Bug 503756 - Denials of setenforce are not being reported in the audit.log
Denials of setenforce are not being reported in the audit.log
Product: Fedora
Classification: Fedora
Component: kernel (Show other bugs)
All Linux
low Severity medium
: ---
: ---
Assigned To: Eric Paris
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2009-06-02 10:51 EDT by Daniel Walsh
Modified: 2009-06-02 16:56 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-06-02 11:54:51 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Daniel Walsh 2009-06-02 10:51:05 EDT
Description of problem:

If I execute 

sandbox setenforce 0

I would expect a big denial in the audit.log

# sandbox setenforce 0
/usr/sbin/setenforce:  setenforce() failed
sh-4.0# ausearch -m avc -ts recent
<no matches>

Sadly no AVC is reported.

If I put the machine in permissive mode I do see the AVC.

#============= sandbox_t ==============
allow sandbox_t security_t:file write;
allow sandbox_t security_t:security setenforce;
Comment 1 Eric Paris 2009-06-02 11:02:28 EDT
Do you have dontaudit on open of security_t:file?  I don't see the open...
Comment 2 Stephen Smalley 2009-06-02 11:09:38 EDT
Ditto for security_t:dir search.
You aren't ever reaching the setenforce check in enforcing mode.
Comment 3 Daniel Walsh 2009-06-02 11:54:51 EDT
I am an idiot, never mind.

I will allow domains to getattr on /selinux and search the selinux_t so that we can get them attempting to write the security_t file.
Comment 4 Daniel Walsh 2009-06-02 16:56:54 EDT
BTW There is n o open of security_t.

Note You need to log in before you can comment on or make changes to this bug.