Description of problem: some avc denials Version-Release number of selected component (if applicable): selinux-policy-3.3.1-87.fc9.noarch #============= auditd_t ============== fs_rw_anon_inodefs_files(auditd_t) #============= nsplugin_t ============== allow nsplugin_t user_mplayer_home_t:file read; allow nsplugin_t zero_device_t:chr_file execute; #============= staff_sudo_t ============== allow staff_sudo_t crond_t:key search; #============= staff_t ============== allow staff_t user_tmp_t:sock_file execute; allow staff_t xdm_xserver_tmp_t:dir write; kernel_getattr_core_if(staff_t) kernel_getattr_message_if(staff_t) kernel_read_software_raid_state(staff_t)
#============= auditd_t ============== fs_rw_anon_inodefs_files(auditd_t) #============= nsplugin_t ============== allow nsplugin_t user_mplayer_home_t:file read; allow nsplugin_t zero_device_t:chr_file execute; Will be added #============= staff_sudo_t ============== allow staff_sudo_t crond_t:key search; This is somekind of wacky bug? Are you running sudo in a cron job? #============= staff_t ============== allow staff_t user_tmp_t:sock_file execute; allow staff_t xdm_xserver_tmp_t:dir write; kernel_getattr_core_if(staff_t) kernel_getattr_message_if(staff_t) kernel_read_software_raid_state(staff_t) Please attach the log files used to generate these? Were you running as root in permissive mode?
time->Sun Sep 14 10:06:14 2008 type=SYSCALL msg=audit(1221379574.743:40): arch=c000003e syscall=250 success=no exit=-13 a0=0 a1=fffffffb a2=0 a3=7fff0f396eb0 items=0 ppid=7616 pid=7640 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=pts0 ses=1 comm="sudo" exe="/usr/bin/sudo" subj=domg472:staff_r:staff_sudo_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1221379574.743:40): avc: denied { search } for pid=7640 comm="sudo" scontext=domg472:staff_r:staff_sudo_t:s0-s0:c0.c1023 tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=key time->Sun Sep 14 17:09:19 2008 type=PATH msg=audit(1221404959.830:40): item=0 name="/proc/kmsg" inode=4026531848 dev=00:03 mode=0100400 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:proc_kmsg_t:s0 type=CWD msg=audit(1221404959.830:40): cwd="/home/domg472" type=SYSCALL msg=audit(1221404959.830:40): arch=c000003e syscall=6 success=no exit=-13 a0=27017b0 a1=41878dd0 a2=41878dd0 a3=3e8a367a70 items=1 ppid=3096 pid=9022 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="nautilus" exe="/usr/bin/nautilus" subj=domg472:staff_r:staff_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1221404959.830:40): avc: denied { getattr } for pid=9022 comm="nautilus" path="/proc/kmsg" dev=proc ino=4026531848 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_kmsg_t:s0 tclass=file time->Sun Sep 14 17:09:19 2008 type=PATH msg=audit(1221404959.831:42): item=0 name="/proc/mdstat" inode=4026531955 dev=00:03 mode=0100444 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:proc_mdstat_t:s0 type=CWD msg=audit(1221404959.831:42): cwd="/home/domg472" type=SYSCALL msg=audit(1221404959.831:42): arch=c000003e syscall=6 success=no exit=-13 a0=7f16740074e0 a1=4367bdd0 a2=4367bdd0 a3=7f1674000090 items=1 ppid=3096 pid=9039 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="nautilus" exe="/usr/bin/nautilus" subj=domg472:staff_r:staff_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1221404959.831:42): avc: denied { getattr } for pid=9039 comm="nautilus" path="/proc/mdstat" dev=proc ino=4026531955 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_mdstat_t:s0 tclass=file time->Sun Sep 14 17:09:24 2008 type=PATH msg=audit(1221404964.384:43): item=0 name="/tmp/gnome-system-monitor.domg472.1909916310" inode=18268 54 dev=fd:01 