Bug 485409
| Summary: | SELinux restrains semodule (semanage_t) "write" for access at system_crond_t. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Matthias Behr <matthias.behr> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 9 | CC: | dwalsh, jkubin, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i686 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-06-10 08:07:42 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
This AVC can be ignored. It is a simple redirection of stdout, which is being denied. Miroslav, I think we should add. cron_rw_system_job_pipes(domain) To the system. If I had to guess what is going on here, you have yum or rpm running as a cron job and some package runs semodule in a post install script. The terminal gets assigned to a cron fifo_file and semodule is not allowed to write its stdout to it. semodule would complete successfully. Fixed in selinux-policy-3.3.1-123.fc9 This message is a reminder that Fedora 9 is nearing its end of life. Approximately 30 (thirty) days from now Fedora will stop maintaining and issuing updates for Fedora 9. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '9'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 9's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 9 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora please change the 'version' of this bug to the applicable version. If you are unable to change the version, please add a comment here and someone will do it for you. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping |
Description of problem: Version-Release number of selected component (if applicable): How reproducible: There were no reasons for reproducing the bug because its not made by an user action or after any user action. The computer runs without any actions and after few hours 'selinux' (not configured yet since installation - absolutely virgin) returns the following report: Actual results: Sum: SELinux restrains semodule (semanage_t) "write" for access at system_crond_t. detailed description: "SELinux verweigerte den von semodule angeforderten Zugriff. Da nicht davon ausgegangen wird, dass dieser Zugriff von semodule benötigt wird, signalisiert dies möglicherweise einen Einbruchsversuch. Es ist ausserdem möglich, dass diese spezielle Version oder Konfiguration der Anwendung den zusätzlichen Zugriff verursacht." I try it in english: SELinux denies semodule write access for system_crond_t, because its not necessary for semodule to access system_crond_t. additional informations: source context system_u:system_r:semanage_t:s0 target context system_u:system_r:system_crond_t:s0 target objects pipe [ fifo_file ] source semodule source-path /usr/sbin/semodule port <Unbekannt> host localhost.localdomain source-RPM-packages policycoreutils-2.0.52-8.fc9 target-RPM-packages RPM-policy selinux-policy-3.3.1-119.fc9 SELinux active True policyversion targeted MLS active True enforcing-mode Enforcing plugin-name catchall hostname localhost.localdomain platform Linux localhost.localdomain 2.6.27.12-78.2.8.fc9.i686 #1 SMP Mon Jan 19 20:14:35 EST 2009 i686 i686 encountered alarms 7 first sawn Do 15 Jan 2009 09:38:21 CET last sawn Fr 13 Feb 2009 11:51:56 CET local ID ee353dd1-16a4-4daf-8fe3-d012c15c79e8 line numbers raw-audit-messages node=localhost.localdomain type=AVC msg=audit(1234522316.650:22): avc: denied { write } for pid=7177 comm="semodule" path="pipe:[65073]" dev=pipefs ino=65073 scontext=system_u:system_r:semanage_t:s0 tcontext=system_u:system_r:system_crond_t:s0 tclass=fifo_file node=localhost.localdomain type=AVC msg=audit(1234522316.650:22): avc: denied { write } for pid=7177 comm="semodule" path="pipe:[65073]" dev=pipefs ino=65073 scontext=system_u:system_r:semanage_t:s0 tcontext=system_u:system_r:system_crond_t:s0 tclass=fifo_file node=localhost.localdomain type=SYSCALL msg=audit(1234522316.650:22): arch=40000003 syscall=11 success=yes exit=0 a0=a0486b0 a1=a0503c8 a2=a04f158 a3=0 items=0 ppid=7176 pid=7177 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="semodule" exe="/usr/sbin/semodule" subj=system_u:system_r:semanage_t:s0 key=(null) I hope this will result in an answer. Thank you for your engagement. Kind regards, matthias.