Bug 544461
| Summary: | SELinux is preventing vlc (unconfined_execmem_t) "mmap_zero" to <Unknown> (unconfined_execmem_t). | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Edgar Dublin <dublinuxs> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 12 | CC: | dwalsh, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i386 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:a36e2bed219212f9b2fa0839cc0213dbe1b2d58b8df39076f1ed977667b2cfe3 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-12-05 12:16:20 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 538428 *** |
Resúmen: SELinux is preventing vlc (unconfined_execmem_t) "mmap_zero" to <Unknown> (unconfined_execmem_t). Descripción Detallada: SELinux denied access requested by vlc. The current boolean settings do not allow this access. If you have not setup vlc to require this access this may signal an intrusion attempt. If you do intend this access you need to change the booleans on this system to allow the access. Permitiendo Acceso: Confined processes can be configured to to run requiring different access, SELinux provides booleans to allow you to turn on/off access as needed. The boolean allow_unconfined_mmap_low is set incorrectly. Boolean Description: Allow unconfined domain to map low memory in the kernel Comando para Corregir: # setsebool -P allow_unconfined_mmap_low 1 Información Adicional: Contexto Fuente unconfined_u:unconfined_r:unconfined_execmem_t:s0- s0:c0.c1023 Contexto Destino unconfined_u:unconfined_r:unconfined_execmem_t:s0- s0:c0.c1023 Objetos Destino None [ memprotect ] Fuente vlc Dirección de Fuente /usr/bin/vlc Puerto <Desconocido> Nombre de Equipo (removed) Paquetes RPM Fuentes vlc-core-1.0.0-0.12rc4.fc11 Paquetes RPM Destinos RPM de Políticas selinux-policy-3.6.12-62.fc11 SELinux Activado True Tipo de Política targeted Modo Obediente Enforcing Nombre de Plugin catchall_boolean Nombre de Equipo (removed) Plataforma Linux (removed) 2.6.29.6-213.fc11.i686.PAE #1 SMP Tue Jul 7 20:59:29 EDT 2009 i686 i686 Cantidad de Alertas 106 Visto por Primera Vez mar 28 jul 2009 12:40:29 MDT Visto por Última Vez mar 28 jul 2009 12:40:29 MDT ID Local f871af0f-3dee-42a9-a534-28af998c5c38 Números de Línea Mensajes de Auditoría Crudos node=(removed) type=AVC msg=audit(1248806429.230:191): avc: denied { mmap_zero } for pid=5203 comm="vlc" scontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=memprotect node=(removed) type=SYSCALL msg=audit(1248806429.230:191): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=100000 a2=0 a3=4022 items=0 ppid=1 pid=5203 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="vlc" exe="/usr/bin/vlc" subj=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 key=(null) Hash String generated from selinux-policy-3.6.12-62.fc11,catchall_boolean,vlc,unconfined_execmem_t,unconfined_execmem_t,memprotect,mmap_zero audit2allow suggests: #============= unconfined_execmem_t ============== allow unconfined_execmem_t self:memprotect mmap_zero;