Bug 462243 - avc_denials
avc_denials
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
rawhide
All Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
:
Depends On:
Blocks: F10Blocker/F10FinalBlocker
  Show dependency treegraph
 
Reported: 2008-09-14 14:07 EDT by Dominick Grift
Modified: 2008-10-24 17:12 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-10-24 17:12:31 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Dominick Grift 2008-09-14 14:07:49 EDT
Description of problem:
some avc denials

Version-Release number of selected component (if applicable):
selinux-policy-3.3.1-87.fc9.noarch

#============= auditd_t ==============
fs_rw_anon_inodefs_files(auditd_t)

#============= nsplugin_t ==============
allow nsplugin_t user_mplayer_home_t:file read;
allow nsplugin_t zero_device_t:chr_file execute;

#============= staff_sudo_t ==============
allow staff_sudo_t crond_t:key search;

#============= staff_t ==============
allow staff_t user_tmp_t:sock_file execute;
allow staff_t xdm_xserver_tmp_t:dir write;
kernel_getattr_core_if(staff_t)
kernel_getattr_message_if(staff_t)
kernel_read_software_raid_state(staff_t)
Comment 1 Daniel Walsh 2008-09-15 13:08:38 EDT
#============= auditd_t ==============
fs_rw_anon_inodefs_files(auditd_t)

#============= nsplugin_t ==============
allow nsplugin_t user_mplayer_home_t:file read;
allow nsplugin_t zero_device_t:chr_file execute;

Will be added 

#============= staff_sudo_t ==============
allow staff_sudo_t crond_t:key search;
This is somekind of wacky bug?  Are you running sudo in a cron job?

#============= staff_t ==============
allow staff_t user_tmp_t:sock_file execute;
allow staff_t xdm_xserver_tmp_t:dir write;
kernel_getattr_core_if(staff_t)
kernel_getattr_message_if(staff_t)
kernel_read_software_raid_state(staff_t)

Please attach the log files used to generate these?  Were you running as root in permissive mode?
Comment 2 Dominick Grift 2008-09-15 13:32:13 EDT
time->Sun Sep 14 10:06:14 2008
type=SYSCALL msg=audit(1221379574.743:40): arch=c000003e syscall=250 success=no exit=-13 a0=0 a1=fffffffb a2=0 a3=7fff0f396eb0 items=0 ppid=7616 pid=7640 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=pts0 ses=1 comm="sudo" exe="/usr/bin/sudo" subj=domg472:staff_r:staff_sudo_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1221379574.743:40): avc:  denied  { search } for  pid=7640 comm="sudo" scontext=domg472:staff_r:staff_sudo_t:s0-s0:c0.c1023 tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=key

time->Sun Sep 14 17:09:19 2008
type=PATH msg=audit(1221404959.830:40): item=0 name="/proc/kmsg" inode=4026531848 dev=00:03 mode=0100400 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:proc_kmsg_t:s0
type=CWD msg=audit(1221404959.830:40):  cwd="/home/domg472"
type=SYSCALL msg=audit(1221404959.830:40): arch=c000003e syscall=6 success=no exit=-13 a0=27017b0 a1=41878dd0 a2=41878dd0 a3=3e8a367a70 items=1 ppid=3096 pid=9022 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="nautilus" exe="/usr/bin/nautilus" subj=domg472:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1221404959.830:40): avc:  denied  { getattr } for  pid=9022 comm="nautilus" path="/proc/kmsg" dev=proc ino=4026531848 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_kmsg_t:s0 tclass=file

time->Sun Sep 14 17:09:19 2008
type=PATH msg=audit(1221404959.831:42): item=0 name="/proc/mdstat" inode=4026531955 dev=00:03 mode=0100444 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:proc_mdstat_t:s0
type=CWD msg=audit(1221404959.831:42):  cwd="/home/domg472"
type=SYSCALL msg=audit(1221404959.831:42): arch=c000003e syscall=6 success=no exit=-13 a0=7f16740074e0 a1=4367bdd0 a2=4367bdd0 a3=7f1674000090 items=1 ppid=3096 pid=9039 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="nautilus" exe="/usr/bin/nautilus" subj=domg472:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1221404959.831:42): avc:  denied  { getattr } for  pid=9039 comm="nautilus" path="/proc/mdstat" dev=proc ino=4026531955 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_mdstat_t:s0 tclass=file

