Description of problem: I got an AVC from ppp that seems like something that should be allowed. Version-Release number of selected component (if applicable): selinux-policy-targeted-2.6.4-26.fc7 ppp-2.4.4-2 How reproducible: I don't know how to reproduce the error that resulted in ppp trying to do something it isn't allowed to. Steps to Reproduce: 1. 2. 3. Actual results: [root@bruno bruno]# sealert -l 17f0cfc2-d238-42a1-a127-d2a3876106a4 Summary SELinux is preventing pppd (pppd_t) "append" to connect-errors (pppd_etc_t). Detailed Description SELinux denied access requested by pppd. It is not expected that this access is required by pppd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for connect-errors, restorecon -v connect-errors If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Additional Information Source Context system_u:system_r:pppd_t Target Context system_u:object_r:pppd_etc_t Target Objects connect-errors [ file ] Affected RPM Packages Policy RPM selinux-policy-2.6.4-26.fc7 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.catchall_file Host Name bruno.wolff.to Platform Linux bruno.wolff.to 2.6.21-1.3228.fc7 #1 SMP Tue Jun 12 15:37:31 EDT 2007 i686 athlon Alert Count 9 First Seen Fri Jun 15 00:19:11 2007 Last Seen Sat Jul 21 09:21:23 2007 Local ID 17f0cfc2-d238-42a1-a127-d2a3876106a4 Line Numbers Raw Audit Messages avc: denied { append } for comm="pppd" dev=md5 name="connect-errors" pid=1919 scontext=system_u:system_r:pppd_t:s0 tclass=file tcontext=system_u:object_r:pppd_etc_t:s0 Expected results: No AVC Additional info:
This looks like a problem in ppp. Why is ppp writing to a file connect-errors under /etc/? This should be under /var/run or /var/log?
You can fix this for now by executing chcon -t ppp_etc_rw_t /etc/ppp/connect-errors
This was also addressed in Bug 118837. I found an old patch that fixed this so I adjusted it for 2.4.4 and applied it. Not sure why it wasn't applied though. This should be fixed in ppp-2.4.4-5.fc9
OK. I should be able to test it in a couple of days. I'll reopen the bug if it is still a problem.
Sorry, I didn't get aropund to this as soon as I had hoped. I am still seeing occasional AVC's for pppd, though not everytime it starts. It looks like it may be a different bug than the previous one though. Here is a sample: [root@bruno log]# sealert -l 9b8bf34e-5dbf-44bd-9907-3c43d98d6168 Summary: SELinux is preventing pppd (pppd_t) "write" to <Unknown> (sysctl_net_t). Detailed Description: [SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.] SELinux denied access requested by pppd. It is not expected that this access is required by pppd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for <Unknown>, restorecon -v '<Unknown>' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:pppd_t Target Context system_u:object_r:sysctl_net_t Target Objects None [ file ] Source pppd Source Path <Unknown> Port <Unknown> Host bruno.wolff.to Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.3.1-42.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall_file Host Name bruno.wolff.to Platform Linux bruno.wolff.to 2.6.25-14.fc9.i686 #1 SMP Thu May 1 06:28:41 EDT 2008 i686 athlon Alert Count 39 First Seen Wed Feb 6 06:35:11 2008 Last Seen Mon May 12 11:02:49 2008 Local ID 9b8bf34e-5dbf-44bd-9907-3c43d98d6168 Line Numbers Raw Audit Messages host=bruno.wolff.to type=AVC msg=audit(1210608169.80:30): avc: denied { write } for pid=2019 comm="pppd" scontext=system_u:system_r:pppd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file
You can allow this for now by executing # audit2allow -M mypol -i /var/log/audit/audit.log # semodule -i mypol.pp Fixed in selinux-policy-3.3.1-52.fc9
I am still getting AVC's from ppp: sealert -l 9b8bf34e-5dbf-44bd-9907-3c43d98d6168 Summary: SELinux is preventing pppd (pppd_t) "write" to <Unknown> (sysctl_net_t). Detailed Description: [SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.] SELinux denied access requested by pppd. It is not expected that this access is required by pppd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for <Unknown>, restorecon -v '<Unknown>' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:pppd_t Target Context system_u:object_r:sysctl_net_t Target Objects None [ file ] Source pppd Source Path <Unknown> Port <Unknown> Host bruno.wolff.to Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.3.1-79.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall_file Host Name bruno.wolff.to Platform Linux bruno.wolff.to 2.6.25.14-108.fc9.i686 #1 SMP Mon Aug 4 14:08:11 EDT 2008 i686 athlon Alert Count 51 First Seen Wed Feb 6 06:35:11 2008 Last Seen Thu Aug 14 07:24:48 2008 Local ID 9b8bf34e-5dbf-44bd-9907-3c43d98d6168 Line Numbers Raw Audit Messages host=bruno.wolff.to type=AVC msg=audit(1218716688.658:19): avc: denied { write } for pid=1963 comm="pppd" scontext=system_u:system_r:pppd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file
You can allow this for now. # audit2allow -M mypol -l -i /var/log/audit/audit.log # semodule -i mypol.pp Fixed in selinux-policy-3.3.1-86.fc9.noarch
*** Bug 454358 has been marked as a duplicate of this bug. ***
This message is a reminder that Fedora 9 is nearing its end of life. Approximately 30 (thirty) days from now Fedora will stop maintaining and issuing updates for Fedora 9. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '9'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 9's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 9 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora please change the 'version' of this bug to the applicable version. If you are unable to change the version, please add a comment here and someone will do it for you. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping