Bug 628275
| Summary: | SELinux is preventing /sbin/setfiles access to a leaked netlink_route_socket file descriptor. | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Bob Bitton <bobbitton> | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | 12 | CC: | al-gallegos, bobbitton, brucelm, dcpub, dennismattinglyzzark, don-redhat-z6y, dwalsh, frank.thrum, geslinux, greg.rancic, gwduker, hobbes1069, jim.cromie, jpgorrono, k.weiz, mgrepl, rnichols42, robatino, robert.l.kief, samuelnemalladinne, sannegha, szoke.karcsi, tsozik | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | i386 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | setroubleshoot_trace_hash:086acc2321e3bfb055fce67e892dac1be81865cb3093ca773d79db621929fd59 | ||||||
| Fixed In Version: | selinux-policy-3.6.32-123.fc12 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2010-10-14 06:33:59 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Bob Bitton
2010-08-29 04:41:16 UTC
Miroslav add
ifdef(`hide_broken_symptoms', `
dontaudit setfiles_t $1:socket_class_set { read write };
')
To
seutil_domtrans_setfiles
In F12/F13.
Bob, do you have any idea what you were running when this happened? We you updating software?
I just exited out of system-config-network In my case the system was just waking up from a suspend, and for some reason came up with networking disabled. I had to restart NetworkManager to get networking back on, but the AVC occurred prior to my doing that. That's not a reproducible scenario. Normally that laptop wakes up from suspend just fine, with no AVCs. kernel-2.6.32.19-163.fc12.i686 NetworkManager-0.8.1-3.git20100813.fc12.i686 selinux-policy-3.6.32-121.fc12.noarch selinux-policy-targeted-3.6.32-121.fc12.noarch Robert are you sure you have the same symptoms. unconfined_t should not be involved in an suspend/resume. Created attachment 442248 [details]
sealert report
All I know is that sealert linked to this bug when I clicked on "Report." Here's an attachment with the full report.
Can you get it to happen again? Yes, I've found a way to get that AVC to happen very easily. It is only indirectly related to the NetworkManager problem. If, from the System->Administration menu, I click on "Network" and supply the root password to bring up system-config-network, then I get that AVC twice. I do not see any AVCs if I invoke system-config-network from a terminal running a root shell. This is on a system where all interfaces are being controlled by NetworkManager, so system-config-network has nothing it can control anyway. Hope that helps. THis means that something in the login procedure is leaking a link to netlink_route_socket. Perhaps xdm? I see this in F12 x86_64 when running system-config-network and selecting File/Save (to test the fix for bug 589593). Don't believe I saw it in F13 or higher when doing the same thing. Was sent here automatically when sending the sealert report. I got the trouble after running my laptop on low/critical power. After power plugin and restart the computer (acer extensa 5620, Fedora 12) the networking (wlan) didnt came up. Within the network manager the button/action "enable networking" couldnt be activated properly, and the console command "/etc/init.d/network restart/(or start)" failed for the wlan interface. I remember that I had the troublle many time befor. Additional commment: during the go down due to low power I watched a flash video within mozilla firefox 3.5.12. Fixed in selinux-policy-3.6.32-123.fc12 selinux-policy-3.6.32-123.fc12 has been submitted as an update for Fedora 12. https://admin.fedoraproject.org/updates/selinux-policy-3.6.32-123.fc12 selinux-policy-3.6.32-123.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.6.32-123.fc12 selinux-policy-3.6.32-123.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report. |