Bug 596347 - pyhook: statvfs('/var/spool/abrt'): Permission denied
pyhook: statvfs('/var/spool/abrt'): Permission denied
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
6.0
All Linux
medium Severity medium
: rc
: ---
Assigned To: Daniel Walsh
Milos Malik
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2010-05-26 12:04 EDT by Michal Nowak
Modified: 2013-03-07 21:10 EST (History)
10 users (show)

See Also:
Fixed In Version: selinux-policy-3.7.19-22
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-07-02 16:53:51 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Michal Nowak 2010-05-26 12:04:25 EDT
Description of problem:

Disabled BlackListedPaths in abrt.conf, modified /usr/share/doc/gamin-python-0.1.10/basic2.py to contain TypeError exception

#!/usr/bin/python
"11" + 11

and executed it:

newman@dhcp-lab-222 init-scripts-LSB $ /usr/share/doc/gamin-python-0.1.10/basic2.py 
Traceback (most recent call last):
  File "/usr/share/doc/gamin-python-0.1.10/basic2.py", line 2, in <module>
    "11" + 11
TypeError: cannot concatenate 'str' and 'int' objects


abrtd spited just following two lines:

python: abrt: detected unhandled Python exception in /usr/share/doc/gamin-python-0.1.10/basic2.py
abrt[24079]: statvfs('/var/spool/abrt'): Permission denied

and no crash is present in abrt-gui.

Version-Release number of selected component (if applicable):

abrt-1.1.4-1.el6.x86_64 (unofficial from jmoskovc's fedorapeople repo)
abrt-1.1.3-1.el6.x86_64 is the same.

How reproducible:

always

There's nothing in audit.log.
Comment 1 Karel Klíč 2010-05-26 12:26:25 EDT
Michal, can you please try it again with SELinux turned off? 
Does it still say 'Permission denied?'

Just to be sure SELinux doesn't forget to report the incident.
Comment 2 Jiri Moskovcak 2010-05-26 12:58:10 EDT
It works with selinux turned off.
Comment 3 Denys Vlasenko 2010-05-26 13:17:03 EDT
The strange part is that we do not seem to be getting any AVC denials!
We only see statfs() syscall (which is what glibc calls when one calls statvfs() function in C) fails with EPERM.
Comment 4 Denys Vlasenko 2010-05-26 13:22:21 EDT
Correction. It's EACCESS, not EPERM.

Here's the part of the strace log. The crashed python process was run under root:

# grep -e 'set[a-z]*uid(' -e EPERM -e EACCESS -e 'statv*fs' -e abrt-hook-python LOG 
8782  statfs("/selinux", {f_type=0xf97cff8c, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={0, 0}, f_namelen=255, f_frsize=4096}) = 0
8783  statfs("/selinux", {f_type=0xf97cff8c, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={0, 0}, f_namelen=255, f_frsize=4096}) = 0
8783  setfsuid(0)                       = 0
8783  setfsuid(0)                       = 0
8783  setfsuid(0)                       = 0
8783  setfsuid(0)                       = 0
8785  setuid(0)                         = 0
8785  statfs("/root/.xauthr0arLD-c", {f_type="EXT2_SUPER_MAGIC", f_bsize=4096, f_blocks=2519771, f_bfree=655765, f_bavail=527765, f_files=640848, f_ffree=409688, f_fsid={-430438761, 1438887161}, f_namelen=255, f_frsize=4096}) = 0
8783  setfsuid(0)                       = 0
8783  setfsuid(0)                       = 0
8786  setuid(0 <unfinished ...>
8786  statfs("/root/.xauthfOoY60-c", {f_type="EXT2_SUPER_MAGIC", f_bsize=4096, f_blocks=2519771, f_bfree=655740, f_bavail=527740, f_files=640848, f_ffree=409687, f_fsid={-430438761, 1438887161}, f_namelen=255, f_frsize=4096}) = 0
8787  setreuid(0, 0)                    = 0
8789  read(5, "4/python2.6/os.pyt\24\0\0\0_make_statvfs_result\335\2\0\0s\2\0\0\0\0\1c\1\0\0\0\3\0\0\0\2\0\0\0C\0\0\0s\34\0\0\0|\0\0i\0\0\203\0\0\\\2\0}\1\0}\2\0t\1\0|\2\0"..., 4096) = 1834
8790  execve("/usr/libexec/abrt-hook-python", ["/usr/libexec/abrt-hook-python", "--pid=8789", "--executable=/usr/share/system-config-display/xconf.py"], [/* 14 vars */]
8790  ("/var/spool/abrt", 0x7fff55516c00) = -1 EACCES (Permission denied)
8790  sendto(3, "<27>May 26 18:42:58 abrt[8790]: statvfs('/var/spool/abrt'): Permission denied", 77, MSG_NOSIGNAL, NULL, 0) = 77

Is it a problem of /usr/libexec/abrt-hook-python not having enough privileges?
Comment 5 Denys Vlasenko 2010-05-27 09:33:36 EDT
Last lines got messed up by copy/paste. Correct ones:

8790  execve("/usr/libexec/abrt-hook-python", ["/usr/libexec/abrt-hook-python", "--pid=8789", "--executable=/usr/share/system-config-display/xconf.py"], [/* 14 vars */] <unfinished ...>
8790  statfs("/var/spool/abrt", 0x7fff55516c00) = -1 EACCES (Permission denied)
8790  sendto(3, "<27>May 26 18:42:58 abrt[8790]: statvfs('/var/spool/abrt'): Permission denied", 77, MSG_NOSIGNAL, NULL, 0) = 77
Comment 6 Miroslav Grepl 2010-05-27 09:54:18 EDT
Dan,
we need to add

files_search_spool(abrt_helper_t)
Comment 8 Daniel Walsh 2010-05-27 10:00:59 EDT
Fixed in selinux-policy-3.7.19-22.fc13.noarch
Comment 12 releng-rhel@redhat.com 2010-07-02 16:53:51 EDT
Red Hat Enterprise Linux Beta 2 is now available and should resolve
the problem described in this bug report. This report is therefore being closed
with a resolution of CURRENTRELEASE. You may reopen this bug report if the
solution does not work for you.

Note You need to log in before you can comment on or make changes to this bug.