Bug 491462
| Summary: | AVC denials when restarting mysqld, network (possibly more) | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Viktor Erdelyi <verdelyi> | ||||||||||||||
| Component: | kdebase | Assignee: | Than Ngo <than> | ||||||||||||||
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||||||||||
| Severity: | medium | Docs Contact: | |||||||||||||||
| Priority: | low | ||||||||||||||||
| Version: | 10 | CC: | arbiter, dwalsh, jreznik, kevin, ltinkl, mgrepl, rdieter, smparrish, than | ||||||||||||||
| Target Milestone: | --- | ||||||||||||||||
| Target Release: | --- | ||||||||||||||||
| Hardware: | All | ||||||||||||||||
| OS: | Linux | ||||||||||||||||
| Whiteboard: | |||||||||||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||||||||||
| Doc Text: | Story Points: | --- | |||||||||||||||
| Clone Of: | Environment: | ||||||||||||||||
| Last Closed: | 2009-04-13 19:12:35 UTC | Type: | --- | ||||||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||||||
| Documentation: | --- | CRM: | |||||||||||||||
| Verified Versions: | Category: | --- | |||||||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||||||
| Embargoed: | |||||||||||||||||
| Attachments: |
|
||||||||||||||||
Created attachment 336153 [details]
Alert 2
Created attachment 336154 [details]
Alert 3
Created attachment 336155 [details]
Alert 4
Created attachment 336156 [details]
Alert 5
Created attachment 336157 [details]
Mysqld alerts in one file
It looks like that Alert 1,2,3 (partly mysqld alert) issues are caused by a leaked file descriptor in the console used to restart the daemon. Are you using a Konsole terminal? Alert 5 issue is a bug in kdebase. The kdm login program thinks it's home dir is / so it is trying to create /.kde in the root directory. Myslqd_safe_t issues are fixed in selinux-policy-3.5.13-51.fc10 Yes, I'm using Konsole. But if I use system-config-services to restart them, I don't get the AVCs. Ok, then it is caused by a leaked file descriptor in konsole/kdebase, which has been reported to them several times.
You can create a policy .te file like the following
cat > kdeleaks.te << __eof
policy_module(kdeleaks, 1.0)
require {
type unconfined_t;
attribute domain;
class unix_stream_socket { read write };
}
#============= dhcpc_t ==============
dontaudit domain unconfined_t:unix_stream_socket { read write };
__eof
# make -f /usr/share/selinux/devel/Makefile
# semodule -i kdeleaks.pp
*** This bug has been marked as a duplicate of bug 484370 *** |
Created attachment 336151 [details] alert 1 Description of problem: I'm getting loads of AVC denials when I restart a service from a root prompt. How reproducible: always Steps to Reproduce: Restart a service (/etc/init.d/whatever restart) Examples attached: mysqld, network Reproducible with sshd too. Version: selinux-policy-3.5.13-48.fc10.noarch