Bug 200083 - readlink of executables causing ptrace SELinux access check to fire
Summary: readlink of executables causing ptrace SELinux access check to fire
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: rawhide
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Eric Paris
QA Contact: Brian Brock
Depends On:
TreeView+ depends on / blocked
Reported: 2006-07-25 13:07 UTC by Daniel Walsh
Modified: 2007-11-30 22:11 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2006-07-26 18:11:23 UTC

Attachments (Terms of Use)

Description Daniel Walsh 2006-07-25 13:07:34 UTC
Description of problem:

The pidof command is doing a readlink of exe files which is causing AVC denials
of ptrace.

type=SYSCALL msg=audit(1153832702.855:6379): arch=40000003 syscall=85 success=no
exit=-13 a0=bfbecd48 a1=9f0aea0 a2=1000 a3=9f08d40 items=1 ppid=9118 pid=9122
auid=3267 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0
comm="pidof" exe="/sbin/killall5" subj=user_u:system_r:initrc_t:s0 key=(null)

You can also get this same behaviour with the readlink command on the 
readlink /proc/9122/exe

This is causing lots of AVC messages during boot and will happen when a normal
user becomes root using su, and does a pidof command.

pidof should not try to ptrace applications.

Comment 1 Stephen Smalley 2006-07-25 13:30:47 UTC
proc uses ptrace checking as a way of controlling access to process private state. 
There were some changes upstream in recent kernels in this area, e.g. see:
SELinux is just applying ptrace checks consistently with the core kernel here.

Comment 2 Daniel Walsh 2006-07-25 14:12:49 UTC
So should these be dontaudited?   Allowed?

Comment 3 Stephen Smalley 2006-07-25 14:17:45 UTC
You'd have to allow it if you wanted the caller to be able to find the process
id of a given program via pidof.  Naturally, you'd only do that for privileged

Comment 4 Daniel Walsh 2006-07-26 18:11:23 UTC
Ok, so I guess this is not a bug.  Updated policy.

Note You need to log in before you can comment on or make changes to this bug.