| Summary: |
libselinux-2.2.1-3 and selinux-policy-3.13.1-10 cause lots of execmem/execstack denials |
| Product: |
[Fedora] Fedora
|
Reporter: |
Kevin Fenzi <kevin> |
| Component: |
libselinux | Assignee: |
Daniel Walsh <dwalsh> |
| Status: |
CLOSED
DUPLICATE
|
QA Contact: |
Fedora Extras Quality Assurance <extras-qa> |
| Severity: |
unspecified
|
Docs Contact: |
|
| Priority: |
unspecified
|
|
|
| Version: |
rawhide | CC: |
bruno, dwalsh, jhrozek, kdudka, kevin, knutjbj, mgrepl, pbrobinson, rjones, robatino, satellitgo, ssekidde
|
| Target Milestone: |
--- | |
|
| Target Release: |
--- | |
|
| Hardware: |
Unspecified | |
|
| OS: |
Unspecified | |
|
| Whiteboard: |
|
|
Fixed In Version:
|
|
Doc Type:
|
Bug Fix
|
|---|
|
Doc Text:
|
|
Story Points:
|
---
|
|---|
|
Clone Of:
|
|
Environment:
|
|
|---|
|
Last Closed:
|
2014-01-02 21:29:33 UTC
|
Type:
|
Bug
|
|---|
|
Regression:
|
---
|
Mount Type:
|
---
|
|---|
|
Documentation:
|
---
|
CRM:
|
|
|---|
|
Verified Versions:
|
|
Category:
|
---
|
|---|
|
oVirt Team:
|
---
|
RHEL 7.3 requirements from Atomic Host:
|
|
|---|
|
Cloudforms Team:
|
---
|
Target Upstream Version:
|
|
|---|
|
Embargoed:
|
|
| |
|---|
Starting with libselinux-2.2.1-3 and selinux-policy-3.13.1-10, there's a flood of execmem and execstack denials appearing. I don't know if this is due to them checking a lot more strictly, a fixed check, or false positives. Here's a sample of the ones I get on boot: time->Tue Dec 24 12:05:44 2013 type=SYSCALL msg=audit(1387911944.134:20): arch=c000003e syscall=10 success=yes exit=0 a0=7fff684d4000 a1=1000 a2=1000007 a3=0 items=0 ppid=1 pid=1006 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="rpcbind" exe="/usr/sbin/rpcbind" subj=system_u:system_r:rpcbind_t:s0 key=(null) type=AVC msg=audit(1387911944.134:20): avc: denied { execmem } for pid=1006 comm="rpcbind" scontext=system_u:system_r:rpcbind_t:s0 tcontext=system_u:system_r:rpcbind_t:s0 tclass=process type=AVC msg=audit(1387911944.134:20): avc: denied { execstack } for pid=1006 comm="rpcbind" scontext=system_u:system_r:rpcbind_t:s0 tcontext=system_u:system_r:rpcbind_t:s0 tclass=process ---- time->Tue Dec 24 12:05:44 2013 type=SYSCALL msg=audit(1387911944.246:36): arch=c000003e syscall=10 success=yes exit=0 a0=7fff0e410000 a1=1000 a2=1000007 a3=0 items=0 ppid=1 pid=984 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="firewalld" exe="/usr/bin/python2.7" subj=system_u:system_r:firewalld_t:s0 key=(null) type=AVC msg=audit(1387911944.246:36): avc: denied { execmem } for pid=984 comm="firewalld" scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:system_r:firewalld_t:s0 tclass=process type=AVC msg=audit(1387911944.246:36): avc: denied { execstack } for pid=984 comm="firewalld" scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:system_r:firewalld_t:s0 tclass=process ---- time->Tue Dec 24 12:05:44 2013 type=SYSCALL msg=audit(1387911944.639:91): arch=c000003e syscall=10 success=yes exit=0 a0=7fffbb53b000 a1=1000 a2=1000007 a3=0 items=0 ppid=1 pid=1166 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1387911944.639:91): avc: denied { execmem } for pid=1166 comm="sshd" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=process type=AVC msg=audit(1387911944.639:91): avc: denied { execstack } for pid=1166 comm="sshd" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=process ---- time->Tue Dec 24 12:05:44 2013 type=SYSCALL msg=audit(1387911944.658:94): arch=c000003e