Summary:

SELinux prevented primegrid_cllr_ from reading from the urandom device.

Detailed Description:

[primegrid_cllr_ has a permissive type (boinc_project_t). This access was not
denied.]

SELinux prevented primegrid_cllr_ from reading from the urandom device. This
access should be allowed for individual applications, but there are situations
where all applications require the access (for example, when ProPolice/SSP stack
smashing protection is used). Allowing this access may allow malicious
applications to drain the kernel entropy pool. This can compromise the ability
of some software that is dependent on high quality random numbers (e.g.,
ssh-keygen) to operate effectively. The risk of this type of attack is
relatively low.

Allowing Access:

Changing the "global_ssp" boolean to true will allow this access: "setsebool -P
global_ssp=1."

Fix Command:

setsebool -P global_ssp=1

Additional Information:

Source Context                system_u:system_r:boinc_project_t:s0
Target Context                system_u:object_r:urandom_device_t:s0
Target Objects                urandom [ chr_file ]
Source                        primegrid_cllr_
Source Path                   /var/lib/boinc/slots/2/primegrid_cllr_3.7.1c
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.7.19-51.fc13
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   global_ssp
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.34.6-47.fc13.x86_64 #1 SMP Fri Aug 27 08:56:01
                              UTC 2010 x86_64 x86_64
Alert Count                   32
First Seen                    Fri 03 Sep 2010 09:33:38 AM CEST
Last Seen                     Fri 03 Sep 2010 09:49:17 PM CEST
Local ID                      b81791a3-9e27-44e4-9545-28b3b02762b2
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1283543357.518:26220): avc:  denied  { read } for  pid=15969 comm="primegrid_cllr_" name="urandom" dev=devtmpfs ino=4035 scontext=system_u:system_r:boinc_project_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file

node=(removed) type=AVC msg=audit(1283543357.518:26220): avc:  denied  { open } for  pid=15969 comm="primegrid_cllr_" name="urandom" dev=devtmpfs ino=4035 scontext=system_u:system_r:boinc_project_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file

node=(removed) type=SYSCALL msg=audit(1283543357.518:26220): arch=40000003 syscall=5 per=400000 success=yes exit=7 a0=84fc4d4 a1=0 a2=0 a3=2062206 items=0 ppid=15962 pid=15969 auid=4294967295 uid=489 gid=472 euid=489 suid=489 fsuid=489 egid=472 sgid=472 fsgid=472 tty=(none) ses=4294967295 comm="primegrid_cllr_" exe="/var/lib/boinc/slots/2/primegrid_cllr_3.7.1c" subj=system_u:system_r:boinc_project_t:s0 key=(null)



Hash String generated from  global_ssp,primegrid_cllr_,boinc_project_t,urandom_device_t,chr_file,read
audit2allow suggests:

#============= boinc_project_t ==============
#!!!! This avc can be allowed using the boolean 'global_ssp'

allow boinc_project_t urandom_device_t:chr_file { read open };