Fedora Account System
Red Hat Associate
Red Hat Customer
The following was filed automatically by setroubleshoot: Souhrn: SELinux is preventing pt_chown (unconfined_t) "mmap_zero" to <Unknown> (unconfined_t). Podrobný popis: [pt_chown has a permissive type (unconfined_t). This access was not denied.] SELinux denied access requested by pt_chown. The current boolean settings do not allow this access. If you have not setup pt_chown to require this access this may signal an intrusion attempt. If you do intend this access you need to change the booleans on this system to allow the access. Povolení přístupu: Confined processes can be configured to to run requiring different access, SELinux provides booleans to allow you to turn on/off access as needed. The boolean allow_unconfined_mmap_low is set incorrectly. Boolean Description: Allow unconfined domain to map low memory in the kernel Příkaz pro opravu: # setsebool -P allow_unconfined_mmap_low 1 Další informace: Kontext zdroje unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Kontext cíle unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Objekty cíle None [ memprotect ] Zdroj pt_chown Cesta zdroje /usr/libexec/pt_chown Port <Neznámé> Počítač (removed) RPM balíčky zdroje glibc-common-2.10.1-5 RPM balíčky cíle RPM politiky selinux-policy-3.6.12-80.fc11 Selinux povolen True Typ politiky targeted MLS povoleno True Vynucovací režim Enforcing Název zásuvného modulu catchall_boolean Název počítače (removed) Platforma Linux (removed) 2.6.30.5-43.fc11.x86_64 #1 SMP Thu Aug 27 21:39:52 EDT 2009 x86_64 x86_64 Počet upozornění 3 Poprvé viděno Út 8. září 2009, 22:39:08 CEST Naposledy viděno Út 8. září 2009, 22:39:08 CEST Místní ID f48f1fb8-2baa-4c8b-a0e8-805ab9848e4c Čísla řádků Původní zprávy auditu node=(removed) type=AVC msg=audit(1252442348.984:11): avc: denied { mmap_zero } for pid=2021 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect node=(removed) type=AVC msg=audit(1252442348.984:11): avc: denied { mmap_zero } for pid=2021 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect node=(removed) type=AVC msg=audit(1252442348.984:11): avc: denied { mmap_zero } for pid=2021 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect node=(removed) type=SYSCALL msg=audit(1252442348.984:11): arch=c000003e syscall=125 success=yes exit=0 a0=7fff939a7014 a1=0 a2=7fff91d87e80 a3=7fff5364a690 items=0 ppid=2020 pid=2021 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="pt_chown" exe="/usr/libexec/pt_chown" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) audit2allow suggests: #============= unconfined_t ============== allow unconfined_t self:memprotect mmap_zero;
To stop you needing pt_chown, you should change the line you your /etc/fstab to look like the following. devpts /dev/pts devpts gid=5,mode=620 0 0 Then execute mount -a Your virtual machines should come up without needing pt_chown any longer. If you are not launching virtual machines, what were you doing to cause this problem? pt_chown should not need this vailue.
on fc11 Souhrn: SELinux is preventing pt_chown (unconfined_t) "mmap_zero" to <Unknown> (unconfined_t). Podrobný popis: SELinux denied access requested by pt_chown. The current boolean settings do not allow this access. If you have not setup pt_chown to require this access this may signal an intrusion attempt. If you do intend this access you need to change the booleans on this system to allow the access. Povolení přístupu: Confined processes can be configured to to run requiring different access, SELinux provides booleans to allow you to turn on/off access as needed. The boolean allow_unconfined_mmap_low is set incorrectly. Boolean Description: Allow unconfined domain to map low memory in the kernel Příkaz pro opravu: # setsebool -P allow_unconfined_mmap_low 1 Další informace: Kontext zdroje unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Kontext cíle unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Objekty cíle None [ memprotect ] Zdroj pt_chown Cesta zdroje /usr/libexec/pt_chown Port <Neznámé> Počítač fedora.linux RPM balíčky zdroje glibc-common-2.10.1-5 RPM balíčky cíle RPM politiky selinux-policy-3.6.12-83.fc11 Selinux povolen True Typ politiky targeted MLS povoleno True Vynucovací režim Enforcing Název zásuvného modulu catchall_boolean Název počítače fedora.linux Platforma Linux fedora.linux 2.6.30.5-43.fc11.x86_64 #1 SMP Thu Aug 27 21:39:52 EDT 2009 x86_64 x86_64 Počet upozornění 3 Poprvé viděno Po 21. září 2009, 20:12:42 CEST Naposledy viděno Po 21. září 2009, 20:12:42 CEST Místní ID 2f47ab10-f793-498e-bb15-3ac67210bfc0 Čísla řádků Původní zprávy auditu node=fedora.linux type=AVC msg=audit(1253556762.671:162): avc: denied { mmap_zero } for pid=26396 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect node=fedora.linux type=AVC msg=audit(1253556762.671:162): avc: denied { mmap_zero } for pid=26396 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect node=fedora.linux type=AVC msg=audit(1253556762.671:162): avc: denied { mmap_zero } for pid=26396 comm="pt_chown" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect node=fedora.linux type=SYSCALL msg=audit(1253556762.671:162): arch=c000003e syscall=125 success=yes exit=0 a0=7fff3919a014 a1=0 a2=7fff382cfe80 a3=7fff28ee9020 items=0 ppid=26394 pid=26396 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=9 comm="pt_chown" exe="/usr/libexec/pt_chown" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
This has zero to do with gcc. If you have wrong /etc/fstab, then it is anaconda (or mock) fault that it created them wrongly (f11 anaconda and mock do that).
*** This bug has been marked as a duplicate of bug 517582 ***