syscall=10 success=yes exit=0 a0=7fffc8a2a000 a1=1000 a2=1000007 a3=0 items=0 ppid=1 pid=1171 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="wpa_supplicant" exe="/usr/sbin/wpa_supplicant" subj=system_u:system_r:NetworkManager_t:s0 key=(null) type=AVC msg=audit(1387911944.658:94): avc: denied { execmem } for pid=1171 comm="wpa_supplicant" scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:system_r:NetworkManager_t:s0 tclass=process type=AVC msg=audit(1387911944.658:94): avc: denied { execstack } for pid=1171 comm="wpa_supplicant" scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:system_r:NetworkManager_t:s0 tclass=process ---- time->Tue Dec 24 12:05:44 2013 type=SYSCALL msg=audit(1387911944.663:95): arch=c000003e syscall=10 success=yes exit=0 a0=7ffff989f000 a1=1000 a2=1000007 a3=0 items=0 ppid=1160 pid=1169 auid=4294967295 uid=992 gid=990 euid=992 suid=992 fsuid=992 egid=990 sgid=990 fsgid=990 ses=4294967295 tty=(none) comm="unbound-anchor" exe="/usr/sbin/unbound-anchor" subj=system_u:system_r:named_t:s0 key=(null) type=AVC msg=audit(1387911944.663:95): avc: denied { execmem } for pid=1169 comm="unbound-anchor" scontext=system_u:system_r:named_t:s0 tcontext=system_u:system_r:named_t:s0 tclass=process type=AVC msg=audit(1387911944.663:95): avc: denied { execstack } for pid=1169 comm="unbound-anchor" scontext=system_u:system_r:named_t:s0 tcontext=system_u:system_r:named_t:s0 tclass=process ---- time->Tue Dec 24 12:05:44 2013 type=SYSCALL msg=audit(1387911944.669:96): arch=c000003e syscall=10 success=yes exit=0 a0=7fff0a9e6000 a1=1000 a2=1000007 a3=0 items=0 ppid=1 pid=1172 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="rpc.statd" exe="/usr/sbin/rpc.statd" subj=system_u:system_r:rpcd_t:s0 key=(null) type=AVC msg=audit(1387911944.669:96): avc: denied { execmem } for pid=1172 comm="rpc.statd" scontext=system_u:system_r:rpcd_t:s0 tcontext=system_u:system_r:rpcd_t:s0 tclass=process type=AVC msg=audit(1387911944.669:96): avc: denied { execstack } for pid=1172 comm="rpc.statd" scontext=system_u:system_r:rpcd_t:s0 tcontext=system_u:system_r:rpcd_t:s0 tclass=process ---- time->Tue Dec 24 12:05:44 2013 type=SYSCALL msg=audit(1387911944.691:102): arch=c000003e syscall=10 success=yes exit=0 a0=7fff661b8000 a1=1000 a2=1000007 a3=0 items=0 ppid=1 pid=1157 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="openvpn" exe="/usr/sbin/openvpn" subj=system_u:system_r:openvpn_t:s0 key=(null) type=AVC msg=audit(1387911944.691:102): avc: denied { execmem } for pid=1157 comm="openvpn" scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:openvpn_t:s0 tclass=process type=AVC msg=audit(1387911944.691:102): avc: denied { execstack } for pid=1157 comm="openvpn" scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:openvpn_t:s0 tclass=process ---- time->Tue Dec 24 12:05:44 2013 type=SYSCALL msg=audit(1387911944.702:105): arch=c000003e syscall=10 success=yes exit=0 a0=7fffa41b6000 a1=1000 a2=1000007 a3=0 items=0 ppid=1 pid=1183 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="unbound-checkco" exe="/usr/sbin/unbound-checkconf" subj=system_u:system_r:named_t:s0 key=(null) type=AVC msg=audit(1387911944.702:105): avc: denied { execmem } for pid=1183 comm="unbound-checkco" scontext=system_u:system_r:named_t:s0 tcontext=system_u:system_r:named_t:s0 tclass=process type=AVC msg=audit(1387911944.702:105): avc: denied { execstack } for pid=1183 