Bug 728756 - SELinux is preventing /sbin/consoletype from 'read' accesses on the file /proc/<pid>/net/dev.
Summary: SELinux is preventing /sbin/consoletype from 'read' accesses on the file /pro...
Keywords:
Status: CLOSED CANTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 15
Hardware: i386
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:57b782cbf47...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-08-07 08:35 UTC by Morris
Modified: 2011-08-11 15:56 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-08-11 15:56:44 UTC


Attachments (Terms of Use)

Description Morris 2011-08-07 08:35:05 UTC
SELinux is preventing /sbin/consoletype from 'read' accesses on the file /proc/<pid>/net/dev.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that consoletype should be allowed read access on the dev file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep consoletype /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:consoletype_t:s0
Target Context                system_u:object_r:proc_net_t:s0
Target Objects                /proc/<pid>/net/dev [ file ]
Source                        consoletype
Source Path                   /sbin/consoletype
Port                          <未知>
Host                          (removed)
Source RPM Packages           initscripts-9.30-2.fc15
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.16-37.fc15
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.40-4.fc15.i686.PAE #1
                              SMP Fri Jul 29 18:47:58 UTC 2011 i686 i686
Alert Count                   2
First Seen                    2011年08月07日 星期日 16时32分40秒
Last Seen                     2011年08月07日 星期日 16时32分41秒
Local ID                      8fea2b19-8e85-47ca-955f-963b04296a4f

Raw Audit Messages
type=AVC msg=audit(1312705961.240:56): avc:  denied  { read } for  pid=2307 comm="consoletype" path="/proc/1098/net/dev" dev=proc ino=4026531973 scontext=system_u:system_r:consoletype_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file


type=SYSCALL msg=audit(1312705961.240:56): arch=i386 syscall=execve success=yes exit=0 a0=99b0100 a1=99b5418 a2=99b1a38 a3=99b5418 items=0 ppid=2306 pid=2307 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=consoletype exe=/sbin/consoletype subj=system_u:system_r:consoletype_t:s0 key=(null)

Hash: consoletype,consoletype_t,proc_net_t,file,read

audit2allow

#============= consoletype_t ==============
allow consoletype_t proc_net_t:file read;

audit2allow -R

#============= consoletype_t ==============
allow consoletype_t proc_net_t:file read;

Comment 1 Miroslav Grepl 2011-08-08 06:34:13 UTC
Do you know what you were doing when this happened?

Comment 2 Daniel Walsh 2011-08-08 15:41:51 UTC
Looks like  aleak.

Comment 3 Morris 2011-08-10 13:07:26 UTC
(In reply to comment #1)
> Do you know what you were doing when this happened?

i'm not sure, but it happened not long after i updated to the "kernel-2.6.40" and installed a "H3C" client.

then it happened when i run the client.

Comment 4 Miroslav Grepl 2011-08-10 16:48:06 UTC
(In reply to comment #2)
> Looks like  aleak.

Yes, I also think.


What is H3C client?

Comment 5 Morris 2011-08-11 01:45:02 UTC
(In reply to comment #4)
> (In reply to comment #2)
> > Looks like  aleak.
> 
> Yes, I also think.
> 
> 
> What is H3C client?

but  after i have installed the "kernel3.0.1", nothing have happened


since i am a student in china, when i need to surf the internet i have to use something, then comes the "H3C client", a program used for authentication, which is most used in Windows.

Comment 6 Daniel Walsh 2011-08-11 13:46:55 UTC
So h3c is probably leaking an open file descriptor to proc_net_t.  You can safely load a policy to ignore this AVC

# grep consoletype /var/log/audit/audit.log | audit2allow -D -M myconsoletype
# semodule -I myconsoletype.pp


Should fix the problem.

Comment 7 Morris 2011-08-11 15:50:00 UTC
(In reply to comment #6)
> So h3c is probably leaking an open file descriptor to proc_net_t.  You can
> safely load a policy to ignore this AVC
> 
> # grep consoletype /var/log/audit/audit.log | audit2allow -D -M myconsoletype
> # semodule -I myconsoletype.pp
> 
> 
> Should fix the problem.

Thank you

now, the problem fixed

thank you all again for the help, and i think something more must be done before i report something next time.


Note You need to log in before you can comment on or make changes to this bug.