Bug 524369

Summary: setroubleshoot: SELinux is preventing pt_chown (unconfined_t) "mmap_zero" to <Unknown> (unconfined_t).
Product: [Fedora] Fedora Reporter: Martin Naď <martin.nad89>
Component: glibcAssignee: Andreas Schwab <schwab>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: rawhideCC: dwalsh, eparis, jakub, mgrepl, schwab
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:759ce6aadd6cbf7c870a1823e261a6a265e80ed9d0ffcdfbdff22eb5d468427b
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-09-21 09:13:55 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Martin Naď 2009-09-19 14:16:03 UTC
The following was filed automatically by setroubleshoot:

Souhrn:

SELinux is preventing pt_chown (unconfined_t) "mmap_zero" to <Unknown>
(unconfined_t).

Podrobný popis:

[pt_chown has a permissive type (unconfined_t). This access was not denied.]

SELinux denied access requested by pt_chown. The current boolean settings do not
allow this access. If you have not setup pt_chown to require this access this
may signal an intrusion attempt. If you do intend this access you need to change
the booleans on this system to allow the access.

Povolení přístupu:

Confined processes can be configured to to run requiring different access,
SELinux provides booleans to allow you to turn on/off access as needed. The
boolean allow_unconfined_mmap_low is set incorrectly.
Boolean Description:
Allow unconfined domain to map low memory in the kernel


Příkaz pro opravu:

# setsebool -P allow_unconfined_mmap_low 1

Další informace:

Kontext zdroje                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Kontext cíle                 unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Objekty cíle                 None [ memprotect ]
Zdroj                         pt_chown
Cesta zdroje                  /usr/libexec/pt_chown
Port                          <Neznámé>
Počítač                    (removed)
RPM balíčky zdroje          glibc-common-2.10.1-5
RPM balíčky cíle           
RPM politiky                  selinux-policy-3.6.12-80.fc11
Selinux povolen               True
Typ politiky                  targeted
MLS povoleno                  True
Vynucovací režim            Enforcing
Název zásuvného modulu     catchall_boolean
Název počítače            (removed)
Platforma                     Linux (removed)
                              2.6.30.5-43.fc11.x86_64 #1 SMP Thu Aug 27 21:39:52
                              EDT 2009 x86_64 x86_64
Počet upozornění           3
Poprvé viděno               Út 8. září 2009, 22:39:08 CEST
Naposledy viděno             Út 8. září 2009, 22:39:08 CEST
Místní ID                   f48f1fb8-2baa-4c8b-a0e8-805ab9848e4c
Čísla řádků              

Původní zprávy auditu      

node=(removed) type=AVC msg=audit(1252442348.984:11): avc:  denied  { mmap_zero } for  pid=2021 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect

node=(removed) type=AVC msg=audit(1252442348.984:11): avc:  denied  { mmap_zero } for  pid=2021 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect

node=(removed) type=AVC msg=audit(1252442348.984:11): avc:  denied  { mmap_zero } for  pid=2021 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect

node=(removed) type=SYSCALL msg=audit(1252442348.984:11): arch=c000003e syscall=125 success=yes exit=0 a0=7fff939a7014 a1=0 a2=7fff91d87e80 a3=7fff5364a690 items=0 ppid=2020 pid=2021 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="pt_chown" exe="/usr/libexec/pt_chown" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)


audit2allow suggests:

#============= unconfined_t ==============
allow unconfined_t self:memprotect mmap_zero;

Comment 1 Daniel Walsh 2009-09-20 11:24:17 UTC
To stop you needing pt_chown, you should change the line you your /etc/fstab to look like the following.

devpts                  /dev/pts                devpts  gid=5,mode=620  0 0


Then execute mount -a


Your virtual machines should come up without needing pt_chown any longer.

If you are not launching virtual machines, what were you doing to cause this problem?

pt_chown should not need this vailue.

Comment 2 Martin Naď 2009-09-20 20:33:42 UTC
on fc11

Souhrn:

SELinux is preventing pt_chown (unconfined_t) "mmap_zero" to <Unknown>
(unconfined_t).

Podrobný popis:

SELinux denied access requested by pt_chown. The current boolean settings do not
allow this access. If you have not setup pt_chown to require this access this
may signal an intrusion attempt. If you do intend this access you need to change
the booleans on this system to allow the access.

Povolení přístupu:

Confined processes can be configured to to run requiring different access,
SELinux provides booleans to allow you to turn on/off access as needed. The
boolean allow_unconfined_mmap_low is set incorrectly.
Boolean Description:
Allow unconfined domain to map low memory in the kernel


Příkaz pro opravu:

# setsebool -P allow_unconfined_mmap_low 1

Další informace:

Kontext zdroje                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Kontext cíle                 unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Objekty cíle                 None [ memprotect ]
Zdroj                         pt_chown
Cesta zdroje                  /usr/libexec/pt_chown
Port                          <Neznámé>
Počítač                    fedora.linux
RPM balíčky zdroje          glibc-common-2.10.1-5
RPM balíčky cíle           
RPM politiky                  selinux-policy-3.6.12-83.fc11
Selinux povolen               True
Typ politiky                  targeted
MLS povoleno                  True
Vynucovací režim            Enforcing
Název zásuvného modulu     catchall_boolean
Název počítače            fedora.linux
Platforma                     Linux fedora.linux 2.6.30.5-43.fc11.x86_64 #1 SMP
                              Thu Aug 27 21:39:52 EDT 2009 x86_64 x86_64
Počet upozornění           3
Poprvé viděno               Po 21. září 2009, 20:12:42 CEST
Naposledy viděno             Po 21. září 2009, 20:12:42 CEST
Místní ID                   2f47ab10-f793-498e-bb15-3ac67210bfc0
Čísla řádků              

Původní zprávy auditu      

node=fedora.linux type=AVC msg=audit(1253556762.671:162): avc:  denied  { mmap_zero } for  pid=26396 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect

node=fedora.linux type=AVC msg=audit(1253556762.671:162): avc:  denied  { mmap_zero } for  pid=26396 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect

node=fedora.linux type=AVC msg=audit(1253556762.671:162): avc:  denied  { mmap_zero } for  pid=26396 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect

node=fedora.linux type=SYSCALL msg=audit(1253556762.671:162): arch=c000003e syscall=125 success=yes exit=0 a0=7fff3919a014 a1=0 a2=7fff382cfe80 a3=7fff28ee9020 items=0 ppid=26394 pid=26396 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=9 comm="pt_chown" exe="/usr/libexec/pt_chown" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)

Comment 3 Jakub Jelinek 2009-09-21 07:23:16 UTC
This has zero to do with gcc.
If you have wrong /etc/fstab, then it is anaconda (or mock) fault that it created them wrongly (f11 anaconda and mock do that).

Comment 4 Andreas Schwab 2009-09-21 09:13:55 UTC

*** This bug has been marked as a duplicate of bug 517582 ***