Hide Forgot
This is occuring on RHEL 6.2. SELinux is preventing /usr/bin/gok from read access on the directory /var/cvs. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that gok should be allowed read access on the cvs directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep gok /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp +++ This bug was initially created as a clone of Bug #697207 +++ Created attachment 492629 [details] sudo sealert -l 82c72044-db37-4c34-b62c-0fd3f2ca4205 Description of problem: gok seems to need access to some places that selinux doesn't expect Version-Release number of selected component (if applicable): $ rpm -q -f /usr/bin/gok gok-2.30.1-1.fc14.i686 How reproducible: very Steps to Reproduce: 1. reboot 2. start up gok (accessibility, on screen keyboard) 3. see messages in /var/log/messages Actual results: messages ... shown Expected results: no messages Additional info: from /var/log/messages Apr 16 13:33:36 pert setroubleshoot: SELinux is preventing /usr/bin/gok from rea d access on the directory /var/games. For complete SELinux messages. run sealert -l 384cb886-46a9-4cf7-92d2-d72d9e72ee32 Apr 16 13:33:36 pert setroubleshoot: SELinux is preventing /usr/bin/gok from read access on the directory /var/yp. For complete SELinux messages. run sealert -l 237e8dae-b133-4c66-9c96-54e78f8b1934 Apr 16 13:33:37 pert setroubleshoot: SELinux is preventing /usr/bin/gok from read access on the directory /var/www. For complete SELinux messages. run sealert -l 25cfa985-f3d7-4be3-b4ab-4bfc126b7e7b Apr 16 13:33:37 pert setroubleshoot: SELinux is preventing /usr/bin/gok from read access on the directory /var/racoon. For complete SELinux messages. run sealert -l 82c72044-db37-4c34-b62c-0fd3f2ca4205 Apr 16 13:33:48 pert setroubleshoot: SELinux is preventing /usr/bin/gok from read access on the directory /var/games. For complete SELinux messages. run sealert -l 384cb886-46a9-4cf7-92d2-d72d9e72ee32 Apr 16 13:33:49 pert setroubleshoot: SELinux is preventing /usr/bin/gok from read access on the directory /var/yp. For complete SELinux messages. run sealert -l 237e8dae-b133-4c66-9c96-54e78f8b1934 Apr 16 13:33:49 pert setroubleshoot: SELinux is preventing /usr/bin/gok from read access on the directory /var/www. For complete SELinux messages. run sealert -l 25cfa985-f3d7-4be3-b4ab-4bfc126b7e7b Apr 16 13:33:50 pert setroubleshoot: SELinux is preventing /usr/bin/gok from read access on the directory /var/racoon. For complete SELinux messages. run sealert -l 82c72044-db37-4c34-b62c-0fd3f2ca4205 --- Additional comment from wendellcraigbaker on 2011-04-16 16:57:00 EDT --- Created attachment 492630 [details] sudo sealert -l 25cfa985-f3d7-4be3-b4ab-4bfc126b7e7b --- Additional comment from wendellcraigbaker on 2011-04-16 16:57:33 EDT --- Created attachment 492631 [details] sudo sealert -l 237e8dae-b133-4c66-9c96-54e78f8b1934 --- Additional comment from wendellcraigbaker on 2011-04-16 16:58:29 EDT --- Created attachment 492632 [details] sudo sealert -l 384cb886-46a9-4cf7-92d2-d72d9e72ee32
Can't really do anything about SELinux policy, sorry. Reassigning.
This was added to selinux-policy in Fedora already in this change entry: * Tue Dec 21 2010 Miroslav Grepl <mgrepl> 3.9.12-1 - Update to upstream - Fixes for systemd policy - Fixes for passenger policy - Allow staff users to run mysqld in the staff_t domain, akonadi needs this - Add bin_t label for /usr/share/kde4/apps/kajongg/kajongg.py - auth_use_nsswitch does not need avahi to read passwords,needed for resolving data - Dontaudit (xdm_t) gok attempting to list contents of /var/account - Telepathy domains need to read urand - Need interface to getattr all file classes in a mock library for setroubleshoot
Yes, we don't audit some gok accesses. But still this covers a behaviour so why gok is listing the contents of /var?
> Yes, we don't audit some gok accesses. But still this covers a behaviour so why > gok is listing the contents of /var? David, any update?
Created attachment 566069 [details] generated AVCs
Reproduced on my RHEL-6.3 virtual machine. # rpm -qa selinux-policy\* selinux-policy-3.7.19-137.el6.noarch selinux-policy-targeted-3.7.19-137.el6.noarch selinux-policy-minimum-3.7.19-137.el6.noarch selinux-policy-mls-3.7.19-137.el6.noarch selinux-policy-doc-3.7.19-137.el6.noarch # sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 24 Policy from config file: targeted # How to Reproduce: 1) boot into runlevel 5 2) switch to graphical screen where GDM is visible 3) open "Universal Access Preferences" window --> select "Use on-screen keyboard" --> click on "Close" 4) get rid of gok process 5) ausearch -m avc -m user_avc -m selinux_err -tc recent
So the gok command is going out and randomly listing lots of directories?
Looks like in Fedora we have allowed it to list all of these directories probably would have been better to dontaudit. files_dontaudit_list_non_security(xdm_t)
This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux.
Red Hat Enterprise Linux 6 is in the Production 3 Phase. During the Production 3 Phase, Critical impact Security Advisories (RHSAs) and selected Urgent Priority Bug Fix Advisories (RHBAs) may be released as they become available. The official life cycle policy can be reviewed here: http://redhat.com/rhel/lifecycle This issue does not meet the inclusion criteria for the Production 3 Phase and will be marked as CLOSED/WONTFIX. If this remains a critical requirement, please contact Red Hat Customer Support to request a re-evaluation of the issue, citing a clear business justification. Note that a strong business justification will be required for re-evaluation. Red Hat Customer Support can be contacted via the Red Hat Customer Portal at the following URL: https://access.redhat.com/