Description of problem: compiled and ran mit-scheme from the website, on first run, this se-linux prompt appeared. Additional info: libreport version: 2.0.18 kernel: 3.6.2-4.fc17.i686 description: :SELinux is preventing /usr/local/bin/mit-scheme-i386 from 'mmap_zero' accesses on the memprotect . : :***** Plugin mmap_zero (53.1 confidence) suggests ************************** : :If you do not think /usr/local/bin/mit-scheme-i386 should need to mmap low memory in the kernel. :Then you may be under attack by a hacker, this is a very dangerous access. :Do :contact your security administrator and report this issue. : :***** Plugin catchall_boolean (42.6 confidence) suggests ******************* : :If you want to mmap_low_allowed :Then you must tell SELinux about this by enabling the 'mmap_low_allowed' boolean.You can read 'unconfined_selinux' man page for more details. :Do :setsebool -P mmap_low_allowed 1 : :***** Plugin catchall (5.76 confidence) suggests *************************** : :If you believe that mit-scheme-i386 should be allowed mmap_zero access on the memprotect by default. :Then you should report this as a bug. :You can generate a local policy module to allow this access. :Do :allow this access for now by executing: :# grep scheme /var/log/audit/audit.log | audit2allow -M mypol :# semodule -i mypol.pp : :Additional Information: :Source Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 : 023 :Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 : 023 :Target Objects [ memprotect ] :Source scheme :Source Path /usr/local/bin/mit-scheme-i386 :Port <Unknown> :Host (removed) :Source RPM Packages :Target RPM Packages :Policy RPM selinux-policy-3.10.0-156.fc17.noarch :Selinux Enabled True :Policy Type targeted :Enforcing Mode Enforcing :Host Name (removed) :Platform Linux (removed) 3.6.2-4.fc17.i686 #1 SMP Wed Oct : 17 03:22:23 UTC 2012 i686 i686 :Alert Count 1 :First Seen 2012-11-03 21:50:22 CDT :Last Seen 2012-11-03 21:50:22 CDT :Local ID 7ae1f303-f501-49e1-a57a-14bef88df01c : :Raw Audit Messages :type=AVC msg=audit(1351997422.78:305): avc: denied { mmap_zero } for pid=1412 comm="scheme" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect : : :type=SYSCALL msg=audit(1351997422.78:305): arch=i386 syscall=mmap2 success=no exit=EACCES a0=1000 a1=1d0f000 a2=7 a3=32 items=0 ppid=25097 pid=1412 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=2 comm=scheme exe=/usr/local/bin/mit-scheme-i386 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) : :Hash: scheme,unconfined_t,unconfined_t,memprotect,mmap_zero : :audit2allow : :#============= unconfined_t ============== :#!!!! This avc can be allowed using the boolean 'mmap_low_allowed' : :allow unconfined_t self:memprotect mmap_zero; : :audit2allow -R : :#============= unconfined_t ============== :#!!!! This avc can be allowed using the boolean 'mmap_low_allowed' : :allow unconfined_t self:memprotect mmap_zero; :
Created attachment 637868 [details] File: type
Created attachment 637869 [details] File: hashmarkername
This is pretty dangerous access. If an apps does not work without this you will need to do what sealert suggests to you. # setsebool -P mmap_low_allowed 1