Summary: SELinux is preventing /sbin/ifconfig "search" access for. NOTE: For some reason ddclient was left out of the message. I am guessing this is why I didn't see ddclient mentioned as the target RPM package in the sealert output. Detailed Description: SELinux denied access requested by ifconfig. It is not expected that this access is required by ifconfig and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context system_u:system_r:ddclient_t:s0 Target Context system_u:object_r:sysctl_net_t:s0 Target Objects None [ dir ] Source ifconfig Source Path /sbin/ifconfig Port <Unknown> Host (removed) Source RPM Packages net-tools-1.60-105.fc14.1 Target RPM Packages ddclient-3.8.0-2.fc14 Policy RPM selinux-policy-3.9.7-13.fc14 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name (removed) Platform Linux (removed) 2.6.35.6-48.fc14.i686 #1 SMP Fri Oct 22 15:34:36 UTC 2010 i686 i686 Alert Count 20 First Seen Sun Nov 28 15:30:13 2010 Last Seen Sun Nov 28 16:15:15 2010 Local ID 274ba89a-eeb0-4d3a-8098-5d552eb08817 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1290978915.259:15258): avc: denied { search } for pid=2536 comm="ifconfig" scontext=system_u:system_r:ddclient_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir node=(removed) type=SYSCALL msg=audit(1290978915.259:15258): arch=40000003 syscall=33 success=no exit=-13 a0=8054be5 a1=4 a2=8058460 a3=8058424 items=0 ppid=2535 pid=2536 auid=4294967295 uid=491 gid=487 euid=491 suid=491 fsuid=491 egid=487 sgid=487 fsgid=487 tty=(none) ses=4294967295 comm="ifconfig" exe="/sbin/ifconfig" subj=system_u:system_r:ddclient_t:s0 key=(null)
Jimmy, could you execute # semanage permissive -a ddclient_t Try to use ddclient and after that execute # ausearch -m avc -ts recent and please attach AVC messages which you are seeing. Thanks.
---- time->Sun Nov 28 19:20:18 2010 type=SYSCALL msg=audit(1290990018.029:15756): arch=40000003 syscall=33 success=no exit=-13 a0=8054c5f a1=4 a2=8058540 a3=8058420 items=0 ppid=4169 pid=4170 auid=4294967295 uid=491 gid=487 euid=491 suid=491 fsuid=491 egid=487 sgid=487 fsgid=487 tty=(none) ses=4294967295 comm="ifconfig" exe="/sbin/ifconfig" subj=system_u:system_r:ddclient_t:s0 key=(null) type=AVC msg=audit(1290990018.029:15756): avc: denied { search } for pid=4170 comm="ifconfig" scontext=system_u:system_r:ddclient_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir ---- time->Sun Nov 28 19:20:18 2010 type=SYSCALL msg=audit(1290990018.033:15757): arch=40000003 syscall=33 success=no exit=-13 a0=8054be5 a1=4 a2=8058460 a3=8058424 items=0 ppid=4169 pid=4170 auid=4294967295 uid=491 gid=487 euid=491 suid=491 fsuid=491 egid=487 sgid=487 fsgid=487 tty=(none) ses=4294967295 comm="ifconfig" exe="/sbin/ifconfig" subj=system_u:system_r:ddclient_t:s0 key=(null) type=AVC msg=audit(1290990018.033:15757): avc: denied { search } for pid=4170 comm="ifconfig" scontext=system_u:system_r:ddclient_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir ---- time->Sun Nov 28 19:25:18 2010 type=SYSCALL msg=audit(1290990318.121:15773): arch=40000003 syscall=33 success=no exit=-13 a0=8054c5f a1=4 a2=8058540 a3=8058420 items=0 ppid=4270 pid=4271 auid=4294967295 uid=491 gid=487 euid=491 suid=491 fsuid=491 egid=487 sgid=487 fsgid=487 tty=(none) ses=4294967295 comm="ifconfig" exe="/sbin/ifconfig" subj=system_u:system_r:ddclient_t:s0 key=(null) type=AVC msg=audit(1290990318.121:15773): avc: denied { search } for pid=4271 comm="ifconfig" scontext=system_u:system_r:ddclient_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir ---- time->Sun Nov 28 19:25:18 2010 type=SYSCALL msg=audit(1290990318.132:15774): arch=40000003 syscall=33 success=no exit=-13 a0=8054be5 a1=4 a2=8058460 a3=8058424 items=0 ppid=4270 pid=4271 auid=4294967295 uid=491 gid=487 euid=491 suid=491 fsuid=491 egid=487 sgid=487 fsgid=487 tty=(none) ses=4294967295 comm="ifconfig" exe="/sbin/ifconfig" subj=system_u:system_r:ddclient_t:s0 key=(null) type=AVC msg=audit(1290990318.132:15774): avc: denied { search } for pid=4271 comm="ifconfig" scontext=system_u:system_r:ddclient_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir ---- time->Sun Nov 28 19:28:04 2010 type=SYSCALL msg=audit(1290990484.026:15794): arch=40000003 syscall=33 success=no exit=-2 a0=8054c5f a1=4 a2=8058540 a3=8058420 items=0 ppid=4322 pid=4323 auid=500 uid=491 gid=487 euid=491 suid=491 fsuid=491 egid=487 sgid=487 fsgid=487 tty=(none) ses=34 comm="ifconfig" exe="/sbin/ifconfig" subj=unconfined_u:system_r:ddclient_t:s0 key=(null) type=AVC msg=audit(1290990484.026:15794): avc: denied { search } for pid=4323 comm="ifconfig" scontext=unconfined_u:system_r:ddclient_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir 19:28 is after I restarted the service.
Fixed in selinux-policy-3.9.7-14.fc14
selinux-policy-3.9.7-14.fc14 has been submitted as an update for Fedora 14. https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-14.fc14
This fixes it. Thanks.
Thanks for testing. Could you update the karma?
selinux-policy-3.9.7-14.fc14 has been pushed to the Fedora 14 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-14.fc14
selinux-policy-3.9.7-14.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.