Bug 726339 - denied sys_module for /sbin/ip capability
Summary: denied sys_module for /sbin/ip capability
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.1
Hardware: All
OS: Linux
medium
low
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
: 727491 733419 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-07-28 10:16 UTC by Eduard Benes
Modified: 2016-07-13 11:06 UTC (History)
4 users (show)

Fixed In Version: selinux-policy-3.7.19-106.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-12-06 10:10:00 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2011:1511 0 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2011-12-06 00:39:17 UTC

Description Eduard Benes 2011-07-28 10:16:28 UTC
After running one of audit-tests for testing PCI Passthrough (iommu -> pci_passthrough sanity_detach_1) there are following AVC recorded in the final report. I guess it could be either allowed it or dontaudited it? The test fails to detach a network device. This is not always reproducible and also the tested functionality does not seems be affected either.

----
type=SYSCALL msg=audit(07/28/2011 05:45:38.040:109451) : arch=x86_64 syscall=ioctl success=no exit=-19(No such device) a0=4 a1=8933 a2=7fffc073c420 a3=3bed126480 items=0 ppid=17810 pid=17833 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=ip exe=/sbin/ip subj=system_u:system_r:ifconfig_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(07/28/2011 05:45:38.040:109451) : avc:  denied  { sys_module } for  pid=17833 comm=ip capability=sys_module  scontext=system_u:system_r:ifconfig_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ifconfig_t:s0-s0:c0.c1023 tclass=capability 
----
type=SYSCALL msg=audit(07/28/2011 05:45:38.154:109452) : arch=x86_64 syscall=ioctl success=no exit=-19(No such device) a0=4 a1=8933 a2=7fff491613b0 a3=3bed126480 items=0 ppid=17810 pid=17853 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=ip exe=/sbin/ip subj=system_u:system_r:ifconfig_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(07/28/2011 05:45:38.154:109452) : avc:  denied  { sys_module } for  pid=17853 comm=ip capability=sys_module  scontext=system_u:system_r:ifconfig_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ifconfig_t:s0-s0:c0.c1023 tclass=capability

Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-93.el6.noarch
qemu-kvm-0.12.1.2-2.165.el6.bz720972v1.x86_64

Comment 1 Miroslav Grepl 2011-07-28 11:48:01 UTC
I will add

 # caused by some bogus kernel code
    dontaudit ifconfig_t self:capability sys_module;

from Fedora.

Comment 2 Daniel Walsh 2011-07-29 13:56:23 UTC
yup

Comment 3 Miroslav Grepl 2011-08-01 12:59:04 UTC
Fixed in selinux-policy-3.7.19-106.el6

Comment 4 Miroslav Grepl 2011-08-02 11:30:38 UTC
*** Bug 727491 has been marked as a duplicate of this bug. ***

Comment 7 Karel Srot 2011-08-26 13:53:55 UTC
*** Bug 733419 has been marked as a duplicate of this bug. ***

Comment 9 errata-xmlrpc 2011-12-06 10:10:00 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1511.html


Note You need to log in before you can comment on or make changes to this bug.