Bug 1026654

commit e31bedf5b4a61c83d3cd3323e2dac870d58244f5
Author: Miroslav Grepl <mgrepl>
Date:   Tue Nov 5 11:12:28 2013 +0100

    Allow netlabel-config to read meminfo

Actual results in permissive mode:
----
type=PATH msg=audit(11/05/2013 14:12:23.948:934) : item=0 name=/proc/meminfo inode=4026532027 dev=00:03 mode=file,444 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:proc_t:s0 objtype=NORMAL 
type=CWD msg=audit(11/05/2013 14:12:23.948:934) :  cwd=/ 
type=SYSCALL msg=audit(11/05/2013 14:12:23.948:934) : arch=x86_64 syscall=open success=yes exit=3 a0=0x38ca37c8cf a1=O_RDONLY|O_CLOEXEC a2=0x1b6 a3=0x0 items=1 ppid=1 pid=21489 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=netlabel-config exe=/usr/bin/bash subj=system_u:system_r:netlabel_mgmt_t:s0 key=(null) 
type=AVC msg=audit(11/05/2013 14:12:23.948:934) : avc:  denied  { open } for  pid=21489 comm=netlabel-config path=/proc/meminfo dev="proc" ino=4026532027 scontext=system_u:system_r:netlabel_mgmt_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file 
type=AVC msg=audit(11/05/2013 14:12:23.948:934) : avc:  denied  { read } for  pid=21489 comm=netlabel-config name=meminfo dev="proc" ino=4026532027 scontext=system_u:system_r:netlabel_mgmt_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file 
----
type=SYSCALL msg=audit(11/05/2013 14:12:23.953:935) : arch=x86_64 syscall=fstat success=yes exit=0 a0=0x3 a1=0x7fffc951af60 a2=0x7fffc951af60 a3=0x0 items=0 ppid=1 pid=21489 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=netlabel-config exe=/usr/bin/bash subj=system_u:system_r:netlabel_mgmt_t:s0 key=(null) 
type=AVC msg=audit(11/05/2013 14:12:23.953:935) : avc:  denied  { getattr } for  pid=21489 comm=netlabel-config path=/proc/meminfo dev="proc" ino=4026532027 scontext=system_u:system_r:netlabel_mgmt_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file 
----
type=PATH msg=audit(11/05/2013 14:12:23.954:936) : item=0 name=/etc/passwd inode=9960380 dev=fd:03 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 objtype=NORMAL 
type=CWD msg=audit(11/05/2013 14:12:23.954:936) :  cwd=/ 
type=SYSCALL msg=audit(11/05/2013 14:12:23.954:936) : arch=x86_64 syscall=open success=yes exit=3 a0=0x7ff40bb3341a a1=O_RDONLY|O_CLOEXEC a2=0x1b6 a3=0x0 items=1 ppid=1 pid=21489 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=netlabel-config exe=/usr/bin/bash subj=system_u:system_r:netlabel_mgmt_t:s0 key=(null) 
type=AVC msg=audit(11/05/2013 14:12:23.954:936) : avc:  denied  { open } for  pid=21489 comm=netlabel-config path=/etc/passwd dev="vda3" ino=9960380 scontext=system_u:system_r:netlabel_mgmt_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file 
type=AVC msg=audit(11/05/2013 14:12:23.954:936) : avc:  denied  { read } for  pid=21489 comm=netlabel-config name=passwd dev="vda3" ino=9960380 scontext=system_u:system_r:netlabel_mgmt_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file 
----
type=SYSCALL msg=audit(11/05/2013 14:12:23.955:937) : arch=x86_64 syscall=fstat success=yes exit=0 a0=0x3 a1=0x7fffc951ce90 a2=0x7fffc951ce90 a3=0x0 items=0 ppid=1 pid=21489 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=netlabel-config exe=/usr/bin/bash subj=system_u:system_r:netlabel_mgmt_t:s0 key=(null) 
type=AVC msg=audit(11/05/2013 14:12:23.955:937) : avc:  denied  { getattr } for  pid=21489 comm=netlabel-config path=/etc/passwd dev="vda3" ino=9960380 scontext=system_u:system_r:netlabel_mgmt_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file 
----

commit b2b42dd25e054a542bb566d66191efc4ca1f0cfc
Author: Miroslav Grepl <mgrepl>
Date:   Wed Nov 6 15:09:06 2013 +0100

    Allow netlabel-config to read passwd

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.