Bug 187814 - pam_console_app gets hundreds of {search} denied, unresponsive system
pam_console_app gets hundreds of {search} denied, unresponsive system
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
rawhide
x86_64 Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2006-04-03 14:54 EDT by Horst H. von Brand
Modified: 2007-11-30 17:11 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-05-05 11:07:00 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Horst H. von Brand 2006-04-03 14:54:52 EDT
Description of problem:
After running for a while, the machine became unresponsive (couldn't open
frefox, su did never (OK, within my (limited!) attention span) return, opening a
new tab in gnome-terminal did never open a new bash, couldn't move windows,
ctrl-alt-del did nothing, ...

/var/log/messages is full with:

Apr  3 14:04:57 quelen kernel: audit(1144087470.479:388): avc:  denied  { search
} for  pid=1367 comm="pam_console_app" name="var" dev=dm-0 ino=118785
scontext=system_u:system_r:pam_console_t:s0-s0:c0.c255
tcontext=user_u:object_r:file_t:s0 tclass=dir

Version-Release number of selected component (if applicable):
selinux-policy-targeted-2.2.29-1
kernel-2.6.16-1.2114_FC6

How reproducible:
Happened once, din't try again. It worked for a while. But the messages started
immediately upon boot.

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:
Comment 1 Daniel Walsh 2006-04-04 05:26:43 EDT
file_t means that some files do not have labels on them.  The usual cause of
this is running selinux=0 for a while or adding a new disk.  The easiest way to
fix the labeling problem is to

touch /.autorelabel
reboot

Comment 2 Ron Yorston 2006-04-04 14:44:49 EDT
I'm not sure that the messages about pam_console_apply and the system being
unresponsive are related.  Certainly I get the messages but my system response
is fine.

Horst, is your /var directory on a separate partition?  I suspect that
pam_console_apply is trying to access /var before it's been mounted so it's
seeing the incorrectly labelled /var mount point, not the correctly labelled
root of the var partition.

If that is the case this bug should be reassigned to whatever it is that's
causing pam_console_apply to try to use /var before it's been mounted.
Comment 3 Horst H. von Brand 2006-04-04 16:44:31 EDT
OK, just did as #1 says (I ran without SELinux for a while as it just failed to
boot, and I'm sure SELinux got updated and relabeled in between, but...

Re #2: Yes, /var is another partition (on LVM, actually). What could be the
culprit here?

OK, rebooted now. dmesg still shows many messages about /var (and assorted other
stuff).
Comment 4 Daniel Walsh 2006-04-05 08:33:43 EDT
Add the following line to the top of you /etc/rc.sysinit

restorecon /var

Should fix your problem.
Comment 6 Daniel Walsh 2006-05-05 11:07:00 EDT
Closing as these have been marked as modified, for a while.  Feel free to reopen
if not fixed

Note You need to log in before you can comment on or make changes to this bug.