time->Sun Sep 14 17:09:24 2008
type=PATH msg=audit(1221404964.384:43): item=0 name="/tmp/gnome-system-monitor.domg472.1909916310" inode=18268
54 dev=fd:01 mode=0140775 ouid=500 ogid=500 rdev=00:00 obj=domg472:object_r:user_tmp_t:s0
type=CWD msg=audit(1221404964.384:43):  cwd="/home/domg472"
type=SYSCALL msg=audit(1221404964.384:43): arch=c000003e syscall=21 success=no exit=-13 a0=7f167400d800 a1=1 a
2=8 a3=7f1674017240 items=1 ppid=3096 pid=9039 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 s
gid=500 fsgid=500 tty=(none) ses=1 comm="nautilus" exe="/usr/bin/nautilus" subj=domg472:staff_r:staff_t:s0-s0:
c0.c1023 key=(null)
type=AVC msg=audit(1221404964.384:43): avc:  denied  { execute } for  pid=9039 comm="nautilus" name="gnome-system-monitor.domg472.1909916310" dev=dm-1 ino=1826854 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=domg472:object_r:user_tmp_t:s0 tclass=sock_file

time->Sun Sep 14 17:09:24 2008
type=PATH msg=audit(1221404964.440:44): item=0 name="/tmp/.X11-unix" inode=1843202 dev=fd:01 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:xdm_xserver_tmp_t:s0
type=CWD msg=audit(1221404964.440:44):  cwd="/home/domg472"
type=SYSCALL msg=audit(1221404964.440:44): arch=c000003e syscall=21 success=no exit=-13 a0=7f167401e590 a1=2 a2=8 a3=7f167401edf0 items=1 ppid=3096 pid=9039 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="nautilus" exe="/usr/bin/nautilus" subj=domg472:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1221404964.440:44): avc:  denied  { write } for  pid=9039 comm="nautilus" name=".X11-unix" dev=dm-1 ino=1843202 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xdm_xserver_tmp_t:s0 tclass=dir

time->Mon Sep 15 13:16:14 2008
type=PATH msg=audit(1221477374.993:86): item=0 name="/home/domg472/.bash_history" inode=7120275 dev=fd:01 mode=0100600 ouid=500 ogid=500 rdev=00:00 obj=domg472:object_r:user_home_t:s0
type=CWD msg=audit(1221477374.993:86):  cwd="/home/domg472"
type=SYSCALL msg=audit(1221477374.993:86): arch=c000003e syscall=2 success=no exit=-13 a0=256b8f0 a1=0 a2=1b6 a3=3e8a367a70 items=1 ppid=13979 pid=13980 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts3 ses=1 comm="sh" exe="/bin/bash" subj=domg472:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1221477374.993:86): avc:  denied  { dac_read_search } for  pid=13980 comm="sh" capability=2 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability
type=AVC msg=audit(1221477374.993:86): avc:  denied  { dac_override } for  pid=13980 comm="sh" capability=1 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability

About staff_sudo_t:
I do not run any cronjobs personally at all and i am the only staff usre on this system. verified empty crontab -e.

About Staff_t:
Yes i these may have been generated during permissive mode as yesterday i was troubleshooting some issues.
Comment 3 Daniel Walsh 2008-09-15 14:57:51 EDT
staff_t should never run as uid=0,  So the dac ones are caused by permissive mode.

allow staff_t user_tmp_t:sock_file execute;
allow staff_t xdm_xserver_tmp_t:dir write;
Did you notice anything going wrong?

kernel_getattr_core_if(staff_t)
kernel_getattr_message_if(staff_t)
kernel_read_software_raid_state(staff_t)

Did you use nautilus to look at /proc?
Comment 4 Dominick Grift 2008-09-15 15:11:11 EDT
Yes i noticed some things going wrong, however i suspect that was not related to SELinux. (quite sure)

I do not recall me using nautilus to view /proc. I may have used the system-monitor.

please ignore these last avc denials for now. I will try to reproduce them and repost it with a better explanation of what i was doing when i am able to

Thanks
Comment 5 Daniel Walsh 2008-09-16 09:48:27 EDT
Added 


kernel_getattr_core_if(staff_t)
kernel_getattr_message_if(staff_t)
kernel_read_software_raid_state(staff_t)

To selinux-policy-3.5.8-1
Comment 6 Tom "spot" Callaway 2008-10-24 17:12:31 EDT
Closing this one out as resolved. If it is not, please reopen.

Note You need to log in before you can comment on or make changes to this bug.