied  { compute_user } for  pid=28518 comm="selinuxconlist" scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=security
>----
>time->Fri Oct 10 03:16:45 2014
>type=SYSCALL msg=audit(1412903805.275:23835): arch=c000003e syscall=1 success=yes exit=81 a0=3 a1=17df290 a2=51 a3=7fff30f93690 items=0 ppid=28523 pid=28524 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="selinuxexeccon" exe="/usr/sbin/selinuxexeccon" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1412903805.275:23835): avc:  denied  { compute_create } for  pid=28524 comm="selinuxexeccon" scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=security
>----
>time->Fri Oct 10 03:16:45 2014
>type=SYSCALL msg=audit(1412903805.142:23833): arch=c000003e syscall=1 success=yes exit=57 a0=3 a1=1d60c60 a2=39 a3=7fffd3b66e30 items=0 ppid=28515 pid=28516 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="selinuxdefcon" exe="/usr/sbin/selinuxdefcon" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1412903805.142:23833): avc:  denied  { compute_user } for  pid=28516 comm="selinuxdefcon" scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=security
>----
>time->Fri Oct 10 03:16:46 2014
>type=SYSCALL msg=audit(1412903806.503:23836): arch=c000003e syscall=21 success=yes exit=0 a0=5341550 a1=7 a2=7f4d5582f040 a3=8 items=0 ppid=28525 pid=28526 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="semanage" exe="/usr/bin/python2.7" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1412903806.503:23836): avc:  denied  { write } for  pid=28526 comm="semanage" name="modules" dev="dm-1" ino=2383877 scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:semanage_store_t:s0 tclass=dir
>----
>time->Fri Oct 10 03:16:46 2014
>type=SYSCALL msg=audit(1412903806.565:23837): arch=c000003e syscall=41 success=yes exit=3 a0=10 a1=3 a2=9 a3=0 items=0 ppid=28525 pid=28526 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="semanage" exe="/usr/bin/python2.7" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1412903806.565:23837): avc:  denied  { create } for  pid=28526 comm="semanage" scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tclass=netlink_audit_socket
>----
>time->Fri Oct 10 03:16:49 2014
>type=SYSCALL msg=audit(1412903809.256:23839): arch=c000003e syscall=2 success=yes exit=5 a0=e523d0 a1=241 a2=1b6 a3=0 items=0 ppid=28566 pid=28567 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="yum" exe="/usr/bin/python2.7" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1412903809.256:23839): avc:  denied  { write } for  pid=28567 comm="yum" path="/etc/yum.repos.d/redhat.repo" dev="dm-1" ino=2361405 scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:system_conf_t:s0 tclass=file
>type=AVC msg=audit(1412903809.256:23839): avc:  denied  { create } for  pid=28567 comm="yum" name="redhat.repo" scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:system_conf_t:s0 tclass=file
>type=AVC msg=audit(1412903809.256:23839): avc:  denied  { add_name } for  pid=28567 comm="yum" name="redhat.repo" scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:system_conf_t:s0 tclass=dir
>type=AVC msg=audit(1412903809.256:23839): avc:  denied  { write } for  pid=28567 comm="yum" name="yum.repos.d" dev="dm-1" ino=2360386 scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:system_conf_t:s0 tclass=dir
>----
>time->Fri Oct 10 03:16:49 2014
>type=SYSCALL msg=audit(1412903809.153:23838): arch=c000003e syscall=83 success=yes exit=0 a0=e66960 a1=1ff a2=7fdb21d12f88 a3=7fffc948da90 items=0 ppid=28566 pid=28567 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="yum" exe="/usr/bin/python2.7" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1412903809.153:23838): avc:  denied  { create } for  pid=28567 comm="yum" name="product-default" scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cert_t:s0 tclass=dir
>type=AVC msg=audit(1412903809.153:23838): avc:  denied  { add_name } for  pid=28567 comm="yum" name="product-default" scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cert_t:s0 tclass=dir
>type=AVC msg=audit(1412903809.153:23838): avc:  denied  { write } for  pid=28567 comm="yum" name="pki" dev="dm-1" ino=2359306 scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cert_t:s0 tclass=dir

Actions: View

Attachments on bug 1151030: 945427 | 945428 | 945457