Bug 590481 - SELinux is preventing /usr/sbin/aiccu (deleted) "write" access on /dev/net/tun.
Summary: SELinux is preventing /usr/sbin/aiccu (deleted) "write" access on /dev/n...
Alias: None
Product: Fedora
Classification: Fedora
Component: aiccu
Version: 13
Hardware: i386
OS: Linux
Target Milestone: ---
Assignee: Conrad Meyer
QA Contact: Fedora Extras Quality Assurance
Whiteboard: setroubleshoot_trace_hash:7089934d3da...
Depends On:
TreeView+ depends on / blocked
Reported: 2010-05-09 19:02 UTC by Tomasz Torcz
Modified: 2010-07-12 20:34 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2010-07-12 20:34:20 UTC
Type: ---

Attachments (Terms of Use)

Description Tomasz Torcz 2010-05-09 19:02:17 UTC

SELinux is preventing /usr/sbin/aiccu (deleted) "write" access on /dev/net/tun.

Szczegółowy opis:

[aiccu posiada typ zezwalania (aiccu_t). Ten dostęp nie został odmówiony.]

SELinux denied access requested by aiccu. It is not expected that this access is
required by aiccu and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Zezwalanie na dostęp:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug

Dodatkowe informacje:

Kontekst źródłowy          system_u:system_r:aiccu_t:s0
Kontekst docelowy             system_u:object_r:tun_tap_device_t:s0
Obiekty docelowe              /dev/net/tun [ chr_file ]
Źródło                     aiccu
Ścieżka źródłowa         /usr/sbin/aiccu (deleted)
Port                          <Nieznane>
Komputer                      (usunięto)
Źródłowe pakiety RPM       
Docelowe pakiety RPM          
Pakiet RPM polityki           selinux-policy-3.7.19-10.fc13
SELinux jest włączony       True
Typ polityki                  targeted
Tryb wymuszania               Enforcing
Nazwa wtyczki                 catchall
Nazwa komputera               (usunięto)
Platforma                     Linux (usunięto)
                     #1 SMP Mon Apr 12
                              14:10:01 UTC 2010 i686 i686
Liczba alarmów               2272
Po raz pierwszy               pią, 23 kwi 2010, 14:31:12
Po raz ostatni                nie, 9 maj 2010, 21:01:03
Lokalny identyfikator         a3977c14-5e2d-4f83-8a80-251370f3adee
Liczba wierszy                

Surowe komunikaty audytu      

node=(usunięto) type=AVC msg=audit(1273431663.469:264644): avc:  denied  { write } for  pid=3998 comm="aiccu" path="/dev/net/tun" dev=devtmpfs ino=8902 scontext=system_u:system_r:aiccu_t:s0 tcontext=system_u:object_r:tun_tap_device_t:s0 tclass=chr_file

node=(usunięto) type=SYSCALL msg=audit(1273431663.469:264644): arch=40000003 syscall=146 success=yes exit=171 a0=4 a1=b6da69ec a2=2 a3=0 items=0 ppid=1 pid=3998 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="aiccu" exe=2F7573722F7362696E2F6169636375202864656C6574656429 subj=system_u:system_r:aiccu_t:s0 key=(null)

Hash String generated from  catchall,aiccu,aiccu_t,tun_tap_device_t,chr_file,write
audit2allow suggests:

#============= aiccu_t ==============
allow aiccu_t tun_tap_device_t:chr_file write;

Comment 1 Daniel Walsh 2010-05-10 18:28:00 UTC
Does aiccu use the /dev/net/tun device?  Does it use any other devices?

Comment 2 Conrad Meyer 2010-05-11 03:13:03 UTC
(In reply to comment #1)
> Does aiccu use the /dev/net/tun device?  Does it use any other devices?    

$ strings /usr/sbin/aiccu |grep /dev/net

Says yes. I'm not familiar with it enough to say one way or the other if it uses other devices, though I'll take a quick look.

Comment 3 Conrad Meyer 2010-05-11 03:32:24 UTC
Just glancing at the code, it looks like /dev/net/tun is the only device it uses on linux.

Comment 4 Daniel Walsh 2010-05-11 14:34:39 UTC
Fixed in selinux-policy-3.7.19-15.fc13.noarch

Comment 5 Jeff Raber 2010-07-08 16:25:57 UTC
Daniel - Should this be CLOSED/ERRATA?

Note You need to log in before you can comment on or make changes to this bug.