selinux February 2008

selinux@lists.fedoraproject.org

34 participants
61 discussions

firefox and selinux
by Antonio Olivares 12 Feb '08

12 Feb '08

Dear all, I have set settroubleshoot to allow the following: chcon -t unconfined_execmem_exec_t '/usr/lib/firefox-3.0b4pre/firefox' But it is happening again, I do not understand why I need to do it multiple of times. I see a pattern occuring: I have filed a bug report against firefox-b3 https://bugzilla.redhat.com/show_bug.cgi?id=432198 I hope that firefox and selinux start to work together and not against each other. :) Summary: SELinux is preventing firefox from making the program stack executable. Detailed Description: The firefox application attempted to make its stack executable. This is a potential security problem. This should never ever be necessary. Stack memory is not executable on most OSes these days and this will not change. Executable stack memory is one of the biggest security problems. An execstack error might in fact be most likely raised by malicious code. Applications are sometimes coded incorrectly and request this permission. The SELinux Memory Protection Tests (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to remove this requirement. If firefox does not work and you need it to work, you can configure SELinux temporarily to allow this access until the application is fixed. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Allowing Access: Sometimes a library is accidentally marked with the execstack flag, if you find a library with this flag you can clear it with the execstack -c LIBRARY_PATH. Then retry your application. If the app continues to not work, you can turn the flag back on with execstack -s LIBRARY_PATH. Otherwise, if you trust firefox to run correctly, you can change the context of the executable to unconfined_execmem_exec_t. "chcon -t unconfined_execmem_exec_t '/usr/lib/firefox-3.0b4pre/firefox'" You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t unconfined_execmem_exec_t '/usr/lib/firefox-3.0b4pre/firefox'" The following command will allow this access: chcon -t unconfined_execmem_exec_t '/usr/lib/firefox-3.0b4pre/firefox' Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Objects None [ process ] Source firefox Source Path /usr/lib/firefox-3.0b3pre/firefox Port <Unknown> Host localhost Source RPM Packages firefox-3.0-0.beta2.16.nightly20080206.fc9 Target RPM Packages Policy RPM selinux-policy-3.2.7-1.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name allow_execstack Host Name localhost Platform Linux localhost 2.6.24-23.fc9 #1 SMP Wed Feb 6 11:36:31 EST 2008 i686 athlon Alert Count 11 First Seen Fri 01 Feb 2008 05:08:54 PM CST Last Seen Sat 09 Feb 2008 12:35:06 PM CST Local ID c4806f30-a6dc-43b0-8901-5531075795f7 Line Numbers Raw Audit Messages host=localhost type=AVC msg=audit(1202582106.621:28): avc: denied { execstack } for pid=9246 comm="firefox" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process host=localhost type=SYSCALL msg=audit(1202582106.621:28): arch=40000003 syscall=125 success=no exit=-13 a0=bfa71000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=9232 pid=9246 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) comm="firefox" exe="/usr/lib/firefox-3.0b4pre/firefox" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) Regards, Antonio ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

2 1

SELinux is preventing ck-history (xdm_t) "search" to ./ConsoleKit (consolekit_var_run_t).
by Antonio Olivares 11 Feb '08

11 Feb '08

Dear all, Setroubleshoot showed me the following: Should I disregard them, or is ConsoleKit important to the system. Summary: SELinux is preventing ck-history (xdm_t) "search" to ./ConsoleKit (consolekit_var_run_t). Detailed Description: SELinux denied access requested by ck-history. It is not expected that this access is required by ck-history and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./ConsoleKit, restorecon -v './ConsoleKit' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:xdm_t:SystemLow-SystemHigh Target Context system_u:object_r:consolekit_var_run_t Target Objects ./ConsoleKit [ dir ] Source ck-history Source Path /usr/bin/ck-history Port <Unknown> Host localhost Source RPM Packages ConsoleKit-0.2.7-1.fc9 Target RPM Packages Policy RPM selinux-policy-3.2.7-1.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost Platform Linux localhost 2.6.24.1-28.fc9 #1 SMP Sun Feb 10 17:27:37 EST 2008 i686 athlon Alert Count 12 First Seen Mon 11 Feb 2008 07:05:42 AM CST Last Seen Mon 11 Feb 2008 02:35:06 PM CST Local ID 3cef7e4a-b1dc-4c27-83e3-91eccbb14047 Line Numbers Raw Audit Messages host=localhost type=AVC msg=audit(1202762106.60:13): avc: denied { search } for pid=2469 comm="ck-history" name="ConsoleKit" dev=dm-0 ino=3342348 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:consolekit_var_run_t:s0 tclass=dir host=localhost type=SYSCALL msg=audit(1202762106.60:13): arch=40000003 syscall=5 success=no exit=-13 a0=8fd3608 a1=0 a2=1b6 a3=0 items=0 ppid=1 pid=2469 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) comm="ck-history" exe="/usr/bin/ck-history" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) TIA, Antonio ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

