Bug 187958 - SELinux blocks ping redirect to file
Summary: SELinux blocks ping redirect to file
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 5
Hardware: i386
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2006-04-04 21:28 UTC by Matthew Saltzman
Modified: 2007-11-30 22:11 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2006-05-05 15:04:55 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Matthew Saltzman 2006-04-04 21:28:28 UTC
Description of problem:
SELinux prevents "ping ... > foo".  The file foo is created, but no lines are
written.  An AVC is generated:

kernel: audit(1144078487.621:723): avc:  denied  { ioctl } for  pid=22278
comm="ping" name="foo" dev=dm-0 ino=65693
scontext=user_u:system_r:ping_t:s0-s0:c0.c255
tcontext=user_u:object_r:user_home_t:s0 tclass=file


Version-Release number of selected component (if applicable):
selinux-policy-targeted-2.2.25-3.fc5

How reproducible:
Always

Steps to Reproduce:
1. ping www.redhat.com > foo
2. Wait a few secs.
3.
  
Actual results:
Described above.

Expected results:
Results of ping written to file

Additional info:
ping output to console works fine.  Redirect is blocked for root as well as
normal users.  "ping | cat > foo" is a  workaround.

Comment 1 Daniel Walsh 2006-04-05 12:40:10 UTC
Unconfined should not be transitioning to ping_t so this has been removed from
selinux-policy-targeted-2.2.29-3.fc5

Comment 3 Daniel Walsh 2006-05-05 15:04:55 UTC
Closing as these have been marked as modified, for a while.  Feel free to reopen
if not fixed


Note You need to log in before you can comment on or make changes to this bug.