Bug 485409 - SELinux restrains semodule (semanage_t) "write" for access at system_crond_t.
SELinux restrains semodule (semanage_t) "write" for access at system_crond_t.
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
9
i686 Linux
low Severity medium
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-02-13 08:12 EST by Matthias Behr
Modified: 2009-06-10 04:07 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-06-10 04:07:42 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Matthias Behr 2009-02-13 08:12:38 EST
Description of problem:


Version-Release number of selected component (if applicable):


How reproducible:

There were no reasons for reproducing the bug because its not made by an user action or after any user action. The computer runs without any actions and after few hours 'selinux' (not configured yet since installation - absolutely virgin) returns the following report:
  
Actual results:


Sum:

SELinux restrains semodule (semanage_t) "write" for access at system_crond_t.

detailed description:

"SELinux verweigerte den von semodule angeforderten Zugriff. Da nicht davon
ausgegangen wird, dass dieser Zugriff von semodule benötigt wird, signalisiert
dies möglicherweise einen Einbruchsversuch. Es ist ausserdem möglich, dass
diese spezielle Version oder Konfiguration der Anwendung den zusätzlichen
Zugriff verursacht."

I try it in english:

SELinux denies semodule write access for system_crond_t, because its not necessary for semodule to access system_crond_t. 

additional informations:

source context           system_u:system_r:semanage_t:s0
target context           system_u:system_r:system_crond_t:s0
target objects           pipe [ fifo_file ]
source                   semodule
source-path              /usr/sbin/semodule
port                     <Unbekannt>
host                     localhost.localdomain
source-RPM-packages      policycoreutils-2.0.52-8.fc9
target-RPM-packages           
RPM-policy               selinux-policy-3.3.1-119.fc9
SELinux active           True
policyversion            targeted
MLS active               True
enforcing-mode           Enforcing
plugin-name              catchall
hostname                 localhost.localdomain
platform                 Linux localhost.localdomain
                         2.6.27.12-78.2.8.fc9.i686 #1 SMP Mon Jan 19
                         20:14:35 EST 2009 i686 i686
encountered alarms       7
first sawn               Do 15 Jan 2009 09:38:21 CET
last sawn                Fr 13 Feb 2009 11:51:56 CET
local ID                 ee353dd1-16a4-4daf-8fe3-d012c15c79e8
line numbers                 

raw-audit-messages        

node=localhost.localdomain type=AVC msg=audit(1234522316.650:22): avc:  denied  { write } for  pid=7177 comm="semodule" path="pipe:[65073]" dev=pipefs ino=65073 scontext=system_u:system_r:semanage_t:s0 tcontext=system_u:system_r:system_crond_t:s0 tclass=fifo_file

node=localhost.localdomain type=AVC msg=audit(1234522316.650:22): avc:  denied  { write } for  pid=7177 comm="semodule" path="pipe:[65073]" dev=pipefs ino=65073 scontext=system_u:system_r:semanage_t:s0 tcontext=system_u:system_r:system_crond_t:s0 tclass=fifo_file

node=localhost.localdomain type=SYSCALL msg=audit(1234522316.650:22): arch=40000003 syscall=11 success=yes exit=0 a0=a0486b0 a1=a0503c8 a2=a04f158 a3=0 items=0 ppid=7176 pid=7177 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="semodule" exe="/usr/sbin/semodule" subj=system_u:system_r:semanage_t:s0 key=(null)

I hope this will result in an answer.

Thank you for your engagement.

Kind regards, matthias.
Comment 1 Daniel Walsh 2009-02-13 08:33:56 EST
This AVC can be ignored.  It is a simple redirection of stdout, which is being denied.

Miroslav, I think we should add.

cron_rw_system_job_pipes(domain)

To the system.

If I had to guess what is going on here, you have yum or rpm running as a cron job and some package runs semodule in a post install script.  The terminal gets assigned to a cron fifo_file and semodule is not allowed to write its stdout to it.

semodule would complete successfully.
Comment 2 Miroslav Grepl 2009-02-13 10:06:33 EST
Fixed in selinux-policy-3.3.1-123.fc9
Comment 3 Bug Zapper 2009-06-09 23:33:34 EDT
This message is a reminder that Fedora 9 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 9.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '9'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 9's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 9 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Note You need to log in before you can comment on or make changes to this bug.