Bug 200083 - readlink of executables causing ptrace SELinux access check to fire
Summary: readlink of executables causing ptrace SELinux access check to fire
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel   
(Show other bugs)
Version: rawhide
Hardware: All
OS: Linux
high
low
Target Milestone: ---
Assignee: Eric Paris
QA Contact: Brian Brock
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2006-07-25 13:07 UTC by Daniel Walsh
Modified: 2007-11-30 22:11 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-07-26 18:11:23 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description Daniel Walsh 2006-07-25 13:07:34 UTC
Description of problem:

The pidof command is doing a readlink of exe files which is causing AVC denials
of ptrace.

type=SYSCALL msg=audit(1153832702.855:6379): arch=40000003 syscall=85 success=no
exit=-13 a0=bfbecd48 a1=9f0aea0 a2=1000 a3=9f08d40 items=1 ppid=9118 pid=9122
auid=3267 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0
comm="pidof" exe="/sbin/killall5" subj=user_u:system_r:initrc_t:s0 key=(null)

You can also get this same behaviour with the readlink command on the 
readlink /proc/9122/exe

This is causing lots of AVC messages during boot and will happen when a normal
user becomes root using su, and does a pidof command.

pidof should not try to ptrace applications.

Comment 1 Stephen Smalley 2006-07-25 13:30:47 UTC
proc uses ptrace checking as a way of controlling access to process private state. 
There were some changes upstream in recent kernels in this area, e.g. see:
http://marc.theaimsgroup.com/?l=git-commits-head&m=115134545732646&w=2
SELinux is just applying ptrace checks consistently with the core kernel here.


Comment 2 Daniel Walsh 2006-07-25 14:12:49 UTC
So should these be dontaudited?   Allowed?

Comment 3 Stephen Smalley 2006-07-25 14:17:45 UTC
You'd have to allow it if you wanted the caller to be able to find the process
id of a given program via pidof.  Naturally, you'd only do that for privileged
domains.


Comment 4 Daniel Walsh 2006-07-26 18:11:23 UTC
Ok, so I guess this is not a bug.  Updated policy.


Note You need to log in before you can comment on or make changes to this bug.