Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: SELinux is preventing /usr/bin/ps from 'search' accesses on the directory /var/log/gdm. ***** Plugin catchall (100. confidence) suggests *************************** If vous pensez que ps devrait être autorisé à accéder search sur gdm directory par défaut. Then vous devriez rapporter ceci en tant qu'anomalie. Vous pouvez générer un module de stratégie local pour autoriser cet accès. Do autoriser cet accès pour le moment en exécutant : # grep ps /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:mdadm_t:s0-s0:c0.c1023 Target Context system_u:object_r:xserver_log_t:s0 Target Objects /var/log/gdm [ dir ] Source ps Source Path /usr/bin/ps Port <Unknown> Host (removed) Source RPM Packages procps-ng-3.3.6-2.fc19.x86_64 Target RPM Packages gdm-3.7.3.1-1.fc19.x86_64 Policy RPM selinux-policy-3.12.1-3.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.8.0-0.rc3.git0.1.fc19.x86_64 #1 SMP Thu Jan 10 21:09:08 UTC 2013 x86_64 x86_64 Alert Count 2 First Seen 2013-01-13 01:00:08 CET Last Seen 2013-01-13 01:00:14 CET Local ID be750977-b527-440d-aa01-84e5eac500f8 Raw Audit Messages type=AVC msg=audit(1358035214.493:8279): avc: denied { search } for pid=16572 comm="ps" name="gdm" dev="dm-0" ino=3025903 scontext=system_u:system_r:mdadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xserver_log_t:s0 tclass=dir type=SYSCALL msg=audit(1358035214.493:8279): arch=x86_64 syscall=stat success=no exit=EACCES a0=328c6103e0 a1=7fff8e6bc760 a2=7fff8e6bc760 a3=4 items=0 ppid=16571 pid=16572 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=224 tty=(none) comm=ps exe=/usr/bin/ps subj=system_u:system_r:mdadm_t:s0-s0:c0.c1023 key=(null) Hash: ps,mdadm_t,xserver_log_t,dir,search audit2allow #============= mdadm_t ============== allow mdadm_t xserver_log_t:dir search; audit2allow -R #============= mdadm_t ============== allow mdadm_t xserver_log_t:dir search; Additional info: hashmarkername: setroubleshoot kernel: 3.8.0-0.rc3.git0.1.fc19.x86_64 type: libreport
Why would ps be searching /var/log/gdm?
This bug appears to have been reported against 'rawhide' during the Fedora 19 development cycle. Changing version to '19'. (As we did not run this process for some time, it could affect also pre-Fedora 19 development cycle bugs. We are very sorry. It will help us with cleanup during Fedora 19 End Of Life. Thank you.) More information and reason for this action is here: https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora19
Description of problem: Alert raised by system while AFK. Additional info: reporter: libreport-2.1.4 hashmarkername: setroubleshoot kernel: 3.9.1-301.fc19.x86_64 type: libreport
deesto you seeing the same problem? Could you attach your AVC's
Description of problem: This seems to happen when md checks arrays. Additional info: reporter: libreport-2.1.5 hashmarkername: setroubleshoot kernel: 3.9.9-301.fc19.x86_64 type: libreport
Still seeing this, and agreed that arrays seem to be affected: ---- time->Sun Jul 7 01:00:19 2013 type=SYSCALL msg=audit(1373173219.895:8842): arch=c000003e syscall=4 success=no exit=-13 a0=378dc11400 a1=7fff0112f290 a2=7fff0112f290 a3=4 items=0 ppid=18454 pid=18455 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=923 tty=(none) comm="ps" exe="/usr/bin/ps" subj=system_u:system_r:mdadm_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1373173219.895:8842): avc: denied { search } for pid=18455 comm="ps" name="gdm" dev="md1" ino=9963241 scontext=system_u:system_r:mdadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xserver_log_t:s0 tclass=dir ---- time->Sun Jul 7 01:00:25 2013 type=SYSCALL msg=audit(1373173225.911:8843): arch=c000003e syscall=4 success=no exit=-13 a0=378dc11400 a1=7fffa0c74270 a2=7fffa0c74270 a3=4 items=0 ppid=18477 pid=18478 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=923 tty=(none) comm="ps" exe="/usr/bin/ps" subj=system_u:system_r:mdadm_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1373173225.911:8843): avc: denied { search } for pid=18478 comm="ps" name="gdm" dev="md1" ino=9963241 scontext=system_u:system_r:mdadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xserver_log_t:s0 tclass=dir ----
b6af0801660231786f18fbaa94afa4a449cd40e7 and e6d10a9c5d4fb85591db80a8963a8532489e4ce4 dontaudit this in git. No idea why it is doing this.
selinux-policy-3.12.1-63.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-63.fc19
Package selinux-policy-3.12.1-63.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-63.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-12762/selinux-policy-3.12.1-63.fc19 then log in and leave karma (feedback).
selinux-policy-3.12.1-63.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.