Bug 527936 (module_request) - SELinux module_request needs better handling of blacklisted modules
Summary: SELinux module_request needs better handling of blacklisted modules
Keywords:
Status: CLOSED NEXTRELEASE
Alias: module_request
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 12
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:962e0d11927...
: 527938 527939 529758 530668 531867 532254 532625 533609 536722 536747 537696 538402 538404 538815 538816 538817 539260 539461 539881 539882 540182 540859 542125 542127 542406 542912 543625 544394 545713 545717 545833 545938 546870 546886 547604 548343 548612 549970 550131 550372 550602 550605 551575 559063 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-10-08 10:01 UTC by Michal Hlavinka
Modified: 2010-08-05 23:57 UTC (History)
38 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2010-08-05 19:00:32 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Michal Hlavinka 2009-10-08 10:01:32 UTC
The following was filed automatically by setroubleshoot:

Summary:

SELinux is preventing /usr/sbin/sshd "module_request" access.

Detailed Description:

SELinux denied access requested by sshd. It is not expected that this access is
required by sshd and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                system_u:system_r:sshd_t:s0-s0:c0.c1023
Target Context                system_u:system_r:kernel_t:s0
Target Objects                None [ system ]
Source                        sshd
Source Path                   /usr/sbin/sshd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           openssh-server-5.2p1-28.fc12
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.32-21.fc12
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     (removed)
Platform                      Linux (removed) 2.6.31.1-58.fc12.x86_64 #1
                              SMP Fri Oct 2 16:17:33 EDT 2009 x86_64 x86_64
Alert Count                   49
First Seen                    Tue 06 Oct 2009 12:16:03 PM CEST
Last Seen                     Thu 08 Oct 2009 11:15:44 AM CEST
Local ID                      6c72bc5f-a8b1-4b7d-8815-32c6dd7ff715
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1254993344.997:107): avc:  denied  { module_request } for  pid=15831 comm="sshd" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:kernel_t:s0 tclass=system

node=(removed) type=SYSCALL msg=audit(1254993344.997:107): arch=c000003e syscall=41 success=no exit=-97 a0=a a1=1 a2=6 a3=7fff592851a0 items=0 ppid=15822 pid=15831 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=7 comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.6.32-21.fc12,catchall,sshd,sshd_t,kernel_t,system,module_request
audit2allow suggests:

#============= sshd_t ==============
allow sshd_t kernel_t:system module_request;

Comment 1 Daniel Walsh 2009-10-08 13:13:54 UTC
Fixed in selinux-policy-3.6.32-23.fc12.noarch

It would really be nice if the AVC included a message about what module was requested.

Eric?

Comment 2 Eric Paris 2009-10-08 13:30:01 UTC
This should not be needed....

Almost certainly this was IPv6, and it should have been loaded by something already and we should get into this situation.

I'll look to see if we can emit some message when we deny module_request.

Comment 3 Michal Hlavinka 2009-10-08 13:44:59 UTC
I have ipv6 disabled

Comment 4 Michal Hlavinka 2009-10-08 13:45:43 UTC
cat /etc/modprobe.d/ipv6_blacklist.conf contains:
blacklist ipv6
install ipv6 /bin/true

Comment 5 Eric Paris 2009-10-08 14:42:05 UTC
So that's almost certainly it.  Everything that tries to do anything with IPv6 is going to cause the kernel to try to auto load the ipv6 module.  Some things pass the security check (udev, ifconfig, etc), but then just call /bin/true, which leaves the module unloaded.  Later things (sshd, sendmail) will then cause the kernel to try to autoload the IPv6 module since it was not loaded, but will be denied by the security hook.  I'm trying to think of a way to solve this problem, but not much other than dontaudit rules is immediately springing to mind...

-eric

Comment 6 Daniel Walsh 2009-10-08 15:01:14 UTC
dontaudit domain kernel_t: module_request since any app that uses the network can cause this.

Comment 7 Eric Paris 2009-10-21 15:04:17 UTC
*** Bug 527939 has been marked as a duplicate of this bug. ***

Comment 8 Eric Paris 2009-10-21 15:04:28 UTC
*** Bug 529758 has been marked as a duplicate of this bug. ***

Comment 9 Eric Paris 2009-10-21 15:05:09 UTC
*** Bug 527938 has been marked as a duplicate of this bug. ***

Comment 10 Daniel Walsh 2009-10-24 12:17:51 UTC
*** Bug 530668 has been marked as a duplicate of this bug. ***

Comment 11 Daniel Walsh 2009-10-29 18:19:53 UTC
*** Bug 531867 has been marked as a duplicate of this bug. ***

Comment 12 Daniel Walsh 2009-11-02 14:34:27 UTC
*** Bug 532254 has been marked as a duplicate of this bug. ***

Comment 13 Daniel Walsh 2009-11-03 14:07:23 UTC
*** Bug 532625 has been marked as a duplicate of this bug. ***

Comment 14 Daniel Walsh 2009-11-09 13:41:37 UTC
*** Bug 533609 has been marked as a duplicate of this bug. ***

Comment 15 Daniel Walsh 2009-11-11 14:50:48 UTC
*** Bug 536722 has been marked as a duplicate of this bug. ***

Comment 16 Daniel Walsh 2009-11-11 14:55:49 UTC
*** Bug 536747 has been marked as a duplicate of this bug. ***

Comment 17 Bradley 2009-11-16 00:20:32 UTC
*** Bug 537696 has been marked as a duplicate of this bug. ***

Comment 18 Bug Zapper 2009-11-16 13:24:31 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 12 development cycle.
Changing version to '12'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 19 Daniel Walsh 2009-11-18 13:59:41 UTC
*** Bug 538402 has been marked as a duplicate of this bug. ***

Comment 20 Daniel Walsh 2009-11-18 14:00:03 UTC
*** Bug 538404 has been marked as a duplicate of this bug. ***

Comment 21 Daniel Walsh 2009-11-18 20:01:12 UTC
*** Bug 538494 has been marked as a duplicate of this bug. ***

Comment 22 Daniel Walsh 2009-11-19 15:22:09 UTC
*** Bug 538815 has been marked as a duplicate of this bug. ***

Comment 23 Daniel Walsh 2009-11-19 15:22:33 UTC
*** Bug 538816 has been marked as a duplicate of this bug. ***

Comment 24 Daniel Walsh 2009-11-19 15:22:49 UTC
*** Bug 538817 has been marked as a duplicate of this bug. ***

Comment 25 Daniel Walsh 2009-11-19 18:46:00 UTC
*** Bug 539260 has been marked as a duplicate of this bug. ***

Comment 26 Miroslav Grepl 2009-11-20 12:16:42 UTC
*** Bug 539461 has been marked as a duplicate of this bug. ***

Comment 27 Miroslav Grepl 2009-11-23 07:54:55 UTC
*** Bug 539882 has been marked as a duplicate of this bug. ***

Comment 28 Miroslav Grepl 2009-11-23 07:56:25 UTC
*** Bug 539881 has been marked as a duplicate of this bug. ***

Comment 29 Miroslav Grepl 2009-11-23 07:57:48 UTC
*** Bug 540182 has been marked as a duplicate of this bug. ***

Comment 30 fade 2009-11-23 19:18:17 UTC
I have the problem and I also have ipv6 disabled. The reason is that I have a crappy ISP box that make believe to my Fedora box it has an ipv6 DNS. So every network operation is delayed by a DNS timeout (web navigation, package upgrade, etc). So I have to tell Fedora to not use ipv6 at all.

Comment 31 Daniel Walsh 2009-11-23 19:32:22 UTC
We are working on a fix to the kernel to report the name of the modules the kernel is trying to load, once we have that we can check if ipv5 is disabled, and not show the avc if it hits.

Comment 32 Miroslav Grepl 2009-11-24 11:57:22 UTC
*** Bug 540859 has been marked as a duplicate of this bug. ***

Comment 33 Miroslav Grepl 2009-11-30 11:36:55 UTC
*** Bug 542125 has been marked as a duplicate of this bug. ***

Comment 34 Miroslav Grepl 2009-11-30 11:37:52 UTC
*** Bug 542127 has been marked as a duplicate of this bug. ***

Comment 35 Miroslav Grepl 2009-11-30 11:44:07 UTC
*** Bug 542406 has been marked as a duplicate of this bug. ***

Comment 36 Miroslav Grepl 2009-12-01 11:14:24 UTC
*** Bug 542912 has been marked as a duplicate of this bug. ***

Comment 37 Simon Lewis 2009-12-02 19:30:35 UTC
This bug has reoccurred in the new kernel version 2.6.31.6-145.fc12.x86_64 which is in upgrade repo...


