Bug 524369 - setroubleshoot: SELinux is preventing pt_chown (unconfined_t) "mmap_zero" to <Unknown> (unconfined_t).
Summary: setroubleshoot: SELinux is preventing pt_chown (unconfined_t) "mmap_zero...
Keywords:
Status: CLOSED DUPLICATE of bug 517582
Alias: None
Product: Fedora
Classification: Fedora
Component: glibc
Version: rawhide
Hardware: x86_64
OS: Linux
low
medium
Target Milestone: ---
Assignee: Andreas Schwab
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:759ce6aadd6...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-09-19 14:16 UTC by Martin Naď
Modified: 2009-09-21 09:13 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-09-21 09:13:55 UTC


Attachments (Terms of Use)

Description Martin Naď 2009-09-19 14:16:03 UTC
The following was filed automatically by setroubleshoot:

Souhrn:

SELinux is preventing pt_chown (unconfined_t) "mmap_zero" to <Unknown>
(unconfined_t).

Podrobný popis:

[pt_chown has a permissive type (unconfined_t). This access was not denied.]

SELinux denied access requested by pt_chown. The current boolean settings do not
allow this access. If you have not setup pt_chown to require this access this
may signal an intrusion attempt. If you do intend this access you need to change
the booleans on this system to allow the access.

Povolení přístupu:

Confined processes can be configured to to run requiring different access,
SELinux provides booleans to allow you to turn on/off access as needed. The
boolean allow_unconfined_mmap_low is set incorrectly.
Boolean Description:
Allow unconfined domain to map low memory in the kernel


Příkaz pro opravu:

# setsebool -P allow_unconfined_mmap_low 1

Další informace:

Kontext zdroje                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Kontext cíle                 unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Objekty cíle                 None [ memprotect ]
Zdroj                         pt_chown
Cesta zdroje                  /usr/libexec/pt_chown
Port                          <Neznámé>
Počítač                    (removed)
RPM balíčky zdroje          glibc-common-2.10.1-5
RPM balíčky cíle           
RPM politiky                  selinux-policy-3.6.12-80.fc11
Selinux povolen               True
Typ politiky                  targeted
MLS povoleno                  True
Vynucovací režim            Enforcing
Název zásuvného modulu     catchall_boolean
Název počítače            (removed)
Platforma                     Linux (removed)
                              2.6.30.5-43.fc11.x86_64 #1 SMP Thu Aug 27 21:39:52
                              EDT 2009 x86_64 x86_64
Počet upozornění           3
Poprvé viděno               Út 8. září 2009, 22:39:08 CEST
Naposledy viděno             Út 8. září 2009, 22:39:08 CEST
Místní ID                   f48f1fb8-2baa-4c8b-a0e8-805ab9848e4c
Čísla řádků              

Původní zprávy auditu      

node=(removed) type=AVC msg=audit(1252442348.984:11): avc:  denied  { mmap_zero } for  pid=2021 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect

node=(removed) type=AVC msg=audit(1252442348.984:11): avc:  denied  { mmap_zero } for  pid=2021 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect

node=(removed) type=AVC msg=audit(1252442348.984:11): avc:  denied  { mmap_zero } for  pid=2021 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect

node=(removed) type=SYSCALL msg=audit(1252442348.984:11): arch=c000003e syscall=125 success=yes exit=0 a0=7fff939a7014 a1=0 a2=7fff91d87e80 a3=7fff5364a690 items=0 ppid=2020 pid=2021 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="pt_chown" exe="/usr/libexec/pt_chown" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)


audit2allow suggests:

#============= unconfined_t ==============
allow unconfined_t self:memprotect mmap_zero;

Comment 1 Daniel Walsh 2009-09-20 11:24:17 UTC
To stop you needing pt_chown, you should change the line you your /etc/fstab to look like the following.

devpts                  /dev/pts                devpts  gid=5,mode=620  0 0


Then execute mount -a


Your virtual machines should come up without needing pt_chown any longer.

If you are not launching virtual machines, what were you doing to cause this problem?

pt_chown should not need this vailue.

Comment 2 Martin Naď 2009-09-20 20:33:42 UTC
on fc11

Souhrn:

SELinux is preventing pt_chown (unconfined_t) "mmap_zero" to <Unknown>
(unconfined_t).

Podrobný popis:

SELinux denied access requested by pt_chown. The current boolean settings do not
allow this access. If you have not setup pt_chown to require this access this
may signal an intrusion attempt. If you do intend this access you need to change
the booleans on this system to allow the access.

Povolení přístupu:

Confined processes can be configured to to run requiring different access,
SELinux provides booleans to allow you to turn on/off access as needed. The
boolean allow_unconfined_mmap_low is set incorrectly.
Boolean Description:
Allow unconfined domain to map low memory in the kernel


Příkaz pro opravu:

# setsebool -P allow_unconfined_mmap_low 1

Další informace:

Kontext zdroje                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Kontext cíle                 unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Objekty cíle                 None [ memprotect ]
Zdroj                         pt_chown
Cesta zdroje                  /usr/libexec/pt_chown
Port                          <Neznámé>
Počítač                    fedora.linux
RPM balíčky zdroje          glibc-common-2.10.1-5
RPM balíčky cíle           
RPM politiky                  selinux-policy-3.6.12-83.fc11
Selinux povolen               True
Typ politiky                  targeted
MLS povoleno                  True
Vynucovací režim            Enforcing
Název zásuvného modulu     catchall_boolean
Název počítače            fedora.linux
Platforma                     Linux fedora.linux 2.6.30.5-43.fc11.x86_64 #1 SMP
                              Thu Aug 27 21:39:52 EDT 2009 x86_64 x86_64
Počet upozornění           3
Poprvé viděno               Po 21. září 2009, 20:12:42 CEST
Naposledy viděno             Po 21. září 2009, 20:12:42 CEST
Místní ID                   2f47ab10-f793-498e-bb15-3ac67210bfc0
Čísla řádků              

Původní zprávy auditu      

node=fedora.linux type=AVC msg=audit(1253556762.671:162): avc:  denied  { mmap_zero } for  pid=26396 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect

node=fedora.linux type=AVC msg=audit(1253556762.671:162): avc:  denied  { mmap_zero } for  pid=26396 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect

node=fedora.linux type=AVC msg=audit(1253556762.671:162): avc:  denied  { mmap_zero } for  pid=26396 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect

node=fedora.linux type=SYSCALL msg=audit(1253556762.671:162): arch=c000003e syscall=125 success=yes exit=0 a0=7fff3919a014 a1=0 a2=7fff382cfe80 a3=7fff28ee9020 items=0 ppid=26394 pid=26396 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=9 comm="pt_chown" exe="/usr/libexec/pt_chown" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)

Comment 3 Jakub Jelinek 2009-09-21 07:23:16 UTC
This has zero to do with gcc.
If you have wrong /etc/fstab, then it is anaconda (or mock) fault that it created them wrongly (f11 anaconda and mock do that).

Comment 4 Andreas Schwab 2009-09-21 09:13:55 UTC

*** This bug has been marked as a duplicate of bug 517582 ***


Note You need to log in before you can comment on or make changes to this bug.