Hide Forgot
SELinux is preventing /usr/sbin/snmpd from 'getattr' accesses on the file /var/spool/mqueue/dfp4HFe3sW022078. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that snmpd should be allowed getattr access on the dfp4HFe3sW022078 file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep snmpd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:snmpd_t:s0 Target Context system_u:object_r:mqueue_spool_t:s0 Target Objects /var/spool/mqueue/dfp4HFe3sW022078 [ file ] Source snmpd Source Path /usr/sbin/snmpd Port <Unbekannt> Host (removed) Source RPM Packages net-snmp-5.6.1-7.fc15 Target RPM Packages Policy RPM selinux-policy-3.9.16-23.fc15 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 2.6.38.6-26.rc1.fc15.x86_64 #1 SMP Mon May 9 20:45:15 UTC 2011 x86_64 x86_64 Alert Count 2 First Seen Di 17 Mai 2011 17:40:05 CEST Last Seen Di 17 Mai 2011 17:40:05 CEST Local ID 37b18460-43fe-4ae1-beda-7f57e89f823d Raw Audit Messages type=AVC msg=audit(1305646805.722:2678): avc: denied { getattr } for pid=1221 comm="snmpd" path="/var/spool/mqueue/dfp4HFe3sW022078" dev=dm-2 ino=14417962 scontext=system_u:system_r:snmpd_t:s0 tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=file type=SYSCALL msg=audit(1305646805.722:2678): arch=x86_64 syscall=stat success=no exit=EACCES a0=7f7852103f9b a1=7fffcd0ecd00 a2=7fffcd0ecd00 a3=100000002 items=0 ppid=1 pid=1221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=snmpd exe=/usr/sbin/snmpd subj=system_u:system_r:snmpd_t:s0 key=(null) Hash: snmpd,snmpd_t,mqueue_spool_t,file,getattr audit2allow #============= snmpd_t ============== allow snmpd_t mqueue_spool_t:file getattr; audit2allow -R #============= snmpd_t ============== allow snmpd_t mqueue_spool_t:file getattr;
If you execute # semanage permissive -a snmpd_t Are you getting more AVC msgs? # semanage permissive -d snmpd_t will remove permissive domain for snmpd_t
semanage permissive -a snmpd_t does not produce any output. Do you want me to execute # semanage permissive -d snmpd_t as well?
Yes. The idea was to see if snmpd_t needed additional access outside of getattr. Is /var/spool/mqueue a mountpoint on your machine?
After running semanage permissive -a snmpd_t I indeed received more AVC denials. But there are not more than once each day (as this is on my laptop, it may be related to booting the machine) I've now run semanage permissive -d snmpd_t And I had some reading on SELinux ;-) Going to understand the first few bits. As I'm on vacation for next two weeks, don't expect me to react during that time.
Any update on this?
This issue still happens. I just encountered it again. Do you need any more information?
Is /var/spool/mqueue a mountpoint on your machine?
not exactly, see below (last line) $ mount /proc on /proc type proc (rw,relatime) /sys on /sys type sysfs (rw,relatime,seclabel) udev on /dev type devtmpfs (rw,nosuid,relatime,seclabel,size=1971532k,nr_inodes=492883,mode=755) devpts on /dev/pts type devpts (rw,relatime,seclabel,gid=5,mode=620,ptmxmode=000) tmpfs on /dev/shm type tmpfs (rw,relatime,seclabel) tmpfs on /run type tmpfs (rw,nosuid,nodev,noexec,relatime,seclabel,mode=755) /dev/mapper/vg_gandalf-lv_root on / type ext4 (rw,relatime,seclabel,user_xattr,barrier=1,stripe=1,data=ordered) selinuxfs on /selinux type selinuxfs (rw,relatime) tmpfs on /sys/fs/cgroup type tmpfs (rw,nosuid,nodev,noexec,relatime,seclabel,mode=755) cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,release_agent=/lib/systemd/systemd-cgroups-agent,name=systemd) cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset) cgroup on /sys/fs/cgroup/cpu type cgroup (rw,nosuid,nodev,noexec,relatime,cpu) cgroup on /sys/fs/cgroup/cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpuacct) cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,memory) cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices) cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer) cgroup on /sys/fs/cgroup/net_cls type cgroup (rw,nosuid,nodev,noexec,relatime,net_cls) cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio) cgroup on /sys/fs/cgroup/perf_event type cgroup (rw,nosuid,nodev,noexec,relatime,perf_event) systemd-1 on /dev/hugepages type autofs (rw,relatime,fd=30,pgrp=1,timeout=300,minproto=5,maxproto=5,direct) systemd-1 on /sys/kernel/debug type autofs (rw,relatime,fd=31,pgrp=1,timeout=300,minproto=5,maxproto=5,direct) systemd-1 on /sys/kernel/security type autofs (rw,relatime,fd=32,pgrp=1,timeout=300,minproto=5,maxproto=5,direct) systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=34,pgrp=1,timeout=300,minproto=5,maxproto=5,direct) systemd-1 on /dev/mqueue type autofs (rw,relatime,fd=35,pgrp=1,timeout=300,minproto=5,maxproto=5,direct) tmpfs on /media type tmpfs (rw,nosuid,nodev,noexec,relatime,rootcontext=system_u:object_r:mnt_t:s0,seclabel,mode=755) /dev/sda3 on /boot type ext4 (rw,relatime,seclabel,user_xattr,barrier=1,stripe=4,data=ordered) /dev/mapper/vg_gandalf-lv_var on /var type ext4 (rw,relatime,seclabel,user_xattr,barrier=1,stripe=1,data=ordered) /dev/mapper/vg_gandalf-lv_home on /home type ext4 (rw,relatime,seclabel,user_xattr,barrier=1,stripe=1,data=ordered) binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,relatime) /dev/mapper/vg_gandalf-lv_root on /tmp type ext4 (rw,relatime,seclabel,user_xattr,barrier=1,stripe=1,data=ordered) /dev/mapper/vg_gandalf-lv_var on /var/tmp type ext4 (rw,relatime,seclabel,user_xattr,barrier=1,stripe=1,data=ordered) /dev/mapper/vg_gandalf-lv_home on /home type ext4 (rw,relatime,seclabel,user_xattr,barrier=1,stripe=1,data=ordered) sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw,relatime) fusectl on /sys/fs/fuse/connections type fusectl (rw,relatime) gvfs-fuse-daemon on /home/reinhard/.gvfs type fuse.gvfs-fuse-daemon (rw,nosuid,nodev,relatime,user_id=500,group_id=500) hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime,seclabel) debugfs on /sys/kernel/debug type debugfs (rw,relatime) securityfs on /sys/kernel/security type securityfs (rw,relatime) mqueue on /dev/mqueue type mqueue (rw,relatime,seclabel)
Let's ask snmp maintainer why this would be needed.
This message is a notice that Fedora 15 is now at end of life. Fedora has stopped maintaining and issuing updates for Fedora 15. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At this time, all open bugs with a Fedora 'version' of '15' have been closed as WONTFIX. (Please note: Our normal process is to give advanced warning of this occurring, but we forgot to do that. A thousand apologies.) Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, feel free to reopen this bug and simply change the 'version' to a later Fedora version. Bug Reporter: Thank you for reporting this issue and we are sorry that we were unable to fix it before Fedora 15 reached end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged to click on "Clone This Bug" (top right of this page) and open it against that version of Fedora. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping