Bug 538882

Résumé:

SELinux is preventing /bin/ping access to a leaked
/usr/local/nagios/var/spool/checkresults/checkzjFZDh file descriptor.

Description détaillée:

[ping has a permissive type (ping_t). This access was not denied.]

SELinux denied access requested by the ping command. It looks like this is
either a leaked descriptor or ping output was redirected to a file it is not
allowed to access. Leaks usually can be ignored since SELinux is just closing
the leak and reporting the error. The application does not use the descriptor,
so it will run properly. If this is a redirection, you will not get output in
the /usr/local/nagios/var/spool/checkresults/checkzjFZDh. You should generate a
bugzilla on selinux-policy, and it will get routed to the appropriate package.
You can safely ignore this avc.

Autoriser l'accès:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385)

Informations complémentaires:

Contexte source               system_u:system_r:ping_t:s0
Contexte cible                system_u:object_r:usr_t:s0
Objets du contexte            /usr/local/nagios/var/spool/checkresults/checkzjFZ
                              Dh [ file ]
source                        ping
Chemin de la source           /bin/ping
Port                          <Inconnu>
Hôte                         (removed)
Paquetages RPM source         iputils-20071127-9.fc12
Paquetages RPM cible          
Politique RPM                 selinux-policy-3.6.32-41.fc12
Selinux activé               True
Type de politique             targeted
MLS activé                   True
Mode strict                   Enforcing
Nom du plugin                 leaks
Nom de l'hôte                (removed)
Plateforme                    Linux (removed)
                              2.6.31.5-127.fc12.x86_64 #1 SMP Sat Nov 7 21:11:14
                              EST 2009 x86_64 x86_64
Compteur d'alertes            1
Première alerte              jeu. 19 nov. 2009 16:48:39 CET
Dernière alerte              jeu. 19 nov. 2009 16:48:39 CET
ID local                      8800d302-3f50-4ba9-9038-38e028c3c022
Numéros des lignes           

Messages d'audit bruts        

node=(removed) type=AVC msg=audit(1258645719.246:42780): avc:  denied  { read write } for  pid=3220 comm="ping" path="/usr/local/nagios/var/spool/checkresults/checkzjFZDh" dev=sdc5 ino=7604500 scontext=system_u:system_r:ping_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1258645719.246:42780): arch=c000003e syscall=59 success=yes exit=0 a0=e543c0 a1=e543f0 a2=7fff4e8fe990 a3=7fff4e8fe700 items=0 ppid=3219 pid=3220 auid=4294967295 uid=501 gid=501 euid=0 suid=0 fsuid=0 egid=501 sgid=501 fsgid=501 tty=(none) ses=4294967295 comm="ping" exe="/bin/ping" subj=system_u:system_r:ping_t:s0 key=(null)



Hash String generated from  selinux-policy-3.6.32-41.fc12,leaks,ping,ping_t,usr_t,file,read,write
audit2allow suggests:

#============= ping_t ==============
allow ping_t usr_t:file { read write };