Bug 738415 - sendmail/logwatch/urandom denials
Summary: sendmail/logwatch/urandom denials
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 16
Hardware: All
OS: Linux
unspecified
low
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-09-14 18:14 UTC by Orion Poplawski
Modified: 2011-09-15 11:38 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-09-15 11:38:40 UTC


Attachments (Terms of Use)

Description Orion Poplawski 2011-09-14 18:14:03 UTC
Description of problem:

In permissive:
Sep 13 03:47:52 vmrawhide kernel: [409473.124718] type=1400 audit(1315907272.972:160): avc:  denied  { read } for  pid=28396 comm="sendmail" name="urandom" dev=devtmpfs ino=4301 scontext=system_u:system_r:logwatch_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file
Sep 13 03:47:52 vmrawhide kernel: [409473.132400] type=1400 audit(1315907272.980:161): avc:  denied  { open } for  pid=28396 comm="sendmail" name="urandom" dev=devtmpfs ino=4301 scontext=system_u:system_r:logwatch_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file
Sep 13 03:47:52 vmrawhide kernel: [409473.140130] type=1400 audit(1315907272.987:162): avc:  denied  { getattr } for  pid=28396 comm="sendmail" path="/dev/urandom" dev=devtmpfs ino=4301 scontext=system_u:system_r:logwatch_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file

in enforcing I just see the first one.  This is apparently from logwatch sending its email summary.

Version-Release number of selected component (if applicable):
selinux-policy-3.10.0-26.fc17.noarch

Comment 1 Miroslav Grepl 2011-09-15 11:38:40 UTC
Fixed in selinux-policy-3.10.0-29.fc17

I am also backporting to RHEL6, F15, F14.


Note You need to log in before you can comment on or make changes to this bug.