Bug 912471 - SELinux is preventing wine-preloader from 'mmap_zero' accesses on the memprotect .
Summary: SELinux is preventing wine-preloader from 'mmap_zero' accesses on the memprot...
Keywords:
Status: CLOSED DUPLICATE of bug 912175
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 18
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:a39935949b5a137b9a65999862d...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-02-18 18:25 UTC by mrblack
Modified: 2013-02-19 09:53 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-02-19 09:53:20 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description mrblack 2013-02-18 18:25:16 UTC
Description of problem:
SELinux is preventing wine-preloader from 'mmap_zero' accesses on the memprotect .

*****  Plugin mmap_zero (53.1 confidence) suggests  **************************

If vous pensez que wine-preloader ne devrait pas effectuer de projection en mémoire (« mmap ») de la mémoire basse dans le noyau.
Then vous pourriez être victime d'une attaque d'un pirate, cet accès est très dangereux.
Do
veuillez contacter l'administrateur de sécurité et rapporter ce problème.

*****  Plugin catchall_boolean (42.6 confidence) suggests  *******************

If vous souhaitez control the ability to mmap a low area of the address space, as configured by /proc/sys/kernel/mmap_min_addr.
Then you must tell SELinux about this by enabling the 'mmap_low_allowed' boolean.
You can read 'initrc_selinux' man page for more details.
Do
setsebool -P mmap_low_allowed 1

*****  Plugin catchall (5.76 confidence) suggests  ***************************

If vous pensez que wine-preloader devrait être autorisé à accéder mmap_zero sur  memprotect par défaut.
Then vous devriez rapporter ceci en tant qu'anomalie.
Vous pouvez générer un module de stratégie local pour autoriser cet accès.
Do
autoriser cet accès pour le moment en exécutant :
# grep wine-preloader /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:initrc_t:s0
Target Context                system_u:system_r:initrc_t:s0
Target Objects                 [ memprotect ]
Source                        wine-preloader
Source Path                   wine-preloader
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.11.1-76.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.7.7-201.fc18.x86_64 #1 SMP Tue
                              Feb 12 22:35:01 UTC 2013 x86_64 x86_64
Alert Count                   1
First Seen                    2013-02-18 19:21:49 CET
Last Seen                     2013-02-18 19:21:49 CET
Local ID                      5cd24a90-7866-43fe-a84a-244bcea4500b

Raw Audit Messages
type=AVC msg=audit(1361211709.223:332): avc:  denied  { mmap_zero } for  pid=1415 comm="wine-preloader" scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=memprotect


Hash: wine-preloader,initrc_t,initrc_t,memprotect,mmap_zero

audit2allow

#============= initrc_t ==============
#!!!! This avc can be allowed using the boolean 'mmap_low_allowed'

allow initrc_t self:memprotect mmap_zero;

audit2allow -R

#============= initrc_t ==============
#!!!! This avc can be allowed using the boolean 'mmap_low_allowed'

allow initrc_t self:memprotect mmap_zero;


Additional info:
hashmarkername: setroubleshoot
kernel:         3.7.7-201.fc18.x86_64
type:           libreport

Potential duplicate: bug 912175

Comment 1 Miroslav Grepl 2013-02-19 09:53:20 UTC

*** This bug has been marked as a duplicate of bug 912175 ***


Note You need to log in before you can comment on or make changes to this bug.