Bug 462243

#============= auditd_t ==============
fs_rw_anon_inodefs_files(auditd_t)

#============= nsplugin_t ==============
allow nsplugin_t user_mplayer_home_t:file read;
allow nsplugin_t zero_device_t:chr_file execute;

Will be added 

#============= staff_sudo_t ==============
allow staff_sudo_t crond_t:key search;
This is somekind of wacky bug?  Are you running sudo in a cron job?

#============= staff_t ==============
allow staff_t user_tmp_t:sock_file execute;
allow staff_t xdm_xserver_tmp_t:dir write;
kernel_getattr_core_if(staff_t)
kernel_getattr_message_if(staff_t)
kernel_read_software_raid_state(staff_t)

Please attach the log files used to generate these?  Were you running as root in permissive mode?

time->Sun Sep 14 10:06:14 2008
type=SYSCALL msg=audit(1221379574.743:40): arch=c000003e syscall=250 success=no exit=-13 a0=0 a1=fffffffb a2=0 a3=7fff0f396eb0 items=0 ppid=7616 pid=7640 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=pts0 ses=1 comm="sudo" exe="/usr/bin/sudo" subj=domg472:staff_r:staff_sudo_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1221379574.743:40): avc:  denied  { search } for  pid=7640 comm="sudo" scontext=domg472:staff_r:staff_sudo_t:s0-s0:c0.c1023 tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=key

time->Sun Sep 14 17:09:19 2008
type=PATH msg=audit(1221404959.830:40): item=0 name="/proc/kmsg" inode=4026531848 dev=00:03 mode=0100400 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:proc_kmsg_t:s0
type=CWD msg=audit(1221404959.830:40):  cwd="/home/domg472"
type=SYSCALL msg=audit(1221404959.830:40): arch=c000003e syscall=6 success=no exit=-13 a0=27017b0 a1=41878dd0 a2=41878dd0 a3=3e8a367a70 items=1 ppid=3096 pid=9022 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="nautilus" exe="/usr/bin/nautilus" subj=domg472:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1221404959.830:40): avc:  denied  { getattr } for  pid=9022 comm="nautilus" path="/proc/kmsg" dev=proc ino=4026531848 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_kmsg_t:s0 tclass=file

time->Sun Sep 14 17:09:19 2008
type=PATH msg=audit(1221404959.831:42): item=0 name="/proc/mdstat" inode=4026531955 dev=00:03 mode=0100444 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:proc_mdstat_t:s0
type=CWD msg=audit(1221404959.831:42):  cwd="/home/domg472"
type=SYSCALL msg=audit(1221404959.831:42): arch=c000003e syscall=6 success=no exit=-13 a0=7f16740074e0 a1=4367bdd0 a2=4367bdd0 a3=7f1674000090 items=1 ppid=3096 pid=9039 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="nautilus" exe="/usr/bin/nautilus" subj=domg472:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1221404959.831:42): avc:  denied  { getattr } for  pid=9039 comm="nautilus" path="/proc/mdstat" dev=proc ino=4026531955 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_mdstat_t:s0 tclass=file

time->Sun Sep 14 17:09:24 2008
type=PATH msg=audit(1221404964.384:43): item=0 name="/tmp/gnome-system-monitor.domg472.1909916310" inode=18268
54 dev=fd:01 mode=0140775 ouid=500 ogid=500 rdev=00:00 obj=domg472:object_r:user_tmp_t:s0
type=CWD msg=audit(1221404964.384:43):  cwd="/home/domg472"
type=SYSCALL msg=audit(1221404964.384:43): arch=c000003e syscall=21 success=no exit=-13 a0=7f167400d800 a1=1 a
2=8 a3=7f1674017240 items=1 ppid=3096 pid=9039 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 s
gid=500 fsgid=500 tty=(none) ses=1 comm="nautilus" exe="/usr/bin/nautilus" subj=domg472:staff_r:staff_t:s0-s0:
c0.c1023 key=(null)
type=AVC msg=audit(1221404964.384:43): avc:  denied  { execute } for  pid=9039 comm="nautilus" name="gnome-system-monitor.domg472.1909916310" dev=dm-1 ino=1826854 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=domg472:object_r:user_tmp_t:s0 tclass=sock_file

time->Sun Sep 14 17:09:24 2008
type=PATH msg=audit(1221404964.440:44): item=0 name="/tmp/.X11-unix" inode=1843202 dev=fd:01 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:xdm_xserver_tmp_t:s0
type=CWD msg=audit(1221404964.440:44):  cwd="/home/domg472"
type=SYSCALL msg=audit(1221404964.440:44): arch=c000003e syscall=21 success=no exit=-13 a0=7f167401e590 a1=2 a2=8 a3=7f167401edf0 items=1 ppid=3096 pid=9039 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="nautilus" exe="/usr/bin/nautilus" subj=domg472:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1221404964.440:44): avc:  denied  { write } for  pid=9039 comm="nautilus" name=".X11-unix" dev=dm-1 ino=1843202 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xdm_xserver_tmp_t:s0 tclass=dir

time->Mon Sep 15 13:16:14 2008
type=PATH msg=audit(1221477374.993:86): item=0 name="/home/domg472/.bash_history" inode=7120275 dev=fd:01 mode=0100600 ouid=500 ogid=500 rdev=00:00 obj=domg472:object_r:user_home_t:s0
type=CWD msg=audit(1221477374.993:86):  cwd="/home/domg472"
type=SYSCALL msg=audit(1221477374.993:86): arch=c000003e syscall=2 success=no exit=-13 a0=256b8f0 a1=0 a2=1b6 a3=3e8a367a70 items=1 ppid=13979 pid=13980 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts3 ses=1 comm="sh" exe="/bin/bash" subj=domg472:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1221477374.993:86): avc:  denied  { dac_read_search } for  pid=13980 comm="sh" capability=2 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability
type=AVC msg=audit(1221477374.993:86): avc:  denied  { dac_override } for  pid=13980 comm="sh" capability=1 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability

About staff_sudo_t:
I do not run any cronjobs personally at all and i am the only staff usre on this system. verified empty crontab -e.

About Staff_t:
Yes i these may have been generated during permissive mode as yesterday i was troubleshooting some issues.

staff_t should never run as uid=0,  So the dac ones are caused by permissive mode.

allow staff_t user_tmp_t:sock_file execute;
allow staff_t xdm_xserver_tmp_t:dir write;
Did you notice anything going wrong?

kernel_getattr_core_if(staff_t)
kernel_getattr_message_if(staff_t)
kernel_read_software_raid_state(staff_t)

Did you use nautilus to look at /proc?

Yes i noticed some things going wrong, however i suspect that was not related to SELinux. (quite sure)

I do not recall me using nautilus to view /proc. I may have used the system-monitor.

please ignore these last avc denials for now. I will try to reproduce them and repost it with a better explanation of what i was doing when i am able to

Thanks

Added 


kernel_getattr_core_if(staff_t)
kernel_getattr_message_if(staff_t)
kernel_read_software_raid_state(staff_t)

To selinux-policy-3.5.8-1

Closing this one out as resolved. If it is not, please reopen.