Bug 249152
Summary: | AVC for ppp under targeted, that probably shouldn't happen | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Bruno Wolff III <bruno> |
Component: | ppp | Assignee: | Jiri Skala <jskala> |
Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | low | Docs Contact: | |
Priority: | low | ||
Version: | 9 | CC: | aglotov, bikehead, dwalsh |
Target Milestone: | --- | Keywords: | Reopened |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2009-06-10 09:58:28 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Bruno Wolff III
2007-07-21 15:03:55 UTC
This looks like a problem in ppp. Why is ppp writing to a file connect-errors under /etc/? This should be under /var/run or /var/log? You can fix this for now by executing chcon -t ppp_etc_rw_t /etc/ppp/connect-errors This was also addressed in Bug 118837. I found an old patch that fixed this so I adjusted it for 2.4.4 and applied it. Not sure why it wasn't applied though. This should be fixed in ppp-2.4.4-5.fc9 OK. I should be able to test it in a couple of days. I'll reopen the bug if it is still a problem. Sorry, I didn't get aropund to this as soon as I had hoped. I am still seeing occasional AVC's for pppd, though not everytime it starts. It looks like it may be a different bug than the previous one though. Here is a sample: [root@bruno log]# sealert -l 9b8bf34e-5dbf-44bd-9907-3c43d98d6168 Summary: SELinux is preventing pppd (pppd_t) "write" to <Unknown> (sysctl_net_t). Detailed Description: [SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.] SELinux denied access requested by pppd. It is not expected that this access is required by pppd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for <Unknown>, restorecon -v '<Unknown>' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:pppd_t Target Context system_u:object_r:sysctl_net_t Target Objects None [ file ] Source pppd Source Path <Unknown> Port <Unknown> Host bruno.wolff.to Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.3.1-42.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall_file Host Name bruno.wolff.to Platform Linux bruno.wolff.to 2.6.25-14.fc9.i686 #1 SMP Thu May 1 06:28:41 EDT 2008 i686 athlon Alert Count 39 First Seen Wed Feb 6 06:35:11 2008 Last Seen Mon May 12 11:02:49 2008 Local ID 9b8bf34e-5dbf-44bd-9907-3c43d98d6168 Line Numbers Raw Audit Messages host=bruno.wolff.to type=AVC msg=audit(1210608169.80:30): avc: denied { write } for pid=2019 comm="pppd" scontext=system_u:system_r:pppd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file You can allow this for now by executing # audit2allow -M mypol -i /var/log/audit/audit.log # semodule -i mypol.pp Fixed in selinux-policy-3.3.1-52.fc9 I am still getting AVC's from ppp: sealert -l 9b8bf34e-5dbf-44bd-9907-3c43d98d6168 Summary: SELinux is preventing pppd (pppd_t) "write" to <Unknown> (sysctl_net_t). Detailed Description: [SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.] SELinux denied access requested by pppd. It is not expected that this access is required by pppd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for <Unknown>, restorecon -v '<Unknown>' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:pppd_t Target Context system_u:object_r:sysctl_net_t Target Objects None [ file ] Source pppd Source Path <Unknown> Port <Unknown> Host bruno.wolff.to Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.3.1-79.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall_file Host Name bruno.wolff.to Platform Linux bruno.wolff.to 2.6.25.14-108.fc9.i686 #1 SMP Mon Aug 4 14:08:11 EDT 2008 i686 athlon Alert Count 51 First Seen Wed Feb 6 06:35:11 2008 Last Seen Thu Aug 14 07:24:48 2008 Local ID 9b8bf34e-5dbf-44bd-9907-3c43d98d6168 Line Numbers Raw Audit Messages host=bruno.wolff.to type=AVC msg=audit(1218716688.658:19): avc: denied { write } for pid=1963 comm="pppd" scontext=system_u:system_r:pppd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file You can allow this for now. # audit2allow -M mypol -l -i /var/log/audit/audit.log # semodule -i mypol.pp Fixed in selinux-policy-3.3.1-86.fc9.noarch *** Bug 454358 has been marked as a duplicate of this bug. *** This message is a reminder that Fedora 9 is nearing its end of life. Approximately 30 (thirty) days from now Fedora will stop maintaining and issuing updates for Fedora 9. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '9'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 9's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 9 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora please change the 'version' of this bug to the applicable version. If you are unable to change the version, please add a comment here and someone will do it for you. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping |