Bug 851064 - ptrace AVC denial for freeradius2
ptrace AVC denial for freeradius2
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy (Show other bugs)
All Linux
medium Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
Milos Malik
Depends On:
  Show dependency treegraph
Reported: 2012-08-23 03:50 EDT by Patrik Kis
Modified: 2013-06-11 05:11 EDT (History)
2 users (show)

See Also:
Fixed In Version: selinux-policy-2.4.6-332.el5
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2013-01-07 22:34:02 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Patrik Kis 2012-08-23 03:50:06 EDT
Description of problem:
When running the test /CoreOS/freeradius/Regression/bz658508-etc-pam-d-radiusd-uses-non-existent-password-auth the following AVC appear when a radius request is sent to radiusd which suppose to authenticate the user via PAM and shadow password. The radiusd is running as user root and is started via services.

type=SYSCALL msg=audit(1345707162.451:5302): arch=c000003e syscall=89 success=no exit=-13 a0=2aae74bc918e a1=433447c0 a2=1000 a3=44d items=0 ppid=1 pid=18258 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=541 comm="radiusd" exe="/usr/sbin/radiusd" subj=root:system_r:radiusd_t:s0 key=(null)
type=AVC msg=audit(1345707162.451:5302): avc:  denied  { ptrace } for  pid=18258 comm="radiusd" scontext=root:system_r:radiusd_t:s0 tcontext=root:system_r:radiusd_t:s0 tclass=process

Switching the boolean "allow_ptrace" on does not have any effect, the same AVC appear.

Version-Release number of selected component (if applicable):

There are the same result also with older version on selinux-policy.

On RHEL6 the same test does work out of the box.

How reproducible:

Steps to Reproduce:
1. Run test /CoreOS/freeradius/Regression/bz658508-etc-pam-d-radiusd-uses-non-existent-password-auth
2. Check the AVCs
Actual results:

Expected results:
Comment 1 RHEL Product and Program Management 2012-08-23 03:58:53 EDT
This request was evaluated by Red Hat Product Management for inclusion
in a Red Hat Enterprise Linux release.  Product Management has
requested further review of this request by Red Hat Engineering, for
potential inclusion in a Red Hat Enterprise Linux release for currently
deployed products.  This request is not yet committed for inclusion in
a release.
Comment 2 Milos Malik 2012-08-23 05:05:25 EDT
This is the only AVC that appears in permissive mode:
time->Thu Aug 23 11:03:35 2012
type=PATH msg=audit(1345712615.872:290): item=0 name="/proc/self/exe" inode=417529864 dev=00:03 mode=0120777 ouid=0 ogid=0 rdev=00:00 obj=root:system_r:radiusd_t:s0
type=CWD msg=audit(1345712615.872:290):  cwd="/"
type=SYSCALL msg=audit(1345712615.872:290): arch=40000003 syscall=85 success=yes exit=17 a0=a6deae a1=b571dbe7 a2=1000 a3=0 items=1 ppid=1 pid=6376 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=21 comm="radiusd" exe="/usr/sbin/radiusd" subj=root:system_r:radiusd_t:s0 key=(null)
type=AVC msg=audit(1345712615.872:290): avc:  denied  { ptrace } for  pid=6376 comm="radiusd" scontext=root:system_r:radiusd_t:s0 tcontext=root:system_r:radiusd_t:s0 tclass=process
Comment 6 errata-xmlrpc 2013-01-07 22:34:02 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.