Bug 901945

I am adding setcap/getcap.

type=AVC msg=audit(1358658647.556:16): avc:  denied  { write } for  pid=1239 comm="syslog-ng" path="anon_inode:[eventfd]" dev=anon_inodefs ino=4019 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:anon_inodefs_t:s0 tclass=file
type=SYSCALL msg=audit(1358658647.556:16): arch=c000003e syscall=1 success=yes exit=8 a0=6 a1=7fff1a464128 a2=8 a3=1 items=0 ppid=1238 pid=1239 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="syslog-ng" exe="/sbin/syslog-ng" subj=system_u:system_r:syslogd_t:s0 key=(null)

type=AVC msg=audit(1358658647.556:17): avc:  denied  { read } for  pid=1239 comm="syslog-ng" path="anon_inode:[eventfd]" dev=anon_inodefs ino=4019 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:anon_inodefs_t:s0 tclass=file
type=SYSCALL msg=audit(1358658647.556:17): arch=c000003e syscall=0 success=yes exit=8 a0=6 a1=7fff1a464140 a2=8 a3=25f3 items=0 ppid=1238 pid=1239 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="syslog-ng" exe="/sbin/syslog-ng" subj=system_u:system_r:syslogd_t:s0 key=(null)

looks like a leak.

Did you get in enforcing mode?

(In reply to comment #2)
> I am adding setcap/getcap.

Thanks!

> type=AVC msg=audit(1358658647.556:16): avc:  denied  { write } for  pid=1239
> comm="syslog-ng" path="anon_inode:[eventfd]" dev=anon_inodefs ino=4019
> scontext=system_u:system_r:syslogd_t:s0
> tcontext=system_u:object_r:anon_inodefs_t:s0 tclass=file
> type=SYSCALL msg=audit(1358658647.556:16): arch=c000003e syscall=1
> success=yes exit=8 a0=6 a1=7fff1a464128 a2=8 a3=1 items=0 ppid=1238 pid=1239
> auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
> tty=(none) ses=4294967295 comm="syslog-ng" exe="/sbin/syslog-ng"
> subj=system_u:system_r:syslogd_t:s0 key=(null)
> 
> type=AVC msg=audit(1358658647.556:17): avc:  denied  { read } for  pid=1239
> comm="syslog-ng" path="anon_inode:[eventfd]" dev=anon_inodefs ino=4019
> scontext=system_u:system_r:syslogd_t:s0
> tcontext=system_u:object_r:anon_inodefs_t:s0 tclass=file
> type=SYSCALL msg=audit(1358658647.556:17): arch=c000003e syscall=0
> success=yes exit=8 a0=6 a1=7fff1a464140 a2=8 a3=25f3 items=0 ppid=1238
> pid=1239 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
> fsgid=0 tty=(none) ses=4294967295 comm="syslog-ng" exe="/sbin/syslog-ng"
> subj=system_u:system_r:syslogd_t:s0 key=(null)
> 
> looks like a leak.
> 
> Did you get in enforcing mode?

I'm running the system in permissive mode: syslog-ng stops logging messages
if I change the selinux policy to enforcing mode (echo 1 > /selinux/enforce).


/jpo

If you add the following local policy

# cat mypol.te
policy_module(mypol,1.0)

require{
 type syslogd_t;
}

allow syslogd_t self:process { getcap setcap };




and then execute

# make -f /usr/share/selinux/devel/Makefile mypol.pp
# semodule -i mypol.pp

Does it work then?

I'm no longer get the setcap/getcap violations with the above policy.

[selinux policy in enforcing mode]
But syslog-ng, although it is running, isn't able of writing the log messages
to their destinations (tailing /var/log/messages). When I do a "setenforce permissive" and restart syslog-ng, it writes the buffered kernel messages.

/jpo

Sounds like a labeling issue.

restorecon -R -v /var/log

Also make sure syslog-ng is running as syslogd_t.

ps -eZ | grep syslog

Finally check if there are any new AVC messages.

(In reply to comment #6)
> Sounds like a labeling issue.
> 
> restorecon -R -v /var/log
> 
> Also make sure syslog-ng is running as syslogd_t.
> 
> ps -eZ | grep syslog
> 
> Finally check if there are any new AVC messages.


Still no luck 

# restorecon -R -v /var/log

# cat /selinux/enforce 
1

# ps -eZ | grep syslog
system_u:system_r:syslogd_t:s0   1299 ?        00:00:00 syslog-ng
system_u:system_r:syslogd_t:s0   1300 ?        00:00:00 syslog-ng

No new syslog related messages in audit.log. Just this one:
---------
type=AVC msg=audit(1358904543.846:10): avc:  denied  { write } for  pid=1300 comm="syslog-ng" path="anon_inode:[eventfd]" dev=anon_inodefs ino=4019 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:anon_inodefs_t:s0 tclass=file
type=SYSCALL msg=audit(1358904543.846:10): arch=c000003e syscall=1 success=no exit=-13 a0=6 a1=7fff2e5a9128 a2=8 a3=1 items=0 ppid=1299 pid=1300 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="syslog-ng" exe="/sbin/syslog-ng" subj=system_u:system_r:syslogd_t:s0 key=(null)
--------



syslog-ng 3.3+ uses a new support library for asynchronous I/O notification (ivykis). strace -p syslog_ng_pid shows the following syscall being made (selinux permissive mode):

      epoll_wait(3, ...

Don't know if this helps...

/jpo

Ok, please re-test it with


# cat mypol.te
policy_module(mypol,1.0)

require{
 type syslogd_t;
 type anon_inodefs_t;
}

allow syslogd_t self:process { getcap setcap };
allow syslogd_t anon_inodefs_t:file { write read };

(In reply to comment #8)
> Ok, please re-test it with
> 
> 
> # cat mypol.te
> policy_module(mypol,1.0)
> 
> require{
>  type syslogd_t;
>  type anon_inodefs_t;
> }
> 
> allow syslogd_t self:process { getcap setcap };
> allow syslogd_t anon_inodefs_t:file { write read };

syslog-ng now operates correctly under selinux enforcing mode (and no syslog-ng related messages in audit.log).

Thanks,
jpo

This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.

This ticket can be closed (I don't have permissions to close it).

syslog-ng 3.3.8 works fine in a freshly installed CentOS 6.4 x86_64 system with selinux-policy-3.7.19-195.el6_4.5.noarch.