RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 585963 - SELinux is preventing /usr/libexec/ipsec/addconn "write" access on /dev/pts/0.
Summary: SELinux is preventing /usr/libexec/ipsec/addconn "write" access on /dev/...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.0
Hardware: x86_64
OS: Linux
high
medium
Target Milestone: rc
: ---
Assignee: Daniel Walsh
QA Contact: Milos Malik
URL:
Whiteboard: setroubleshoot_trace_hash:e48142e3145...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-04-26 14:30 UTC by Mark Wielaard
Modified: 2012-10-15 15:08 UTC (History)
3 users (show)

Fixed In Version: selinux-policy-3.7.19-6.fc13.noarch
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-11-11 14:56:28 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Mark Wielaard 2010-04-26 14:30:12 UTC 
Summary:

SELinux is preventing /usr/libexec/ipsec/addconn "write" access on /dev/pts/0.

Detailed Description:

SELinux denied access requested by addconn. It is not expected that this access
is required by addconn and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                system_u:system_r:ipsec_mgmt_t:s0
Target Context                system_u:object_r:devpts_t:s0
Target Objects                /dev/pts/0 [ chr_file ]
Source                        addconn
Source Path                   /usr/libexec/ipsec/addconn
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           openswan-2.6.24-3.el6
Target RPM Packages           
Policy RPM                    selinux-policy-3.7.19-3.el6
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     (removed)
Platform                      Linux (removed) 2.6.32-22.el6.x86_64
                              #1 SMP Tue Apr 20 12:10:42 EDT 2010 x86_64 x86_64
Alert Count                   1
First Seen                    Mon 26 Apr 2010 04:25:43 PM CEST
Last Seen                     Mon 26 Apr 2010 04:25:43 PM CEST
Local ID                      a16c31e4-5a38-42f3-af85-c534c2bbb04d
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1272291943.659:9): avc:  denied  { write } for  pid=2362 comm="addconn" path="/dev/pts/0" dev=devpts ino=3 scontext=system_u:system_r:ipsec_mgmt_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=chr_file

node=(removed) type=SYSCALL msg=audit(1272291943.659:9): arch=c000003e syscall=1 success=no exit=-13 a0=2 a1=7ffffab52bb0 a2=4e a3=ffffffff items=0 ppid=2359 pid=2362 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="addconn" exe="/usr/libexec/ipsec/addconn" subj=system_u:system_r:ipsec_mgmt_t:s0 key=(null)



Hash String generated from  catchall,addconn,ipsec_mgmt_t,devpts_t,chr_file,write
audit2allow suggests:

#============= ipsec_mgmt_t ==============
allow ipsec_mgmt_t devpts_t:chr_file write;
Comment 1 Avesh Agarwal 2010-04-26 15:21:27 UTC 
Some other avcs:


Summary:

SELinux is preventing /bin/rm "write" access on etc.

Detailed Description:

[SELinux is in permissive mode. This access was not denied.]

SELinux denied access requested by rm. It is not expected that this
access is
required by rm and this access may signal an intrusion attempt. It is
also
possible that the specific version or configuration of the application
is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a
bug
report.

Additional Information:

Source Context                unconfined_u:system_r:ipsec_mgmt_t:s0
Target Context                system_u:object_r:etc_t:s0
Target Objects                etc [ dir ]
Source                        rm
Source Path                   /bin/rm
Port                          <Unknown>
Host                          springer.wildebeest.org
Source RPM Packages           coreutils-8.4-6.el6
Target RPM Packages           filesystem-2.4.30-2.1.el6
Policy RPM                    selinux-policy-3.7.19-3.el6
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Plugin Name                   catchall
Host Name                     springer.wildebeest.org
Platform                      Linux springer.wildebeest.org
2.6.32-22.el6.x86_64
                              #1 SMP Tue Apr 20 12:10:42 EDT 2010 x86_64
x86_64
Alert Count                   3
First Seen                    Mon 26 Apr 2010 05:05:27 PM CEST
Last Seen                     Mon 26 Apr 2010 05:05:27 PM CEST
Local ID                      81579864-2036-4711-941b-31e848863e6a
Line Numbers                  

