Bug 710802

Resúmen:

SELinux is preventing generaobjetosco access to a leaked <Unknown> file
descriptor.

Descripción Detallada:

SELinux denied access requested by the generaobjetosco command. It looks like
this is either a leaked descriptor or generaobjetosco output was redirected to a
file it is not allowed to access. Leaks usually can be ignored since SELinux is
just closing the leak and reporting the error. The application does not use the
descriptor, so it will run properly. If this is a redirection, you will not get
output in the <Unknown>. You should generate a bugzilla on selinux-policy, and
it will get routed to the appropriate package. You can safely ignore this avc.

Permitiendo Acceso:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385)

Información Adicional:

Contexto Fuente               unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Contexto Destino              unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Objetos Destino               None [ memprotect ]
Fuente                        generaobjetosco
Dirección de Fuente          generaobjetosco
Puerto                        <Desconocido>
Nombre de Equipo              (eliminado)
Paquetes RPM Fuentes          
Paquetes RPM Destinos         
RPM de Políticas             selinux-policy-3.6.32-125.fc12
SELinux Activado              True
Tipo de Política             targeted
Modo Obediente                Enforcing
Nombre de Plugin              leaks
Nombre de Equipo              (eliminado)
Plataforma                    Linux (eliminado)
                              2.6.32.23-170.fc12.i686 #1 SMP Mon Sep 27 17:58:16
                              UTC 2010 i686 i686
Cantidad de Alertas           2
Visto por Primera Vez         jue 10 feb 2011 12:03:47 PYST
Visto por Última Vez         jue 10 feb 2011 12:03:53 PYST
ID Local                      3079d185-04ef-4367-8229-3a6d94ee65a5
Números de Línea            

Mensajes de Auditoría Crudos 

node=(eliminado) type=AVC msg=audit(1297350233.251:24569): avc:  denied  { mmap_zero } for  pid=26236 comm="generaobjetosco" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect

node=(eliminado) type=SYSCALL msg=audit(1297350233.251:24569): arch=40000003 syscall=11 per=400000 success=no exit=-13 a0=9cb1cb0 a1=9cb1fb0 a2=9ca6e00 a3=9cb1fb0 items=0 ppid=25663 pid=26236 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="generaobjetosco" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  leaks,generaobjetosco,unconfined_t,unconfined_t,memprotect,mmap_zero
audit2allow suggests:

#============= unconfined_t ==============
#!!!! This avc can be allowed using the boolean 'mmap_low_allowed'

allow unconfined_t self:memprotect mmap_zero;