Bug 590481

Summary: SELinux is preventing /usr/sbin/aiccu (deleted) "write" access on /dev/net/tun.
Product: [Fedora] Fedora Reporter: Tomasz Torcz <tomek>
Component: aiccuAssignee: Conrad Meyer <cse.cem+redhatbugz>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: 13CC: cse.cem+redhatbugz, dwalsh, jeff.raber, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:7089934d3dae1abef4802e8f7dfd703b3214342f74e1f09501756050082f0c9c
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-07-12 20:34:20 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Tomasz Torcz 2010-05-09 19:02:17 UTC
Podsumowanie:

SELinux is preventing /usr/sbin/aiccu (deleted) "write" access on /dev/net/tun.

Szczegółowy opis:

[aiccu posiada typ zezwalania (aiccu_t). Ten dostęp nie został odmówiony.]

SELinux denied access requested by aiccu. It is not expected that this access is
required by aiccu and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Zezwalanie na dostęp:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Dodatkowe informacje:

Kontekst źródłowy          system_u:system_r:aiccu_t:s0
Kontekst docelowy             system_u:object_r:tun_tap_device_t:s0
Obiekty docelowe              /dev/net/tun [ chr_file ]
Źródło                     aiccu
Ścieżka źródłowa         /usr/sbin/aiccu (deleted)
Port                          <Nieznane>
Komputer                      (usunięto)
Źródłowe pakiety RPM       
Docelowe pakiety RPM          
Pakiet RPM polityki           selinux-policy-3.7.19-10.fc13
SELinux jest włączony       True
Typ polityki                  targeted
Tryb wymuszania               Enforcing
Nazwa wtyczki                 catchall
Nazwa komputera               (usunięto)
Platforma                     Linux (usunięto)
                              2.6.33.2-41.fc13.i686.PAE #1 SMP Mon Apr 12
                              14:10:01 UTC 2010 i686 i686
Liczba alarmów               2272
Po raz pierwszy               pią, 23 kwi 2010, 14:31:12
Po raz ostatni                nie, 9 maj 2010, 21:01:03
Lokalny identyfikator         a3977c14-5e2d-4f83-8a80-251370f3adee
Liczba wierszy                

Surowe komunikaty audytu      

node=(usunięto) type=AVC msg=audit(1273431663.469:264644): avc:  denied  { write } for  pid=3998 comm="aiccu" path="/dev/net/tun" dev=devtmpfs ino=8902 scontext=system_u:system_r:aiccu_t:s0 tcontext=system_u:object_r:tun_tap_device_t:s0 tclass=chr_file

node=(usunięto) type=SYSCALL msg=audit(1273431663.469:264644): arch=40000003 syscall=146 success=yes exit=171 a0=4 a1=b6da69ec a2=2 a3=0 items=0 ppid=1 pid=3998 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="aiccu" exe=2F7573722F7362696E2F6169636375202864656C6574656429 subj=system_u:system_r:aiccu_t:s0 key=(null)



Hash String generated from  catchall,aiccu,aiccu_t,tun_tap_device_t,chr_file,write
audit2allow suggests:

#============= aiccu_t ==============
allow aiccu_t tun_tap_device_t:chr_file write;

Comment 1 Daniel Walsh 2010-05-10 18:28:00 UTC
Does aiccu use the /dev/net/tun device?  Does it use any other devices?

Comment 2 Conrad Meyer 2010-05-11 03:13:03 UTC
(In reply to comment #1)
> Does aiccu use the /dev/net/tun device?  Does it use any other devices?    

$ strings /usr/sbin/aiccu |grep /dev/net

Says yes. I'm not familiar with it enough to say one way or the other if it uses other devices, though I'll take a quick look.

Comment 3 Conrad Meyer 2010-05-11 03:32:24 UTC
Just glancing at the code, it looks like /dev/net/tun is the only device it uses on linux.

Comment 4 Daniel Walsh 2010-05-11 14:34:39 UTC
Fixed in selinux-policy-3.7.19-15.fc13.noarch

Comment 5 Jeff Raber 2010-07-08 16:25:57 UTC
Daniel - Should this be CLOSED/ERRATA?