Raw Audit Messages            

node=springer.wildebeest.org type=AVC msg=audit(1272294327.307:105):
avc:  denied  { write } for  pid=8607 comm="rm" name="etc" dev=dm-0
ino=524293 scontext=unconfined_u:system_r:ipsec_mgmt_t:s0
tcontext=system_u:object_r:etc_t:s0 tclass=dir

node=springer.wildebeest.org type=AVC msg=audit(1272294327.307:105):
avc:  denied  { remove_name } for  pid=8607 comm="rm" name="resolv.conf"
dev=dm-0 ino=524306 scontext=unconfined_u:system_r:ipsec_mgmt_t:s0
tcontext=system_u:object_r:etc_t:s0 tclass=dir

node=springer.wildebeest.org type=AVC msg=audit(1272294327.307:105):
avc:  denied  { unlink } for  pid=8607 comm="rm" name="resolv.conf"
dev=dm-0 ino=524306 scontext=unconfined_u:system_r:ipsec_mgmt_t:s0
tcontext=system_u:object_r:net_conf_t:s0 tclass=file

node=springer.wildebeest.org type=SYSCALL msg=audit(1272294327.307:105):
arch=c000003e syscall=263 success=yes exit=0 a0=ffffffffffffff9c
a1=19340f0 a2=0 a3=7fff69d43790 items=0 ppid=8604 pid=8607 auid=500
uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1
comm="rm" exe="/bin/rm" subj=unconfined_u:system_r:ipsec_mgmt_t:s0
key=(null)


Summary:

SELinux is preventing /bin/bash "add_name" access on resolv.conf.

Detailed Description:

[SELinux is in permissive mode. This access was not denied.]

SELinux denied access requested by _updown.netkey. It is not expected
that this
access is required by _updown.netkey and this access may signal an
intrusion
attempt. It is also possible that the specific version or configuration
of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a
bug
report.

Additional Information:

Source Context                unconfined_u:system_r:ipsec_mgmt_t:s0
Target Context                system_u:object_r:etc_t:s0
Target Objects                resolv.conf [ dir ]
Source                        _updown.netkey
Source Path                   /bin/bash
Port                          <Unknown>
Host                          springer.wildebeest.org
Source RPM Packages           bash-4.1.2-2.el6
Target RPM Packages           
Policy RPM                    selinux-policy-3.7.19-3.el6
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Plugin Name                   catchall
Host Name                     springer.wildebeest.org
Platform                      Linux springer.wildebeest.org
2.6.32-22.el6.x86_64
                              #1 SMP Tue Apr 20 12:10:42 EDT 2010 x86_64
x86_64
Alert Count                   3
First Seen                    Mon 26 Apr 2010 05:05:27 PM CEST
Last Seen                     Mon 26 Apr 2010 05:05:27 PM CEST
Local ID                      c13e4ef5-e9bf-44a6-9257-0827d9a0ca60
Line Numbers                  

Raw Audit Messages            

node=springer.wildebeest.org type=AVC msg=audit(1272294327.307:106):
avc:  denied  { add_name } for  pid=8604 comm="_updown.netkey"
name="resolv.conf" scontext=unconfined_u:system_r:ipsec_mgmt_t:s0
tcontext=system_u:object_r:etc_t:s0 tclass=dir

node=springer.wildebeest.org type=AVC msg=audit(1272294327.307:106):
avc:  denied  { create } for  pid=8604 comm="_updown.netkey"
name="resolv.conf" scontext=unconfined_u:system_r:ipsec_mgmt_t:s0
tcontext=unconfined_u:object_r:etc_t:s0 tclass=file

node=springer.wildebeest.org type=AVC msg=audit(1272294327.307:106):
avc:  denied  { write } for  pid=8604 comm="_updown.netkey"
name="resolv.conf" dev=dm-0 ino=524306
scontext=unconfined_u:system_r:ipsec_mgmt_t:s0
tcontext=unconfined_u:object_r:etc_t:s0 tclass=file

node=springer.wildebeest.org type=SYSCALL msg=audit(1272294327.307:106):
arch=c000003e syscall=2 success=yes exit=4294967424 a0=1ee36b0 a1=241
a2=1b6 a3=fffffffffffffff0 items=0 ppid=8603 pid=8604 auid=500 uid=0
gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1
comm="_updown.netkey" exe="/bin/bash"
subj=unconfined_u:system_r:ipsec_mgmt_t:s0 key=(null)
Comment 3 Daniel Walsh 2010-04-26 15:49:48 UTC 
Fixed in selinux-policy-3.7.19-6.fc13.noarch
Comment 4 RHEL Program Management 2010-04-26 16:15:17 UTC 
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.
Comment 8 releng-rhel@redhat.com 2010-11-11 14:56:28 UTC 
Red Hat Enterprise Linux 6.0 is now available and should resolve
the problem described in this bug report. This report is therefore being closed
with a resolution of CURRENTRELEASE. You may reopen this bug report if the
solution does not work for you.
Note You need to log in before you can comment on or make changes to this bug.