Bug 522380
| Summary: | setroubleshoot: SELinux is preventing vbetool "mmap_zero" access on <Unknown>. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Rodd Clarkson <rodd> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | rawhide | CC: | ajax, atodorov, dwalsh, eparis, mgrepl |
| Target Milestone: | --- | Keywords: | Reopened |
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:2eaa3b6c17b0dec9dbea7a4862b004af2b34ba9fd312c1bea983aaac007b28b5 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-10-20 21:34:07 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Did you turn on the boolean? This is a configuration issue, turn the boolean on and vbetool will work for you. I see similar issue with default rawhide install:
type=1400 audit(1253010534.078:7): avc: denied { mmap_zero } for pid=434 comm="vbetool" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=memprotect
Shoudn't vbetool turn this boolean on by default ?
Did you see any problem from not having the boolean turned on? Does your machine successfully Suspend/Resume? This was from automated test run. I have only shell access to this machine and I'm not sure if I can test suspend/resume via serial console. The problem here is the boolean is all on or all off. With the boolean turned off, we can prevent unconfined users/admin from accidentally executing mmap_zero applications, allowing them to take over the machine. I guess since the standard is now to require root access, I can turn the boolean on by default. The only other app besides vbetool that needs this access is wine. *** This bug has been marked as a duplicate of bug 528022 *** |
The following was filed automatically by setroubleshoot: Summary: SELinux is preventing vbetool "mmap_zero" access on <Unknown>. Detailed Description: [vbetool has a permissive type (vbetool_t). This access was not denied.] SELinux denied access requested by vbetool. The current boolean settings do not allow this access. If you have not setup vbetool to require this access this may signal an intrusion attempt. If you do intend this access you need to change the booleans on this system to allow the access. Allowing Access: Confined processes can be configured to to run requiring different access, SELinux provides booleans to allow you to turn on/off access as needed. The boolean mmap_low_allowed is set incorrectly. Boolean Description: Allow certain domains to map low memory in the kernel Fix Command: # setsebool -P mmap_low_allowed 1 Additional Information: Source Context system_u:system_r:vbetool_t:s0-s0:c0.c1023 Target Context system_u:system_r:vbetool_t:s0-s0:c0.c1023 Target Objects None [ memprotect ] Source vbetool Source Path /usr/sbin/vbetool Port <Unknown> Host (removed) Source RPM Packages vbetool-1.2.1-1.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.30-4.fc12 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_boolean Host Name (removed) Platform Linux (removed) 2.6.31-0.125.4.2.rc5.git2.fc12.x86_64 #1 SMP Tue Aug 11 21:00:45 EDT 2009 x86_64 x86_64 Alert Count 6 First Seen Thu 10 Sep 2009 07:53:42 EST Last Seen Thu 10 Sep 2009 19:07:21 EST Local ID f7610e37-3869-489b-bc36-25e2fd111a3c Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1252573641.381:37): avc: denied { mmap_zero } for pid=2350 comm="vbetool" scontext=system_u:system_r:vbetool_t:s0-s0:c0.c1023 tcontext=system_u:system_r:vbetool_t:s0-s0:c0.c1023 tclass=memprotect node=(removed) type=SYSCALL msg=audit(1252573641.381:37): arch=c000003e syscall=9 success=yes exit=0 a0=0 a1=502 a2=7 a3=11 items=0 ppid=2338 pid=2350 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="vbetool" exe="/usr/sbin/vbetool" subj=system_u:system_r:vbetool_t:s0-s0:c0.c1023 key=(null) audit2allow suggests: #============= vbetool_t ============== allow vbetool_t self:memprotect mmap_zero;