comm="unbound-checkco" scontext=system_u:system_r:named_t:s0 tcontext=system_u:system_r:named_t:s0 tclass=process ---- time->Tue Dec 24 12:05:44 2013 type=SYSCALL msg=audit(1387911944.708:107): arch=c000003e syscall=10 success=yes exit=0 a0=7fff4366a000 a1=1000 a2=1000007 a3=0 items=0 ppid=1 pid=1184 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="postfix" exe="/usr/sbin/postfix" subj=system_u:system_r:postfix_master_t:s0 key=(null) type=AVC msg=audit(1387911944.708:107): avc: denied { execmem } for pid=1184 comm="postfix" scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:system_r:postfix_master_t:s0 tclass=process type=AVC msg=audit(1387911944.708:107): avc: denied { execstack } for pid=1184 comm="postfix" scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:system_r:postfix_master_t:s0 tclass=process ---- time->Tue Dec 24 12:05:44 2013 type=SYSCALL msg=audit(1387911944.731:111): arch=c000003e syscall=10 success=yes exit=0 a0=7fff3eb93000 a1=1000 a2=1000007 a3=0 items=0 ppid=1 pid=1192 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="unbound" exe="/usr/sbin/unbound" subj=system_u:system_r:named_t:s0 key=(null) type=AVC msg=audit(1387911944.731:111): avc: denied { execmem } for pid=1192 comm="unbound" scontext=system_u:system_r:named_t:s0 tcontext=system_u:system_r:named_t:s0 tclass=process type=AVC msg=audit(1387911944.731:111): avc: denied { execstack } for pid=1192 comm="unbound" scontext=system_u:system_r:named_t:s0 tcontext=system_u:system_r:named_t:s0 tclass=process ---- time->Tue Dec 24 12:05:44 2013 type=SYSCALL msg=audit(1387911944.746:115): arch=c000003e syscall=10 success=yes exit=0 a0=7fff5e1e3000 a1=1000 a2=1000007 a3=0 items=0 ppid=1184 pid=1205 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="postconf" exe="/usr/sbin/postconf" subj=system_u:system_r:postfix_master_t:s0 key=(null) type=AVC msg=audit(1387911944.746:115): avc: denied { execmem } for pid=1205 comm="postconf" scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:system_r:postfix_master_t:s0 tclass=process type=AVC msg=audit(1387911944.746:115): avc: denied { execstack } for pid=1205 comm="postconf" scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:system_r:postfix_master_t:s0 tclass=process ---- time->Tue Dec 24 12:05:44 2013 type=SYSCALL msg=audit(1387911944.755:117): arch=c000003e syscall=10 success=yes exit=0 a0=7fff39880000 a1=1000 a2=1000007 a3=0 items=0 ppid=1 pid=1208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="dnssec-triggerd" exe="/usr/sbin/dnssec-triggerd" subj=system_u:system_r:dnssec_trigger_t:s0 key=(null) type=AVC msg=audit(1387911944.755:117): avc: denied { execmem } for pid=1208 comm="dnssec-triggerd" scontext=system_u:system_r:dnssec_trigger_t:s0 tcontext=system_u:system_r:dnssec_trigger_t:s0 tclass=process type=AVC msg=audit(1387911944.755:117): avc: denied { execstack } for pid=1208 comm="dnssec-triggerd" scontext=system_u:system_r:dnssec_trigger_t:s0 tcontext=system_u:system_r:dnssec_trigger_t:s0 tclass=process ---- time->Tue Dec 24 12:05:44 2013 type=SYSCALL msg=audit(1387911944.789:120): arch=c000003e syscall=10 success=yes exit=0 a0=7fff053aa000 a1=1000 a2=1000007 a3=0 items=0 ppid=1184 pid=1221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="master" exe="/usr/libexec/postfix/master" subj=system_u:system_r:postfix_master_t:s0 key=(null) type=AVC msg=audit(1387911944.789:120): avc: denied { execmem } for pid=1221 