Bug 256361
| Summary: | SELinux is preventing /usr/bin/gdb (NetworkManager_t) "signal" to <Unknown> (unconfined_t). | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Martin Jürgens <ma> | ||||
| Component: | kernel | Assignee: | Eric Paris <eparis> | ||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | low | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 7 | CC: | dwalsh, jan.kratochvil | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | All | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | F8 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2008-01-08 14:43:40 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 232371 | ||||||
| Bug Blocks: | |||||||
| Attachments: |
|
||||||
|
Description
Martin Jürgens
2007-08-27 13:27:49 UTC
Created attachment 173541 [details]
selinux_alert
It is related to Bug 232371. In some way it is correct - the debugged process must have the right to signal the debugger. NetworkManager has restricted rights, it must not be able to signal anyone. Daniel, still it should be possible to get it working by permitting sending SIGCHLD to the (unconfined) ptrace-parent if the confined process is under ptrace. Is it possible to make it working in the kernel part of SELinux or it was already denied as too dangerous? This is not sigchld It is some other signal. sigchld is special cased in SELinux. SELinux differentiates: signull, sigstop, sigchld, sigkill; All others are grouped together as signal So allowing NetworkManager to send signals to any unconfined process is still considered dangerous. This problem has been fixed by Eric Paris in kernel-2.6.23.1-33.fc8: * Tue Oct 23 2007 Eric Paris <eparis> - check sigchld when waiting on a task (gdb/selinux interaction) file: linux-2.6-selinux-sigchld-wait.patch It is now just a question if it gets backported for F-7. F8 has been out long enough without anyone else complaining about F7. closing. |