mode=0140775 ouid=500 ogid=500 rdev=00:00 obj=domg472:object_r:user_tmp_t:s0 type=CWD msg=audit(1221404964.384:43): cwd="/home/domg472" type=SYSCALL msg=audit(1221404964.384:43): arch=c000003e syscall=21 success=no exit=-13 a0=7f167400d800 a1=1 a 2=8 a3=7f1674017240 items=1 ppid=3096 pid=9039 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 s gid=500 fsgid=500 tty=(none) ses=1 comm="nautilus" exe="/usr/bin/nautilus" subj=domg472:staff_r:staff_t:s0-s0: c0.c1023 key=(null) type=AVC msg=audit(1221404964.384:43): avc: denied { execute } for pid=9039 comm="nautilus" name="gnome-system-monitor.domg472.1909916310" dev=dm-1 ino=1826854 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=domg472:object_r:user_tmp_t:s0 tclass=sock_file time->Sun Sep 14 17:09:24 2008 type=PATH msg=audit(1221404964.440:44): item=0 name="/tmp/.X11-unix" inode=1843202 dev=fd:01 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:xdm_xserver_tmp_t:s0 type=CWD msg=audit(1221404964.440:44): cwd="/home/domg472" type=SYSCALL msg=audit(1221404964.440:44): arch=c000003e syscall=21 success=no exit=-13 a0=7f167401e590 a1=2 a2=8 a3=7f167401edf0 items=1 ppid=3096 pid=9039 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="nautilus" exe="/usr/bin/nautilus" subj=domg472:staff_r:staff_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1221404964.440:44): avc: denied { write } for pid=9039 comm="nautilus" name=".X11-unix" dev=dm-1 ino=1843202 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xdm_xserver_tmp_t:s0 tclass=dir time->Mon Sep 15 13:16:14 2008 type=PATH msg=audit(1221477374.993:86): item=0 name="/home/domg472/.bash_history" inode=7120275 dev=fd:01 mode=0100600 ouid=500 ogid=500 rdev=00:00 obj=domg472:object_r:user_home_t:s0 type=CWD msg=audit(1221477374.993:86): cwd="/home/domg472" type=SYSCALL msg=audit(1221477374.993:86): arch=c000003e syscall=2 success=no exit=-13 a0=256b8f0 a1=0 a2=1b6 a3=3e8a367a70 items=1 ppid=13979 pid=13980 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts3 ses=1 comm="sh" exe="/bin/bash" subj=domg472:staff_r:staff_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1221477374.993:86): avc: denied { dac_read_search } for pid=13980 comm="sh" capability=2 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability type=AVC msg=audit(1221477374.993:86): avc: denied { dac_override } for pid=13980 comm="sh" capability=1 scontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tcontext=domg472:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability About staff_sudo_t: I do not run any cronjobs personally at all and i am the only staff usre on this system. verified empty crontab -e. About Staff_t: Yes i these may have been generated during permissive mode as yesterday i was troubleshooting some issues.
staff_t should never run as uid=0, So the dac ones are caused by permissive mode. allow staff_t user_tmp_t:sock_file execute; allow staff_t xdm_xserver_tmp_t:dir write; Did you notice anything going wrong? kernel_getattr_core_if(staff_t) kernel_getattr_message_if(staff_t) kernel_read_software_raid_state(staff_t) Did you use nautilus to look at /proc?
Yes i noticed some things going wrong, however i suspect that was not related to SELinux. (quite sure) I do not recall me using nautilus to view /proc. I may have used the system-monitor. please ignore these last avc denials for now. I will try to reproduce them and repost it with a better explanation of what i was doing when i am able to Thanks
Added kernel_getattr_core_if(staff_t) kernel_getattr_message_if(staff_t) kernel_read_software_raid_state(staff_t) To selinux-policy-3.5.8-1
Closing this one out as resolved. If it is not, please reopen.