comm="master" scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:system_r:postfix_master_t:s0 tclass=process type=AVC msg=audit(1387911944.789:120): avc: denied { execstack } for pid=1221 comm="master" scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:system_r:postfix_master_t:s0 tclass=process ---- time->Tue Dec 24 12:05:44 2013 type=SYSCALL msg=audit(1387911944.842:135): arch=c000003e syscall=10 success=yes exit=0 a0=7fff8a213000 a1=1000 a2=1000007 a3=0 items=0 ppid=1249 pid=1251 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="postconf" exe="/usr/sbin/postconf" subj=system_u:system_r:postfix_master_t:s0 key=(null) type=AVC msg=audit(1387911944.842:135): avc: denied { execmem } for pid=1251 comm="postconf" scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:system_r:postfix_master_t:s0 tclass=process type=AVC msg=audit(1387911944.842:135): avc: denied { execstack } for pid=1251 comm="postconf" scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:system_r:postfix_master_t:s0 tclass=process ---- time->Tue Dec 24 12:05:44 2013 type=SYSCALL msg=audit(1387911944.946:162): arch=c000003e syscall=10 success=yes exit=0 a0=7fff2bbe6000 a1=1000 a2=1000007 a3=0 items=0 ppid=1208 pid=1298 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="unbound-control" exe="/usr/sbin/unbound-control" subj=system_u:system_r:dnssec_trigger_t:s0 key=(null) type=AVC msg=audit(1387911944.946:162): avc: denied { execmem } for pid=1298 comm="unbound-control" scontext=system_u:system_r:dnssec_trigger_t:s0 tcontext=system_u:system_r:dnssec_trigger_t:s0 tclass=process type=AVC msg=audit(1387911944.946:162): avc: denied { execstack } for pid=1298 comm="unbound-control" scontext=system_u:system_r:dnssec_trigger_t:s0 tcontext=system_u:system_r:dnssec_trigger_t:s0 tclass=process ---- time->Tue Dec 24 12:05:45 2013 type=SYSCALL msg=audit(1387911945.298:238): arch=c000003e syscall=10 success=yes exit=0 a0=7fff21af8000 a1=1000 a2=1000007 a3=0 items=0 ppid=1231 pid=1412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="postsuper" exe="/usr/sbin/postsuper" subj=system_u:system_r:postfix_master_t:s0 key=(null) type=AVC msg=audit(1387911945.298:238): avc: denied { execmem } for pid=1412 comm="postsuper" scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:system_r:postfix_master_t:s0 tclass=process type=AVC msg=audit(1387911945.298:238): avc: denied { execstack } for pid=1412 comm="postsuper" scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:system_r:postfix_master_t:s0 tclass=process ---- time->Tue Dec 24 12:05:45 2013 type=SYSCALL msg=audit(1387911945.350:254): arch=c000003e syscall=10 success=yes exit=0 a0=7fff32f67000 a1=1000 a2=1000007 a3=0 items=0 ppid=1429 pid=1432 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="postconf" exe="/usr/sbin/postconf" subj=system_u:system_r:postfix_master_t:s0 key=(null) type=AVC msg=audit(1387911945.350:254): avc: denied { execmem } for pid=1432 comm="postconf" scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:system_r:postfix_master_t:s0 tclass=process type=AVC msg=audit(1387911945.350:254): avc: denied { execstack } for pid=1432 comm="postconf" scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:system_r:postfix_master_t:s0 tclass=process ---- time->Tue Dec 24 12:05:45 2013 type=SYSCALL msg=audit(1387911945.473:283): arch=c000003e syscall=10 success=yes exit=0 a0=7fff13f08000 a1=1000 a2=1000007 a3=0 items=0 ppid=1487 pid=1498 