Bug 710292 - setroubleshoot: Your system may be seriously compromised! /usr/sbin/wpa_supplicant (deleted) tried to load a kernel module
Summary: setroubleshoot: Your system may be seriously compromised! /usr/sbin/wpa_suppl...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.0
Hardware: x86_64
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Karel Srot
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-06-02 22:18 UTC by Natxo Asenjo
Modified: 2018-11-14 12:30 UTC (History)
5 users (show)

Fixed In Version: selinux-policy-3.7.19-96.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-12-06 10:08:17 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2011:1511 0 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2011-12-06 00:39:17 UTC

Description Natxo Asenjo 2011-06-02 22:18:14 UTC
Description of problem:

selinux 'panicks' (and made me panick) when laptop resumes from suspended mode.

I read this log: 
Jun  2 19:57:31 host setroubleshoot: Your system may be seriously compromised! /usr/sbin/wpa_supplicant (deleted) tried to load a kernel module. For complete SELinux messages. run sealert -l abe18b46-f4f7-46b4-bcd4-be8ed703073e

If you run the sealer command, you get a very nasty looking warning that the system has been compromised.

In fact, this is what has happened: this system is a laptop with a builtin broadband modem. I closed the laptop lid, so it suspended. When I reopened its lid, it reactivated and the network devices (wifi, 3g modem, etc) woke up. This is a piece of thelog:

Jun  2 19:57:31 host NetworkManager[1529]: <info> Activation (wlan0) Stage 5 of 5 (IP Configure Commit) scheduled...
Jun  2 19:57:31 host NetworkManager[1529]: <info> Activation (wlan0) Stage 4 of 5 (IP4 Configure Get) complete.
Jun  2 19:57:31 host NetworkManager[1529]: <info> Activation (wlan0) Stage 5 of 5 (IP Configure Commit) started...
Jun  2 19:57:31 host dhclient: bound to 192.168.0.10 -- renewal in 34580 seconds.
Jun  2 19:57:31 host kernel: cdc_acm 2-6:1.1: ttyACM0: USB ACM device
Jun  2 19:57:31 host kernel: cdc_acm 2-6:1.3: ttyACM1: USB ACM device
Jun  2 19:57:31 host kernel: cdc_wdm 2-6:1.5: cdc-wdm0: USB WDM device
Jun  2 19:57:31 host kernel: cdc_wdm 2-6:1.6: cdc-wdm1: USB WDM device
Jun  2 19:57:31 host kernel: usb0: register 'cdc_ether' at usb-0000:00:1d.7-6, CDC Ethernet Device, 02:80:37:ec:02:00
Jun  2 19:57:31 host kernel: cdc_acm 2-6:1.9: ttyACM2: USB ACM device
Jun  2 19:57:31 host modem-manager: (Ericsson MBM): GSM modem /sys/devices/pci0000:00/0000:00:1d.7/usb2/2-6 claimed port usb0
Jun  2 19:57:31 host modem-manager: (ttyACM1) opening serial device...
Jun  2 19:57:31 host modem-manager: (ttyACM2) opening serial device...
Jun  2 19:57:31 host modem-manager: (ttyACM0) opening serial device...
Jun  2 19:57:31 host setroubleshoot: Your system may be seriously compromised! /usr/sbin/wpa_supplicant (deleted) tried to load a kernel module. For complete SELinux messages. run sealert -l abe18b46-f4f7-46b4-bcd4-be8ed703073e

As you see the message comes right after the wifi nic gets an ip
address. Then the modem driver gets loaded.

I am quite confident the system has not been compromised, although
everything is possible. The firewall is on, no services are running.

Version-Release number of selected component (if applicable):


How reproducible:

I have not seen this behaviour before, grepping the messages log files
shows only this one message

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 2 Natxo Asenjo 2011-06-02 22:29:47 UTC
I had the laptop suspend again, and again I go the message. So it looks reproducible:

