Bug 721388

Summary: SELinux is preventing evolution from 'mmap_zero' accesses on the memprotect Unknown.
Product: [Fedora] Fedora Reporter: Sai Kiran Kanuri <saikiranrgda>
Component: openchangeAssignee: Matthew Barnes <mbarnes>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 15CC: dominick.grift, dwalsh, eparis, lucilanga, mbarnes, mcrha, mgrepl, ssorce
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:aef98a92308f16958354dfbbe1dc4e56d0b57dac4d10d845ffca09140164badc
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-08-07 17:05:29 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Sai Kiran Kanuri 2011-07-14 13:32:33 UTC
SELinux is preventing evolution from 'mmap_zero' accesses on the memprotect Unknown.

*****  Plugin mmap_zero (53.1 confidence) suggests  **************************

If you do not think evolution should need to mmap low memory in the kernel.
Then you may be under attack by a hacker, this is a very dangerous access.
Do
contact your security administrator and report this issue.

*****  Plugin catchall_boolean (42.6 confidence) suggests  *******************

If you want to control the ability to mmap a low area of the address space, as configured by /proc/sys/kernel/mmap_min_addr.
Then you must tell SELinux about this by enabling the 'mmap_low_allowed' boolean.
Do
setsebool -P mmap_low_allowed 1

*****  Plugin catchall (5.76 confidence) suggests  ***************************

If you believe that evolution should be allowed mmap_zero access on the Unknown memprotect by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep evolution /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Objects                Unknown [ memprotect ]
Source                        evolution
Source Path                   evolution
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.16-32.fc15
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.38.8-35.fc15.i686.PAE #1 SMP Wed Jul 6
                              14:29:06 UTC 2011 i686 i686
Alert Count                   9
First Seen                    Thu 14 Jul 2011 03:13:41 PM IST
Last Seen                     Thu 14 Jul 2011 03:13:44 PM IST
Local ID                      b45545d7-6bed-4c66-8515-c10096124706

Raw Audit Messages
type=AVC msg=audit(1310636624.470:332): avc:  denied  { mmap_zero } for  pid=26270 comm="evolution" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect


Hash: evolution,unconfined_t,unconfined_t,memprotect,mmap_zero

audit2allow

#============= unconfined_t ==============
#!!!! This avc can be allowed using the boolean 'mmap_low_allowed'

allow unconfined_t self:memprotect mmap_zero;

audit2allow -R

#============= unconfined_t ==============
#!!!! This avc can be allowed using the boolean 'mmap_low_allowed'

allow unconfined_t self:memprotect mmap_zero;

Comment 1 Daniel Walsh 2011-07-14 14:09:46 UTC
If this is real, it is not something we would want to allow.  mmap_zero is a dangerous permission and very few applications should require it.

Comment 2 Sai Kiran Kanuri 2011-07-15 05:54:02 UTC
This information might be useful..


$ rpm -qa 'evolution*'
evolution-mapi-3.0.2-2.fc15.i686
evolution-help-3.0.2-3.fc15.noarch
evolution-sharp-0.21.1-12.fc15.i686
evolution-NetworkManager-3.0.2-3.fc15.i686
evolution-exchange-3.0.2-1.fc15.i686
evolution-3.0.2-3.fc15.i686
evolution-data-server-3.0.2-1.fc15.i686

Comment 3 Matthew Barnes 2011-07-16 20:49:59 UTC
A backtrace from the mmap_zero call would be more useful...

Comment 4 Sai Kiran Kanuri 2011-07-19 07:01:53 UTC
How do i generate it?

Comment 5 Matthew Barnes 2011-07-19 14:12:11 UTC
From a command shell:

$ debuginfo-install evolution   (as super user)
$ gdb evolution

Then from within gdb:

(gdb) break mmap_zero
(gdb) run
... wait for evolution to halt on the mmap_zero call ...
(gdb) backtrace

Post the results of the "bt" command.

Comment 6 Matthew Barnes 2011-07-19 14:13:07 UTC
(In reply to comment #5)
> Post the results of the "bt" command.

Sorry... post the results of the "backtrace" command.

Comment 7 Sai Kiran Kanuri 2011-07-27 06:56:08 UTC
I have been running evolution under gdb for 2 days & haven't come across it.. but evolution-data-server has crashed a few time meanwhile. Would it be possible for the mmap_zero call to originate from evolution-data-server?

Comment 8 Sai Kiran Kanuri 2011-08-01 05:01:11 UTC
Here its is finally..

(gdb) backtrace 
#0  0x00506459 in emsmdb_transaction () from /usr/lib/libmapi-openchange.so.0
#1  0x004f9905 in OpenFolder () from /usr/lib/libmapi-openchange.so.0
#2  0x0034c638 in ?? () from /usr/lib/libexchangemapi-1.0.so.0
#3  0x00357a02 in exchange_mapi_connection_fetch_items () from /usr/lib/libexchangemapi-1.0.so.0
#4  0x010aec8c in camel_mapi_folder_fetch_summary () from /usr/lib/evolution-data-server/camel-providers/libcamelmapi.so
#5  0x010aef9f in mapi_refresh_folder () from /usr/lib/evolution-data-server/camel-providers/libcamelmapi.so
#6  0x010af3c7 in ?? () from /usr/lib/evolution-data-server/camel-providers/libcamelmapi.so
#7  0x4f55fae3 in camel_folder_refresh_info_sync (folder=0xb233ea38, cancellable=0x87901d0, error=0x0) at camel-folder.c:3373
#8  0x416104f0 in refresh_folders_exec (m=0x8aea590, cancellable=0x87901d0, error=0x8aea5a4) at mail-send-recv.c:938
#9  0x4160996a in mail_msg_proxy (msg=0x8aea590) at mail-mt.c:415
#10 0x4d86fb07 in g_thread_pool_thread_proxy (data=0x88eccb8) at gthreadpool.c:319
#11 0x4d86d535 in g_thread_create_proxy (data=0x8b19d00) at gthread.c:1955
#12 0x4d7589fe in start_thread (arg=0xb2cdeb70) at pthread_create.c:305
#13 0x4d69f24e in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:133
(gdb)

Comment 9 Matthew Barnes 2011-08-01 12:24:17 UTC
Thanks.  So this is an OpenChange or possibly Samba4 issue.

Comment 10 Simo Sorce 2011-08-01 12:51:20 UTC
I have no knowledge of samba needing mmap_zero, I can't think of a reason why we would need it.

Comment 11 Fedora End Of Life 2012-08-07 17:05:31 UTC
This message is a notice that Fedora 15 is now at end of life. Fedora
has stopped maintaining and issuing updates for Fedora 15. It is
Fedora's policy to close all bug reports from releases that are no
longer maintained. At this time, all open bugs with a Fedora 'version'
of '15' have been closed as WONTFIX.

(Please note: Our normal process is to give advanced warning of this
occurring, but we forgot to do that. A thousand apologies.)

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, feel free to reopen
this bug and simply change the 'version' to a later Fedora version.

Bug Reporter: Thank you for reporting this issue and we are sorry that
we were unable to fix it before Fedora 15 reached end of life. If you
would still like to see this bug fixed and are able to reproduce it
against a later version of Fedora, you are encouraged to click on
"Clone This Bug" (top right of this page) and open it against that
version of Fedora.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

The process we are following is described here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping