| Summary: | SELinux denies consoletype access to UDP socket | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Timothy Miller <theosib> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED NOTABUG | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | low | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.2 | CC: | dwalsh, mmalik, notting |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | i386 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-10-09 21:38:21 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
This is caused by some app leaking open file descriptors to consoletype, it can be safely ignored. Absolutely. However, I was under the impression that developers like to fix these leaks, which is why I reported it. TImothy, yes, do you have any idea which app was leaking? Not really, sorry. This appears to have happened at boot time, and from the message, it looks to have been called by an init script. Does the init system use file system sockets? I also haven't seen this repeat. I'm thinking about filing a feature request with SELinux to have the reports include the parent PID and command name. That might be helpful sometimes. This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux. This request was erroneously removed from consideration in Red Hat Enterprise Linux 6.4, which is currently under development. This request will be evaluated for inclusion in Red Hat Enterprise Linux 6.4. I am closing this bug per the latest comment. Let's open the bug if we see it again. |
Description of problem: I found this in my audit.log: type=AVC msg=audit(1328730010.816:41): avc: denied { read write } for pid=2438 comm="consoletype" path="socket:[13102]" dev=sockfs ino=13102 scontext=system_u:system_r:consoletype_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=udp_socket I'm guessing there's a leaked file descriptor from something that called consoletype. Version-Release number of selected component (if applicable): This is owned by initscripts version 9.03.27-1 How reproducible: No idea. Found it in a log. Never saw it before. I also can't figure out who called consoletype to find out who might be leaking a file descriptor.