Zusammenfassung:

SELinux is preventing /usr/sbin/sshd "module_request" access.

Detaillierte Beschreibung:

SELinux denied access requested by sshd. It is not expected that this access is
required by sshd and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Zugriff erlauben:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug
report.

Zusätzliche Informationen:

Quellkontext                  system_u:system_r:sshd_t:s0-s0:c0.c1023
Zielkontext                   system_u:system_r:kernel_t:s0
Zielobjekte                   None [ system ]
Quelle                        sshd
Quellen-Pfad                  /usr/sbin/sshd
Port                          <Unbekannt>
Host                          (removed)
Quellen-RPM-Pakete            openssh-server-5.2p1-31.fc12
Ziel-RPM-Pakete               
RPM-Richtlinie                selinux-policy-3.6.32-46.fc12
SELinux aktiviert             True
Richtlinienversion            targeted
Enforcing-Modus               Enforcing
Plugin-Name                   catchall
Hostname                      (removed)
Plattform                     Linux hp550-01.slnet 2.6.31.6-145.fc12.x86_64 #1
                              SMP Sat Nov 21 15:57:45 EST 2009 x86_64 x86_64
Anzahl der Alarme             2
Zuerst gesehen                Mi 02 Dez 2009 18:34:08 CET
Zuletzt gesehen               Mi 02 Dez 2009 18:34:08 CET
Lokale ID                     6b9fe65f-24ec-45c4-a914-96aaac0ee005
Zeilennummern                 

Raw-Audit-Meldungen           

node=hp550-01.slnet type=AVC msg=audit(1259775248.256:8): avc:  denied  { module_request } for  pid=1051 comm="sshd" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:kernel_t:s0 tclass=system

node=hp550-01.slnet type=SYSCALL msg=audit(1259775248.256:8): arch=c000003e syscall=41 success=no exit=-97 a0=a a1=1 a2=6 a3=fffffffffffffee8 items=0 ppid=1048 pid=1051 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)

Comment 38 Daniel Walsh 2009-12-04 13:19:39 UTC
*** Bug 544146 has been marked as a duplicate of this bug. ***

Comment 39 Daniel Walsh 2009-12-05 12:08:31 UTC
*** Bug 544394 has been marked as a duplicate of this bug. ***

Comment 40 Daniel Walsh 2009-12-09 14:39:46 UTC
*** Bug 545713 has been marked as a duplicate of this bug. ***

Comment 41 Daniel Walsh 2009-12-09 14:44:31 UTC
*** Bug 545717 has been marked as a duplicate of this bug. ***

Comment 42 Daniel Walsh 2009-12-09 15:23:58 UTC
*** Bug 545833 has been marked as a duplicate of this bug. ***

Comment 43 Daniel Walsh 2009-12-09 17:18:24 UTC
*** Bug 545938 has been marked as a duplicate of this bug. ***

Comment 44 Hin-Tak Leung 2009-12-10 00:30:38 UTC
I have been taking bleeding-edge pacakges from koji and this isn't getting fixed.

Comment 45 Daniel Walsh 2009-12-10 15:13:44 UTC
We are waiting for a kernel update to identify the module that is loading.  At the time this kernel update gets out, I will modify setroubleshoot to check if ipv6 is disabled and then ignore any AVC message that attempts to load the ipv6 kernel module.   This is the best we can do.

Comment 46 Daniel Walsh 2009-12-12 12:50:47 UTC
*** Bug 546870 has been marked as a duplicate of this bug. ***

Comment 47 Daniel Walsh 2009-12-14 11:18:54 UTC
*** Bug 546886 has been marked as a duplicate of this bug. ***

Comment 48 Daniel Walsh 2009-12-15 14:12:46 UTC
*** Bug 547604 has been marked as a duplicate of this bug. ***

Comment 49 Daniel Walsh 2009-12-17 13:18:11 UTC
*** Bug 548343 has been marked as a duplicate of this bug. ***

Comment 50 Daniel Walsh 2009-12-23 17:28:28 UTC
*** Bug 543625 has been marked as a duplicate of this bug. ***

Comment 51 Daniel Walsh 2009-12-23 18:02:12 UTC
*** Bug 549970 has been marked as a duplicate of this bug. ***