Jun  3 00:23:28 host dhclient: bound to 192.168.0.10 -- renewal in 35854 seconds.
Jun  3 00:23:29 host kernel: usb 2-6: New USB device found, idVendor=413c, idProduct=8147
Jun  3 00:23:29 host kernel: usb 2-6: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Jun  3 00:23:29 host kernel: usb 2-6: Product: Dell Wireless 5530 HSPA Mobile Broadband Minicard Device
Jun  3 00:23:29 host kernel: usb 2-6: Manufacturer: Dell
Jun  3 00:23:29 host kernel: usb 2-6: SerialNumber: 3558620253014030
Jun  3 00:23:29 host kernel: usb 2-6: configuration #1 chosen from 2 choices
Jun  3 00:23:29 host kernel: cdc_acm 2-6:1.1: ttyACM0: USB ACM device
Jun  3 00:23:29 host kernel: cdc_acm 2-6:1.3: ttyACM1: USB ACM device
Jun  3 00:23:29 host kernel: cdc_wdm 2-6:1.5: cdc-wdm0: USB WDM device
Jun  3 00:23:29 host kernel: cdc_wdm 2-6:1.6: cdc-wdm1: USB WDM device
Jun  3 00:23:29 host kernel: usb0: register 'cdc_ether' at usb-0000:00:1d.7-6, CDC Ethernet Device, 02:80:37:ec:02:00
Jun  3 00:23:29 host kernel: cdc_acm 2-6:1.9: ttyACM2: USB ACM device
Jun  3 00:23:29 host modem-manager: (ttyACM1) opening serial device...
Jun  3 00:23:29 host modem-manager: (ttyACM2) opening serial device...
Jun  3 00:23:29 host modem-manager: (ttyACM0) opening serial device...
Jun  3 00:23:29 host modem-manager: (Ericsson MBM): GSM modem /sys/devices/pci0000:00/0000:00:1d.7/usb2/2-6 claimed port usb0
Jun  3 00:23:29 host NetworkManager[1529]: <info> (wlan0): device state change: 7 -> 8 (reason 0)
Jun  3 00:23:29 host NetworkManager[1529]: <info> Policy set 'Auto default' (wlan0) as default for IPv4 routing and DNS.
Jun  3 00:23:29 host NetworkManager[1529]: <info> Activation (wlan0) successful, device activated.
Jun  3 00:23:29 host NetworkManager[1529]: <info> Activation (wlan0) Stage 5 of 5 (IP Configure Commit) complete.
Jun  3 00:23:29 host NetworkManager[1529]: <error> [1307053409.968902] [nm-device-ethernet.c:729] real_update_permanent_hw_address(): (usb0): unable to read permanent 
MAC address (error 0)
Jun  3 00:23:29 host NetworkManager[1529]: <info> (usb0): carrier is OFF
Jun  3 00:23:29 host NetworkManager[1529]: <info> (usb0): new Ethernet device (driver: 'cdc_ether' ifindex: 7)
Jun  3 00:23:29 host NetworkManager[1529]: <info> (usb0): exported as /org/freedesktop/NetworkManager/Devices/6
Jun  3 00:23:29 host NetworkManager[1529]: <info> (usb0): now managed
Jun  3 00:23:29 host NetworkManager[1529]: <info> (usb0): device state change: 1 -> 2 (reason 2)
Jun  3 00:23:29 host NetworkManager[1529]: <info> (usb0): bringing up device.
Jun  3 00:23:29 host NetworkManager[1529]: <info> (usb0): preparing device.
Jun  3 00:23:29 host NetworkManager[1529]: <info> (usb0): deactivating device (reason: 2).
Jun  3 00:23:29 host NetworkManager[1529]: <info> Added default wired connection 'Auto usb0' for /sys/devices/pci0000:00/0000:00:1d.7/usb2/2-6/2-6:1.7/net/usb0
Jun  3 00:23:29 host NetworkManager[1529]: <info> (usb0): carrier now ON (device state 2)
Jun  3 00:23:29 host NetworkManager[1529]: <info> (usb0): device state change: 2 -> 3 (reason 40)
Jun  3 00:23:29 host NetworkManager[1529]: <info> (usb0): carrier now OFF (device state 3)
Jun  3 00:23:29 host NetworkManager[1529]: <info> (usb0): device state change: 3 -> 2 (reason 40)
Jun  3 00:23:29 host NetworkManager[1529]: <info> (usb0): deactivating device (reason: 40).
Jun  3 00:23:30 host NetworkManager[1529]: <info> Policy set 'Auto default' (wlan0) as default for IPv4 routing and DNS.
Jun  3 00:23:30 host NetworkManager[1529]: <info> Policy set 'Auto default' (wlan0) as default for IPv4 routing and DNS.
Jun  3 00:23:30 host NetworkManager[1529]: <info> Connection 'Auto usb0' auto-activation failed: (2) Device not managed by NetworkManager
Jun  3 00:23:30 host ntpd[21394]: ntpd exiting on signal 15
Jun  3 00:23:30 host ntpd_initres[21397]: parent died before we finished, exiting
Jun  3 00:23:30 host ntpd[21608]: ntpd 4.2.4p8 Wed Nov 24 19:02:17 UTC 2010 (1)
Jun  3 00:23:30 host ntpd[21609]: precision = 1.117 usec
Jun  3 00:23:30 host ntpd[21609]: Listening on interface #0 wildcard, 0.0.0.0#123 Disabled
Jun  3 00:23:30 host ntpd[21609]: Listening on interface #1 wildcard, ::#123 Disabled
Jun  3 00:23:30 host ntpd[21609]: Listening on interface #2 lo, ::1#123 Enabled
Jun  3 00:23:30 host ntpd[21609]: Listening on interface #3 wlan0, fe80::224:d6ff:fe83:bbc2#123 Enabled
Jun  3 00:23:30 host ntpd[21609]: Listening on interface #4 lo, 127.0.0.1#123 Enabled
Jun  3 00:23:30 host ntpd[21609]: Listening on interface #5 wlan0, 192.168.0.10#123 Enabled
Jun  3 00:23:30 host ntpd[21609]: Listening on routing socket on fd #22 for interface updates
Jun  3 00:23:30 host ntpd[21609]: kernel time sync status 2040
Jun  3 00:23:30 host ntpd[21609]: frequency initialized 0.711 PPM from /var/lib/ntp/drift
Jun  3 00:23:31 host setroubleshoot: Your system may be seriously compromised! /usr/sbin/wpa_supplicant (deleted) tried to load a kernel module. For complete SELinux messages. run sealert -l abe18b46-f4f7-46b4-bcd4-be8ed703073e

Comment 3 Jacob Hunt 2011-06-03 17:50:25 UTC
This issue happens with this kernel:
kernel-2.6.32-71.29.1.el6.x86_64
If you revert back to the following kernel, the issue disappears:
kernel-2.6.32-71.18.2.el6.x86_64

Comment 4 Daniel Walsh 2011-06-03 20:37:54 UTC
Yes we have to hack in some dontaudits because the kernel/userspace has never been fixed.

This looks like the latest policy has the fix.

selinux-policy-3.7.19-96.el6

Comment 10 errata-xmlrpc 2011-12-06 10:08:17 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1511.html


Note You need to log in before you can comment on or make changes to this bug.