Bug 200083

Summary: readlink of executables causing ptrace SELinux access check to fire
Product: [Fedora] Fedora Reporter: Daniel Walsh <dwalsh>
Component: kernelAssignee: Eric Paris <eparis>
Status: CLOSED NOTABUG QA Contact: Brian Brock <bbrock>
Severity: low Docs Contact:
Priority: high    
Version: rawhideCC: eparis, sdsmall, wtogami
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2006-07-26 18:11:23 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Daniel Walsh 2006-07-25 13:07:34 UTC 
Description of problem:

The pidof command is doing a readlink of exe files which is causing AVC denials
of ptrace.

type=SYSCALL msg=audit(1153832702.855:6379): arch=40000003 syscall=85 success=no
exit=-13 a0=bfbecd48 a1=9f0aea0 a2=1000 a3=9f08d40 items=1 ppid=9118 pid=9122
auid=3267 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0
comm="pidof" exe="/sbin/killall5" subj=user_u:system_r:initrc_t:s0 key=(null)

You can also get this same behaviour with the readlink command on the 
readlink /proc/9122/exe

This is causing lots of AVC messages during boot and will happen when a normal
user becomes root using su, and does a pidof command.

pidof should not try to ptrace applications.
Comment 1 Stephen Smalley 2006-07-25 13:30:47 UTC 
proc uses ptrace checking as a way of controlling access to process private state. 
There were some changes upstream in recent kernels in this area, e.g. see:
http://marc.theaimsgroup.com/?l=git-commits-head&m=115134545732646&w=2
SELinux is just applying ptrace checks consistently with the core kernel here.
Comment 2 Daniel Walsh 2006-07-25 14:12:49 UTC 
So should these be dontaudited?   Allowed?
Comment 3 Stephen Smalley 2006-07-25 14:17:45 UTC 
You'd have to allow it if you wanted the caller to be able to find the process
id of a given program via pidof.  Naturally, you'd only do that for privileged
domains.
Comment 4 Daniel Walsh 2006-07-26 18:11:23 UTC 
Ok, so I guess this is not a bug.  Updated policy.