1 0

selinux now causing trouble with seamonkey
by Antonio Olivares 11 Feb '08

11 Feb '08

Dear all, In addition to the bug filed https://bugzilla.redhat.com/show_bug.cgi?id=432198 selinux now is causing trouble with seamonkey. I deleted the ~/.mozilla/ directory and started from scratch. So the argument about the plugins will not work now :) Am I the only one seeing this? I feel kind of bad about complaining that selinux is doing this, but it did not happen before and now it does, both with firefox and with seamonkey. Here's the message Summary: SELinux is preventing seamonkey-bin from making the program stack executable. Detailed Description: The seamonkey-bin application attempted to make its stack executable. This is a potential security problem. This should never ever be necessary. Stack memory is not executable on most OSes these days and this will not change. Executable stack memory is one of the biggest security problems. An execstack error might in fact be most likely raised by malicious code. Applications are sometimes coded incorrectly and request this permission. The SELinux Memory Protection Tests (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to remove this requirement. If seamonkey-bin does not work and you need it to work, you can configure SELinux temporarily to allow this access until the application is fixed. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Allowing Access: Sometimes a library is accidentally marked with the execstack flag, if you find a library with this flag you can clear it with the execstack -c LIBRARY_PATH. Then retry your application. If the app continues to not work, you can turn the flag back on with execstack -s LIBRARY_PATH. Otherwise, if you trust seamonkey-bin to run correctly, you can change the context of the executable to unconfined_execmem_exec_t. "chcon -t unconfined_execmem_exec_t '/usr/lib/seamonkey-1.1.8/seamonkey-bin'" You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t unconfined_execmem_exec_t '/usr/lib/seamonkey-1.1.8/seamonkey-bin'" The following command will allow this access: chcon -t unconfined_execmem_exec_t '/usr/lib/seamonkey-1.1.8/seamonkey-bin' Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Objects None [ process ] Source firefox Source Path /usr/lib/firefox-3.0b3pre/firefox Port <Unknown> Host localhost Source RPM Packages seamonkey-1.1.8-3.fc9 Target RPM Packages Policy RPM selinux-policy-3.2.7-1.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name allow_execstack Host Name localhost Platform Linux localhost 2.6.24.1-28.fc9 #1 SMP Sun Feb 10 17:27:37 EST 2008 i686 athlon Alert Count 33 First Seen Fri 01 Feb 2008 05:08:54 PM CST Last Seen Mon 11 Feb 2008 06:39:47 PM CST Local ID c4806f30-a6dc-43b0-8901-5531075795f7 Line Numbers Raw Audit Messages host=localhost type=AVC msg=audit(1202776787.936:31): avc: denied { execstack } for pid=3481 comm="seamonkey-bin" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process host=localhost type=SYSCALL msg=audit(1202776787.936:31): arch=40000003 syscall=125 success=no exit=-13 a0=bff2d000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=1 pid=3481 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) comm="seamonkey-bin" exe="/usr/lib/seamonkey-1.1.8/seamonkey-bin" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

More consolekit_t and dbus_t AVCs (from today's Rawhide)
by Tom London 10 Feb '08

10 Feb '08

After doing today's rawhide thing, get this on targeted/enforcing boot/login: #============= system_dbusd_t ============== allow system_dbusd_t NetworkManager_t:dbus send_msg; allow system_dbusd_t unconfined_t:dbus send_msg; #============= xdm_t ============== allow xdm_t consolekit_var_run_t:dir search; [copy of /var/log/audit/audit.log attached.] tom -- Tom London

1 1

Re: host certificates & keys
by John Griffiths 10 Feb '08

10 Feb '08

1 0

host certificates & keys
by "Stanisław T. Findeisen" 08 Feb '08

08 Feb '08

Hello Are there any standard ways to add certificate and private key files to services like Postfix (SMTP) or Dovecot (POP3/IMAP) to enable them use TLS? STF

2 2

selinux/setroubleshoot reports trouble with nspluginscan, NetworkManager_t
by Antonio Olivares 06 Feb '08

