Fedora Account System
Red Hat Associate
Red Hat Customer
Summary: SELinux is preventing /usr/sbin/abrtd "write" access . Detailed Description: [SELinux is in permissive mode. This access was not denied.] SELinux denied access requested by abrtd. It is not expected that this access is required by abrtd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context unconfined_u:system_r:abrt_t:s0-s0:c0.c1023 Target Context system_u:system_r:afs_t:s0 Target Objects None [ udp_socket ] Source abrtd Source Path /usr/sbin/abrtd Port <Unknown> Host (removed) Source RPM Packages abrt-1.1.1-1.fc13 Target RPM Packages Policy RPM selinux-policy-3.7.19-21.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Plugin Name catchall Host Name (removed) Platform Linux (removed) 2.6.33.5-112.fc13.x86_64 #1 SMP Thu May 27 02:28:31 UTC 2010 x86_64 x86_64 Alert Count 1 First Seen Thu 03 Jun 2010 08:47:48 AM EDT Last Seen Thu 03 Jun 2010 08:47:48 AM EDT Local ID 88e2ca12-9343-41bb-9f16-1f196f27f077 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1275569268.892:3158600): avc: denied { write } for pid=23714 comm="abrtd" lport=7001 scontext=unconfined_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:system_r:afs_t:s0 tclass=udp_socket node=(removed) type=SYSCALL msg=audit(1275569268.892:3158600): arch=c000003e syscall=4 success=yes exit=0 a0=7fff7c7b42a0 a1=7fff7c7b4310 a2=7fff7c7b4310 a3=3527d21a10 items=0 ppid=23713 pid=23714 auid=768 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="abrtd" exe="/usr/sbin/abrtd" subj=unconfined_u:system_r:abrt_t:s0-s0:c0.c1023 key=(null) Hash String generated from catchall,abrtd,abrt_t,afs_t,udp_socket,write audit2allow suggests: #============= abrt_t ============== allow abrt_t afs_t:udp_socket write;
I think that this is similar to a different bug where an selinux alert is shown with /etc/init.d/abrtd restart But not when doing: service abrtd restart
No I think this is just the way AFS works. Any app that needs to read/write nfs files needs to be able to communicate with the udp_socket. Not sure if this is a kernel bug, but since we don't control the kernel module for AFS we can not fix it. Miroslav, I think we have two solutions to this either optional_policy(` afs_rw_udp_sockets(abrt_t) ') Or change fs_read_nfs_files and fs_write_nfs_files to include this function.
Lets eliminate them all with putting them into file system. optional_policy(` afs_rw_udp_sockets($1) ')
OK, added to selinux-policy-3.7.19-24.fc13
selinux-policy-3.7.19-28.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/selinux-policy-3.7.19-28.fc13
selinux-policy-3.7.19-28.fc13 has been pushed to the Fedora 13 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/selinux-policy-3.7.19-28.fc13
selinux-policy-3.7.19-28.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.