Bug 256601 - audit2allow generates incorrect syntax when comma "," in denied list
audit2allow generates incorrect syntax when comma "," in denied list
Status: CLOSED NEXTRELEASE
Product: Fedora
Classification: Fedora
Component: setroubleshoot (Show other bugs)
7
All All
medium Severity low
: ---
: ---
Assigned To: John Dennis
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2007-08-27 10:29 EDT by Josh Cogliati
Modified: 2007-11-30 17:12 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-09-15 15:20:57 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Patch to fix output (614 bytes, text/x-patch)
2007-09-04 15:03 EDT, Daniel Walsh
no flags Details

  None (edit)
Description Josh Cogliati 2007-08-27 10:29:25 EDT
Description of problem:
I had a avc deny:
avc: denied { read, write } for comm="dbus-daemon" dev=dm-0 egid=0 euid=0
exe="/bin/dbus-daemon" exit=4 fsgid=0 fsuid=0 gid=0 items=0 name="vas_misc.vdb"
pid=4491 scontext=user_u:system_r:system_dbusd_t:s0 sgid=0
subj=user_u:system_r:system_dbusd_t:s0 suid=0 tclass=file
tcontext=user_u:object_r:var_t:s0 tty=pts3 uid=0 

which I ran audit2allow on and got:
#============= system_dbusd_t ==============
allow system_dbusd_t var_t:file { write read, };

which has an extra , after the read so there is a syntax error when you then use
checkmodule.  


Version-Release number of selected component (if applicable):
policycoreutils-2.0.16-11.fc7


How reproducible:
Run audit2allow on something with a comma separated list, and it happens.

Steps to reproduce:
audit2allow 
avc: denied { read, write } for comm="dbus-daemon" dev=dm-0 egid=0 euid=0
exe="/bin/dbus-daemon" exit=4 fsgid=0 fsuid=0 gid=0 items=0 name="vas_misc.vdb"
pid=4491 scontext=user_u:system_r:system_dbusd_t:s0 sgid=0
subj=user_u:system_r:system_dbusd_t:s0 suid=0 tclass=file
tcontext=user_u:object_r:var_t:s0 tty=pts3 uid=0 


  
Actual results:
#============= system_dbusd_t ==============
allow system_dbusd_t var_t:file { write read, };


Expected results:
#============= system_dbusd_t ==============
allow system_dbusd_t var_t:file { write read };
Comment 1 Daniel Walsh 2007-09-04 14:44:54 EDT
I see this as more of a kernel error.  The AVC is the wrong format.  While, we
can fix the audit2allow message, the kernel also needs to be fixed.
Comment 2 Eric Paris 2007-09-04 14:55:28 EDT
where did the malformed avc denial come from?  dmesg?  audit.log? 
setroubleshoot gui?  While I agree with dan the problem isn't with audit2allow
it is with the message itself, I can't find who would be generating a message
with a comma in it.
Comment 3 Daniel Walsh 2007-09-04 15:01:26 EDT
This output comes from setroubleshoot.  
Comment 4 Daniel Walsh 2007-09-04 15:03:26 EDT
Created attachment 186431 [details]
Patch to fix output
Comment 5 John Dennis 2007-09-15 15:20:57 EDT
Fixed, thanks for the report, thanks for the patch.

BTW, I've rewritten the interface to the audit system and we're now capturing
the exact audit lines and keeping audit records in event seperate to avoid any
information loss in the audit data. This has not yet been fully plumbed to
extend the data to the AVC class though, but when it is the audit data in the
alert will be one for one exact and not a modified processed version.

Note You need to log in before you can comment on or make changes to this bug.