Bug 801606 - (selinux_ptrace) SELinux is preventing /usr/bin/gdb from using the 'ptrace' accesses on a process.
SELinux is preventing /usr/bin/gdb from using the 'ptrace' accesses on a proc...
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2012-03-08 18:36 EST by Barry Godusky
Modified: 2012-08-13 10:38 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-03-09 09:49:29 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Barry Godusky 2012-03-08 18:36:24 EST
libreport version: 2.0.8
executable:     /usr/bin/python
hashmarkername: setroubleshoot
kernel:         3.3.0-0.rc6.git0.2.fc17.x86_64
reason:         SELinux is preventing /usr/bin/gdb from using the 'ptrace' accesses on a process.
time:           Thu 08 Mar 2012 06:36:03 PM EST

:SELinux is preventing /usr/bin/gdb from using the 'ptrace' accesses on a process.
:*****  Plugin catchall_boolean (89.3 confidence) suggests  *******************
:If you want to deny_ptrace
:Then you must tell SELinux about this by enabling the 'deny_ptrace'boolean.
:setsebool -P deny_ptrace 0
:*****  Plugin catchall (11.6 confidence) suggests  ***************************
:If you believe that gdb should be allowed ptrace access on processes labeled unconfined_t by default.
:Then you should report this as a bug.
:You can generate a local policy module to allow this access.
:allow this access for now by executing:
:# grep gdb /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:Additional Information:
:Source Context                unconfined_u:unconfined_r:unconfined_t:s0
:Target Context                unconfined_u:unconfined_r:unconfined_t:s0
:Target Objects                 [ process ]
:Source                        gdb
:Source Path                   /usr/bin/gdb
:Port                          <Unknown>
:Host                          (removed)
:Source RPM Packages           gdb-
:Target RPM Packages           
:Policy RPM                    selinux-policy-3.10.0-95.fc17.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed)
:                              3.3.0-0.rc6.git0.2.fc17.x86_64 #1 SMP Mon Mar 5
:                              16:54:07 UTC 2012 x86_64 x86_64
:Alert Count                   3
:First Seen                    Thu 08 Mar 2012 05:41:08 PM EST
:Last Seen                     Thu 08 Mar 2012 06:34:46 PM EST
:Local ID                      059d38cb-3358-4d7c-9682-e9104aeda79e
:Raw Audit Messages
:type=AVC msg=audit(1331249686.474:3312): avc:  denied  { ptrace } for  pid=29218 comm="gdb" scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process
:type=SYSCALL msg=audit(1331249686.474:3312): arch=x86_64 syscall=ptrace success=no exit=EACCES a0=10 a1=5d84 a2=0 a3=0 items=0 ppid=25154 pid=29218 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm=gdb exe=/usr/bin/gdb subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null)
:Hash: gdb,unconfined_t,unconfined_t,process,ptrace
:audit2allowunable to open /sys/fs/selinux/policy:  Permission denied
:audit2allow -Runable to open /sys/fs/selinux/policy:  Permission denied
Comment 1 Daniel Walsh 2012-03-09 09:49:29 EST
The alert tells you what to do, We have a bugzilla open on gdb to tell you this also, and hope to get a change into the kernel where

gdb EXEC 

Is legal and

gdb -P PID 

Is illegal with the boolean turned on.
Comment 2 Mikhail 2012-08-04 07:54:58 EDT
Why this alert happens? I have such alert,
Comment 3 Mikhail 2012-08-05 09:47:08 EDT
Recently, I have this alert several times a day. This did not exist before. what happens?
Comment 4 Mikhail 2012-08-05 09:57:10 EDT
I have Fedora 17 installed on four computers, this alert appears only on one.
Comment 5 Daniel Walsh 2012-08-06 10:39:30 EDT
MikHail what AVC's are you seeing?  What is the setting of deny_ptrace

getsebool deny_ptrace
Comment 6 Mikhail 2012-08-06 14:48:14 EDT
$ getsebool deny_ptrace
deny_ptrace --> on
Comment 7 Daniel Walsh 2012-08-13 10:38:28 EDT
So if you want to allow this you would have to turn off the deny_ptrace.

Note You need to log in before you can comment on or make changes to this bug.