Bug 200083 - readlink of executables causing ptrace SELinux access check to fire
readlink of executables causing ptrace SELinux access check to fire
Status: CLOSED NOTABUG
Product: Fedora
Classification: Fedora
Component: kernel (Show other bugs)
rawhide
All Linux
high Severity low
: ---
: ---
Assigned To: Eric Paris
Brian Brock
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2006-07-25 09:07 EDT by Daniel Walsh
Modified: 2007-11-30 17:11 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-07-26 14:11:23 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Daniel Walsh 2006-07-25 09:07:34 EDT
Description of problem:

The pidof command is doing a readlink of exe files which is causing AVC denials
of ptrace.

type=SYSCALL msg=audit(1153832702.855:6379): arch=40000003 syscall=85 success=no
exit=-13 a0=bfbecd48 a1=9f0aea0 a2=1000 a3=9f08d40 items=1 ppid=9118 pid=9122
auid=3267 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0
comm="pidof" exe="/sbin/killall5" subj=user_u:system_r:initrc_t:s0 key=(null)

You can also get this same behaviour with the readlink command on the 
readlink /proc/9122/exe

This is causing lots of AVC messages during boot and will happen when a normal
user becomes root using su, and does a pidof command.

pidof should not try to ptrace applications.
Comment 1 Stephen Smalley 2006-07-25 09:30:47 EDT
proc uses ptrace checking as a way of controlling access to process private state. 
There were some changes upstream in recent kernels in this area, e.g. see:
http://marc.theaimsgroup.com/?l=git-commits-head&m=115134545732646&w=2
SELinux is just applying ptrace checks consistently with the core kernel here.
Comment 2 Daniel Walsh 2006-07-25 10:12:49 EDT
So should these be dontaudited?   Allowed?
Comment 3 Stephen Smalley 2006-07-25 10:17:45 EDT
You'd have to allow it if you wanted the caller to be able to find the process
id of a given program via pidof.  Naturally, you'd only do that for privileged
domains.
Comment 4 Daniel Walsh 2006-07-26 14:11:23 EDT
Ok, so I guess this is not a bug.  Updated policy.

Note You need to log in before you can comment on or make changes to this bug.