Comment 52 Daniel Walsh 2009-12-27 13:03:03 UTC
*** Bug 550131 has been marked as a duplicate of this bug. ***

Comment 53 Daniel Walsh 2009-12-30 13:41:41 UTC
*** Bug 550605 has been marked as a duplicate of this bug. ***

Comment 54 Daniel Walsh 2009-12-31 13:53:45 UTC
*** Bug 550602 has been marked as a duplicate of this bug. ***

Comment 55 Daniel Walsh 2009-12-31 13:54:11 UTC
*** Bug 551575 has been marked as a duplicate of this bug. ***

Comment 56 Dmitry Torokhov 2010-01-03 07:54:17 UTC
(In reply to comment #45)
> We are waiting for a kernel update to identify the module that is loading.  At
> the time this kernel update gets out, I will modify setroubleshoot to check if
> ipv6 is disabled and then ignore any AVC message that attempts to load the ipv6
> kernel module.   This is the best we can do.  

What about other modules, such as 'tun'? Is there a knob that would turn the warning off for all modules? In the long run pretty much any application can cause module load (mount loading an fs module, etc)...

Comment 57 Michal Hlavinka 2010-01-04 13:39:40 UTC
(In reply to comment #45)
> We are waiting for a kernel update to identify the module that is loading.  At
> the time this kernel update gets out, I will modify setroubleshoot to check if
> ipv6 is disabled and then ignore any AVC message that attempts to load the ipv6
> kernel module.   This is the best we can do.  

would it be possible to have some workaround in selinux policy? It's quite annoying when once a while sealert shows up with another module request. Especially when managing more computers.

Comment 58 Daniel Walsh 2010-01-04 16:16:56 UTC
Adding

## <desc>
## <p>
## Allow all domains to have the kernel load modules
## </p>
## </desc>
#
gen_tunable(domain_kernel_load_modules, false)

tunable_policy(`domain_kernel_load_modules',`
	kernel_request_load_module(domain)
')

This will be turned off by default, but if turned on, all confined domains will be allowed to request the kernel to load a module.
Fixed in selinux-policy-3.6.32-66.fc12.noarch

Comment 59 Daniel Walsh 2010-01-18 16:35:24 UTC
*** Bug 548612 has been marked as a duplicate of this bug. ***

Comment 60 Daniel Walsh 2010-02-09 20:17:19 UTC
*** Bug 559063 has been marked as a duplicate of this bug. ***

Comment 61 Eric Paris 2010-03-15 18:14:12 UTC
Dan I'm going to reassign this to setroubleshootd.  The 2.6.34 kernels in rawhide will report an additional   kmod=pf-net-10  if it is IPv6 being autoloaded.  setroubleshoot should look in the modprobe blacklist for ipv6 and just ignore the message if it was disabled.

Comment 62 Daniel Walsh 2010-03-15 18:25:17 UTC
Sure could you give me pseudo code of what I am looking for?  IE where would you put the modprobe blacklist?

Comment 63 Eric Paris 2010-03-15 18:31:45 UTC
egrep "blacklist[ \t].*ipv6" /etc/modprobe.d/ -R
RET = $?
if $RET == 0
   don't complain
if $RET == 1
   complain

Comment 64 Miroslav Grepl 2010-04-13 15:49:03 UTC
*** Bug 550372 has been marked as a duplicate of this bug. ***

Comment 65 Robert Story 2010-08-05 16:44:35 UTC
I have ipv6 disabled on f12/2.6.32.14-127/PPC, and am seeing this avc for multiple comms:

"canberra-gtk-pl" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:kernel_t:s0 tclass=system
"rndc" scontext=system_u:system_r:ndc_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system
"sendmail" scontext=system_u:system_r:sendmail_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system
"spamd" scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system
"spamd" scontext=unconfined_u:system_r:spamd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system
"sshd" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:kernel_t:s0 tclass=system

Not thrilled about setting domain_kernel_load_modules, but if it will keep my syslog from getting spammed with this message every few minutes...

Comment 66 Daniel Walsh 2010-08-05 19:00:32 UTC
This code is in F13 and we have a big switch

tunable_policy(`domain_kernel_load_modules',`
	kernel_request_load_module(domain)
')

setroubleshoot checks in F13 also.


Note You need to log in before you can comment on or make changes to this bug.