Summary:

SELinux prevented cmcalibrate from reading from the urandom device.

Detailed Description:

[cmcalibrate has a permissive type (boinc_project_t). This access was not
denied.]

SELinux prevented cmcalibrate from reading from the urandom device. This access
should be allowed for individual applications, but there are situations where
all applications require the access (for example, when ProPolice/SSP stack
smashing protection is used). Allowing this access may allow malicious
applications to drain the kernel entropy pool. This can compromise the ability
of some software that is dependent on high quality random numbers (e.g.,
ssh-keygen) to operate effectively. The risk of this type of attack is
relatively low.

Allowing Access:

Changing the "global_ssp" boolean to true will allow this access: "setsebool -P
global_ssp=1."

Fix Command:

setsebool -P global_ssp=1

Additional Information:

Source Context                system_u:system_r:boinc_project_t:s0
Target Context                system_u:object_r:urandom_device_t:s0
Target Objects                /dev/urandom [ chr_file ]
Source                        cmcalibrate
Source Path                   /var/lib/boinc/slots/10/cmcalibrate
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.7.19-51.fc13
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   global_ssp
Host Name                     (removed)
Platform                      Linux (removed) 2.6.33.8-149.fc13.x86_64 #1
                              SMP Tue Aug 17 22:53:15 UTC 2010 x86_64 x86_64
Alert Count                   8
First Seen                    Tue 24 Aug 2010 06:18:31 AM EDT
Last Seen                     Thu 26 Aug 2010 09:17:18 AM EDT
Local ID                      e1e0faf6-c9d1-4bad-8373-fdfb93d701a9
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1282828638.554:12): avc:  denied  { read } for  pid=2457 comm="cmcalibrate" name="urandom" dev=devtmpfs ino=4033 scontext=system_u:system_r:boinc_project_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file

node=(removed) type=AVC msg=audit(1282828638.554:12): avc:  denied  { open } for  pid=2457 comm="cmcalibrate" name="urandom" dev=devtmpfs ino=4033 scontext=system_u:system_r:boinc_project_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file

node=(removed) type=SYSCALL msg=audit(1282828638.554:12): arch=c000003e syscall=2 success=yes exit=128 a0=5a75bb a1=0 a2=700 a3=7d99c8 items=0 ppid=2455 pid=2457 auid=4294967295 uid=491 gid=472 euid=491 suid=491 fsuid=491 egid=472 sgid=472 fsgid=472 tty=(none) ses=4294967295 comm="cmcalibrate" exe="/var/lib/boinc/slots/4/cmcalibrate" subj=system_u:system_r:boinc_project_t:s0 key=(null)



Hash String generated from  global_ssp,cmcalibrate,boinc_project_t,urandom_device_t,chr_file,read
audit2allow suggests:

#============= boinc_project_t ==============
#!!!! This avc can be allowed using the boolean 'global_ssp'

allow boinc_project_t urandom_device_t:chr_file { read open };