Bug 187958 - SELinux blocks ping redirect to file
SELinux blocks ping redirect to file
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
5
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2006-04-04 17:28 EDT by Matthew Saltzman
Modified: 2007-11-30 17:11 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-05-05 11:04:55 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Matthew Saltzman 2006-04-04 17:28:28 EDT
Description of problem:
SELinux prevents "ping ... > foo".  The file foo is created, but no lines are
written.  An AVC is generated:

kernel: audit(1144078487.621:723): avc:  denied  { ioctl } for  pid=22278
comm="ping" name="foo" dev=dm-0 ino=65693
scontext=user_u:system_r:ping_t:s0-s0:c0.c255
tcontext=user_u:object_r:user_home_t:s0 tclass=file


Version-Release number of selected component (if applicable):
selinux-policy-targeted-2.2.25-3.fc5

How reproducible:
Always

Steps to Reproduce:
1. ping www.redhat.com > foo
2. Wait a few secs.
3.
  
Actual results:
Described above.

Expected results:
Results of ping written to file

Additional info:
ping output to console works fine.  Redirect is blocked for root as well as
normal users.  "ping | cat > foo" is a  workaround.
Comment 1 Daniel Walsh 2006-04-05 08:40:10 EDT
Unconfined should not be transitioning to ping_t so this has been removed from
selinux-policy-targeted-2.2.29-3.fc5
Comment 3 Daniel Walsh 2006-05-05 11:04:55 EDT
Closing as these have been marked as modified, for a while.  Feel free to reopen
if not fixed

Note You need to log in before you can comment on or make changes to this bug.