Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
For bugs related to Red Hat Enterprise Linux 5 product line. The current stable release is 5.10. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 519790

Summary: crash interpreting IPC mode fields via libauparse
Product: Red Hat Enterprise Linux 5 Reporter: Joshua Roys <roysjosh>
Component: auditAssignee: Steve Grubb <sgrubb>
Status: CLOSED ERRATA QA Contact: BaseOS QE <qe-baseos-auto>
Severity: medium Docs Contact:
Priority: medium    
Version: 5.3   
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-03-30 08:20:05 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
simple program using libauparse none

Description Joshua Roys 2009-08-27 19:29:28 UTC 
Created attachment 358951 [details]
simple program using libauparse

Description of problem:
crash interpreting IPC mode fields via libauparse


Version-Release number of selected component (if applicable):
the version in rhel5.3, 1.7.7-6.
the attached program works fine on f11.
it seems this was fixed in upstream svn revision 269?  https://fedorahosted.org/audit/changeset/269


How reproducible:
Steps to Reproduce:
1. create simple app using libauparse and printing out interpreted info
2. feed it the below, an IPC type w/mode field
3. boom
  
Actual results:
Using aup.c, attached

raw audit log:
type=AVC msg=audit(1251205644.484:424): avc:  denied  { associate } for  pid=6778 comm="oracle" key=-1031617816 scontext=system_u:system_r:oracle_db_t:s0 tcontext=staff_u:sysadm_r:
sysadm_t:s0 tclass=shm
type=SYSCALL msg=audit(1251205644.484:424): arch=c000003e syscall=29 per=400000 success=yes exit=32768 a0=c282c2e8 a1=1000 a2=0 a3=0 items=0 ppid=6777 pid=6778 auid=602 uid=601 gid
=604 euid=601 suid=601 fsuid=601 egid=604 sgid=604 fsgid=604 tty=(none) ses=1 comm="oracle" exe="/opt/oracle/product/10.2.0/bin/oracle" subj=system_u:system_r:oracle_db_t:s0 key=(n
ull)
type=IPC msg=audit(1251205644.484:424): ouid=601 ogid=604 mode=1a0 obj=staff_u:sysadm_r:sysadm_t:s0


serial=424
seconds=1251205644
type=AVC
seresult=denied
seperms=associate
pid=6778
comm=oracle
key=scontext=system_u:system_r:oracle_db_t:s0 tcontext=staff_u:sysadm_r:sysadm_t:s0 tclass=shm

type=SYSCALL
arch=x86_64
syscall=shmget
per=400000
success=yes
exit=32768
a0=c282c2e8
a1=1000
a2=0
a3=0
items=0
ppid=6777
pid=6778
auid=jkayse
uid=oracle
gid=dba
euid=oracle
suid=oracle
fsuid=oracle
egid=dba
sgid=dba
fsgid=dba
tty=(none)
ses=1
comm=oracle
exe=/opt/oracle/product/10.2.0/bin/oracle
subj=system_u:system_r:oracle_db_t:s0
key=(null)

type=IPC
ouid=oracle
ogid=dba
Segmentation fault


Expected results:
no segv


Additional info:
can a fix be put into place for 5.3 and upcoming 5.4, please?  thanks.
Comment 1 Steve Grubb 2009-08-27 21:10:31 UTC 
The RHEL5.4 packages are set to be released in the near future. I think its 1.7.13-2. There is no way to fix it short of a customer support request until 5.5 is out.
Comment 6 Steve Grubb 2009-12-08 21:11:21 UTC 
audit-1.7.17-1 was built to resolve this issue.
Comment 10 errata-xmlrpc 2010-03-30 08:20:05 UTC 
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2010-0228.html