Bug 539728

Souhrn:

SELinux is preventing updatedb (locate_t) "sys_resource" locate_t.

Podrobný popis:

[updatedb has a permissive type (locate_t). This access was not denied.]

SELinux denied access requested by updatedb. It is not expected that this access
is required by updatedb and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.

Povolení přístupu:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Další informace:

Kontext zdroje                system_u:system_r:locate_t:s0-s0:c0.c1023
Kontext cíle                 system_u:system_r:locate_t:s0-s0:c0.c1023
Objekty cíle                 None [ capability ]
Zdroj                         updatedb
Cesta zdroje                  /usr/bin/updatedb
Port                          <Neznámé>
Počítač                    (removed)
RPM balíčky zdroje          mlocate-0.22-1
RPM balíčky cíle           
RPM politiky                  selinux-policy-3.6.12-45.fc11
Selinux povolen               True
Typ politiky                  targeted
Vynucovací režim            Enforcing
Název zásuvného modulu     catchall
Název počítače            (removed)
Platforma                     Linux (removed) 2.6.29.4-167.fc11.x86_64 #1 SMP Wed
                              May 27 17:27:08 EDT 2009 x86_64 x86_64
Počet upozornění           158
Poprvé viděno               So 13. červen 2009, 03:54:49 CEST
Naposledy viděno             So 13. červen 2009, 03:54:56 CEST
Místní ID                   b0ae6f04-10bb-425a-8c82-6065172294fb
Čísla řádků              

Původní zprávy auditu      

node=(removed) type=AVC msg=audit(1244858096.170:61720): avc:  denied  { sys_resource } for  pid=10646 comm="updatedb" capability=24 scontext=system_u:system_r:locate_t:s0-s0:c0.c1023 tcontext=system_u:system_r:locate_t:s0-s0:c0.c1023 tclass=capability

node=(removed) type=SYSCALL msg=audit(1244858096.170:61720): arch=c000003e syscall=1 success=yes exit=4096 a0=6 a1=7f0b15d64000 a2=1000 a3=6b2f656d6f682f74 items=0 ppid=10640 pid=10646 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=29 comm="updatedb" exe="/usr/bin/updatedb" subj=system_u:system_r:locate_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.6.12-45.fc11,catchall,updatedb,locate_t,locate_t,capability,sys_resource
audit2allow suggests:

#============= locate_t ==============
allow locate_t self:capability sys_resource;