Description of problem: Don't know exact procedure to reproduce this. SELinux is preventing /usr/libexec/ibus-engine-kkc (deleted) from 'mmap_zero' accesses on the memprotect . ***** Plugin mmap_zero (53.1 confidence) suggests ************************** If /usr/libexec/ibus-engine-kkc (deleted) は kernel で low メモリにmmapする必要はありません。 Then ハッカーから攻撃されている可能性があります。これは非常に危険なアクセスです。 Do セキュリティ管理者にコンタクトし、この問題を報告してください。 ***** Plugin catchall_boolean (42.6 confidence) suggests ******************* If control the ability to mmap a low area of the address space, as configured by /proc/sys/kernel/mmap_min_addr. がしたい Then you must tell SELinux about this by enabling the 'mmap_low_allowed' boolean. 詳細情報については、'unconfined_selinux' man ページをご覧下さい。 Do setsebool -P mmap_low_allowed 1 ***** Plugin catchall (5.76 confidence) suggests *************************** If ibus-engine-kkc (deleted) に、 memprotect の mmap_zero アクセスがデフォルトで許可されるべきです。 Then バグとして報告してください。 ローカルのポリシーモジュールを生成すると、 このアクセスを許可することができます。 Do このアクセスを一時的に許可するには、以下を実行してください。: # grep ibus-engine-kkc /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects [ memprotect ] Source ibus-engine-kkc Source Path /usr/libexec/ibus-engine-kkc (deleted) Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.11.1-97.fc18.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.9.4-200.fc18.i686 #1 SMP Fri May 24 20:35:02 UTC 2013 i686 i686 Alert Count 3 First Seen 2013-05-13 15:44:20 JST Last Seen 2013-06-05 11:32:23 JST Local ID 1ae5e6df-7fad-4a0d-8a9e-7992ac991c39 Raw Audit Messages type=AVC msg=audit(1370399543.616:889): avc: denied { mmap_zero } for pid=4594 comm="ibus-engine-kkc" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect type=SYSCALL msg=audit(1370399543.616:889): arch=i386 syscall=mmap2 success=no exit=EACCES a0=0 a1=ca363 a2=1 a3=1 items=0 ppid=4339 pid=4594 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 ses=2 tty=(none) comm=ibus-engine-kkc exe=2F7573722F6C6962657865632F696275732D656E67696E652D6B6B63202864656C6574656429 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) Hash: ibus-engine-kkc,unconfined_t,unconfined_t,memprotect,mmap_zero audit2allow #============= unconfined_t ============== #!!!! This avc can be allowed using the boolean 'mmap_low_allowed' allow unconfined_t self:memprotect mmap_zero; audit2allow -R require { type unconfined_t; class memprotect mmap_zero; } #============= unconfined_t ============== #!!!! This avc can be allowed using the boolean 'mmap_low_allowed' allow unconfined_t self:memprotect mmap_zero; Additional info: reporter: libreport-2.1.4 hashmarkername: setroubleshoot kernel: 3.9.4-200.fc18.i686 type: libreport
Does the app work correctly? The alert tells you what to do.
Umm?? /usr/libexec/ibus-engine-kkc is in ibus-kkc-1.5.13-1.fc18 (i.e. Fedora's package), not some external one. So policy should be set by selinux-policy, not by myself, or ibus-kkc should be fixed. Reopening. Would you tell me why "I" should fix by myself?
THen this is a bug in ibus, it should not require this access.
*** This bug has been marked as a duplicate of bug 490753 ***