Bug 524369
Summary: | setroubleshoot: SELinux is preventing pt_chown (unconfined_t) "mmap_zero" to <Unknown> (unconfined_t). | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Martin Naď <martin.nad89> |
Component: | glibc | Assignee: | Andreas Schwab <schwab> |
Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | medium | Docs Contact: | |
Priority: | low | ||
Version: | rawhide | CC: | dwalsh, eparis, jakub, mgrepl, schwab |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | x86_64 | ||
OS: | Linux | ||
Whiteboard: | setroubleshoot_trace_hash:759ce6aadd6cbf7c870a1823e261a6a265e80ed9d0ffcdfbdff22eb5d468427b | ||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2009-09-21 09:13:55 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Martin Naď
2009-09-19 14:16:03 UTC
To stop you needing pt_chown, you should change the line you your /etc/fstab to look like the following. devpts /dev/pts devpts gid=5,mode=620 0 0 Then execute mount -a Your virtual machines should come up without needing pt_chown any longer. If you are not launching virtual machines, what were you doing to cause this problem? pt_chown should not need this vailue. on fc11 Souhrn: SELinux is preventing pt_chown (unconfined_t) "mmap_zero" to <Unknown> (unconfined_t). Podrobný popis: SELinux denied access requested by pt_chown. The current boolean settings do not allow this access. If you have not setup pt_chown to require this access this may signal an intrusion attempt. If you do intend this access you need to change the booleans on this system to allow the access. Povolení přístupu: Confined processes can be configured to to run requiring different access, SELinux provides booleans to allow you to turn on/off access as needed. The boolean allow_unconfined_mmap_low is set incorrectly. Boolean Description: Allow unconfined domain to map low memory in the kernel Příkaz pro opravu: # setsebool -P allow_unconfined_mmap_low 1 Další informace: Kontext zdroje unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Kontext cíle unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Objekty cíle None [ memprotect ] Zdroj pt_chown Cesta zdroje /usr/libexec/pt_chown Port <Neznámé> Počítač fedora.linux RPM balíčky zdroje glibc-common-2.10.1-5 RPM balíčky cíle RPM politiky selinux-policy-3.6.12-83.fc11 Selinux povolen True Typ politiky targeted MLS povoleno True Vynucovací režim Enforcing Název zásuvného modulu catchall_boolean Název počítače fedora.linux Platforma Linux fedora.linux 2.6.30.5-43.fc11.x86_64 #1 SMP Thu Aug 27 21:39:52 EDT 2009 x86_64 x86_64 Počet upozornění 3 Poprvé viděno Po 21. září 2009, 20:12:42 CEST Naposledy viděno Po 21. září 2009, 20:12:42 CEST Místní ID 2f47ab10-f793-498e-bb15-3ac67210bfc0 Čísla řádků Původní zprávy auditu node=fedora.linux type=AVC msg=audit(1253556762.671:162): avc: denied { mmap_zero } for pid=26396 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect node=fedora.linux type=AVC msg=audit(1253556762.671:162): avc: denied { mmap_zero } for pid=26396 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect node=fedora.linux type=AVC msg=audit(1253556762.671:162): avc: denied { mmap_zero } for pid=26396 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect node=fedora.linux type=SYSCALL msg=audit(1253556762.671:162): arch=c000003e syscall=125 success=yes exit=0 a0=7fff3919a014 a1=0 a2=7fff382cfe80 a3=7fff28ee9020 items=0 ppid=26394 pid=26396 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=9 comm="pt_chown" exe="/usr/libexec/pt_chown" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) This has zero to do with gcc. If you have wrong /etc/fstab, then it is anaconda (or mock) fault that it created them wrongly (f11 anaconda and mock do that). *** This bug has been marked as a duplicate of bug 517582 *** |