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="pickup" exe="/usr/libexec/postfix/pickup" subj=system_u:system_r:postfix_pickup_t:s0 key=(null) type=AVC msg=audit(1387911945.473:283): avc: denied { execmem } for pid=1498 comm="pickup" scontext=system_u:system_r:postfix_pickup_t:s0 tcontext=system_u:system_r:postfix_pickup_t:s0 tclass=process type=AVC msg=audit(1387911945.473:283): avc: denied { execstack } for pid=1498 comm="pickup" scontext=system_u:system_r:postfix_pickup_t:s0 tcontext=system_u:system_r:postfix_pickup_t:s0 tclass=process ---- time->Tue Dec 24 12:05:45 2013 type=SYSCALL msg=audit(1387911945.475:284): arch=c000003e syscall=10 success=yes exit=0 a0=7fffb3df3000 a1=1000 a2=1000007 a3=0 items=0 ppid=1487 pid=1499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="qmgr" exe="/usr/libexec/postfix/qmgr" subj=system_u:system_r:postfix_qmgr_t:s0 key=(null) type=AVC msg=audit(1387911945.475:284): avc: denied { execmem } for pid=1499 comm="qmgr" scontext=system_u:system_r:postfix_qmgr_t:s0 tcontext=system_u:system_r:postfix_qmgr_t:s0 tclass=process type=AVC msg=audit(1387911945.475:284): avc: denied { execstack } for pid=1499 comm="qmgr" scontext=system_u:system_r:postfix_qmgr_t:s0 tcontext=system_u:system_r:postfix_qmgr_t:s0 tclass=process ---- time->Tue Dec 24 12:05:46 2013 type=SYSCALL msg=audit(1387911946.163:535): arch=c000003e syscall=9 success=yes exit=139822773370880 a0=0 a1=801000 a2=7 a3=20022 items=0 ppid=1 pid=984 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="firewalld" exe="/usr/bin/python2.7" subj=system_u:system_r:firewalld_t:s0 key=(null) type=AVC msg=audit(1387911946.163:535): avc: denied { execmem } for pid=984 comm="firewalld" scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:system_r:firewalld_t:s0 tclass=process ---- time->Tue Dec 24 12:05:52 2013 type=SYSCALL msg=audit(1387911952.115:549): arch=c000003e syscall=10 success=yes exit=0 a0=7ffffecad000 a1=1000 a2=1000007 a3=0 items=0 ppid=1113 pid=1902 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="dhclient" exe="/usr/sbin/dhclient" subj=system_u:system_r:dhcpc_t:s0 key=(null) type=AVC msg=audit(1387911952.115:549): avc: denied { execmem } for pid=1902 comm="dhclient" scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:system_r:dhcpc_t:s0 tclass=process type=AVC msg=audit(1387911952.115:549): avc: denied { execstack } for pid=1902 comm="dhclient" scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:system_r:dhcpc_t:s0 tclass=process ---- time->Tue Dec 24 12:05:52 2013 type=SYSCALL msg=audit(1387911952.713:551): arch=c000003e syscall=10 success=yes exit=0 a0=7fff27ee6000 a1=1000 a2=1000007 a3=0 items=0 ppid=1208 pid=1958 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="unbound-control" exe="/usr/sbin/unbound-control" subj=system_u:system_r:dnssec_trigger_t:s0 key=(null) type=AVC msg=audit(1387911952.713:551): avc: denied { execmem } for pid=1958 comm="unbound-control" scontext=system_u:system_r:dnssec_trigger_t:s0 tcontext=system_u:system_r:dnssec_trigger_t:s0 tclass=process type=AVC msg=audit(1387911952.713:551): avc: denied { execstack } for pid=1958 comm="unbound-control" scontext=system_u:system_r:dnssec_trigger_t:s0 tcontext=system_u:system_r:dnssec_trigger_t:s0 tclass=process Downgrading to libselinux-2.2.1-2 AND selinux-policy-3.13.1-9 seems to go back to the behavor before without these denials. I had to downgrade both, so I am not sure which one is responsible.