06 Feb '08

Dear all, Upon applying todays updates rawhide report 20080205, and the failed update/conflicts \begin{QUOTE} xorg-x11-xinit-1.0.7-3.fc9.i386 from development has depsolving problems --> xorg-x11-xinit-1.0.7-3.fc9.i386 (development) conflicts with dbus < 1.1 .4-3.fc9 Error: xorg-x11-xinit-1.0.7-3.fc9.i386 (development) conflicts with dbus < 1. 1.4-3.fc9 \end{QUOTE} I get two denials from selinux Summary: SELinux is preventing nspluginscan from making the program stack executable. Detailed Description: The nspluginscan application attempted to make its stack executable. This is a potential security problem. This should never ever be necessary. Stack memory is not executable on most OSes these days and this will not change. Executable stack memory is one of the biggest security problems. An execstack error might in fact be most likely raised by malicious code. Applications are sometimes coded incorrectly and request this permission. The SELinux Memory Protection Tests (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to remove this requirement. If nspluginscan does not work and you need it to work, you can configure SELinux temporarily to allow this access until the application is fixed. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Allowing Access: Sometimes a library is accidentally marked with the execstack flag, if you find a library with this flag you can clear it with the execstack -c LIBRARY_PATH. Then retry your application. If the app continues to not work, you can turn the flag back on with execstack -s LIBRARY_PATH. Otherwise, if you trust nspluginscan to run correctly, you can change the context of the executable to unconfined_execmem_exec_t. "chcon -t unconfined_execmem_exec_t '/usr/bin/nspluginscan'" You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t unconfined_execmem_exec_t '/usr/bin/nspluginscan'" The following command will allow this access: chcon -t unconfined_execmem_exec_t '/usr/bin/nspluginscan' Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Objects None [ process ] Source nspluginscan Source Path /usr/bin/nspluginscan Port <Unknown> Host localhost.localdomain Source RPM Packages kdebase-4.0.1-3.fc9 Target RPM Packages Policy RPM selinux-policy-3.2.6-5.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name allow_execstack Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.24-17.fc9 #1 SMP Mon Feb 4 19:02:27 EST 2008 i686 i686 Alert Count 2 First Seen Tue 05 Feb 2008 07:13:02 AM CST Last Seen Tue 05 Feb 2008 07:41:42 PM CST Local ID 7afb3a36-5b69-486c-a93b-02e714040250 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1202262102.930:20): avc: denied { execstack } for pid=2866 comm="nspluginscan" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process host=localhost.localdomain type=SYSCALL msg=audit(1202262102.930:20): arch=40000003 syscall=125 success=no exit=-13 a0=bfce4000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=2855 pid=2866 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) comm="nspluginscan" exe="/usr/bin/nspluginscan" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing the 00-netreport (NetworkManager_t) from executing ./init. Detailed Description: SELinux has denied the 00-netreport from executing ./init. If 00-netreport is supposed to be able to execute ./init, this could be a labeling problem. Most confined domains are allowed to execute files labeled bin_t. So you could change the labeling on this file to bin_t and retry the application. If this 00-netreport is not supposed to execute ./init, this could signal a intrusion attempt. Allowing Access: If you want to allow 00-netreport to execute ./init: chcon -t bin_t './init' If this fix works, please update the file context on disk, with the following command: semanage fcontext -a -t bin_t './init' Please specify the full path to the executable, Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this selinux-policy to make sure this becomes the default labeling. Additional Information: Source Context system_u:system_r:NetworkManager_t Target Context system_u:object_r:etc_t Target Objects ./init [ file ] Source 00-netreport Source Path /bin/bash Port <Unknown> Host localhost.localdomain Source RPM Packages bash-3.2-20.fc9 Target RPM Packages Policy RPM selinux-policy-3.2.6-5.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name execute Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.24-17.fc9 #1 SMP Mon Feb 4 19:02:27 EST 2008 i686 i686 Alert Count 1 First Seen Tue 05 Feb 2008 07:42:33 PM CST Last Seen Tue 05 Feb 2008 07:42:33 PM CST Local ID 9a1f71bd-9256-450a-bc0c-a7ebb115cacb Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1202262153.640:107): avc: denied { execute } for pid=3226 comm="00-netreport" name="init" dev=dm-0 ino=360497 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file host=localhost.localdomain type=SYSCALL msg=audit(1202262153.640:107): arch=40000003 syscall=33 success=no exit=-13 a0=9f7a370 a1=1 a2=11 a3=9f7a370 items=0 ppid=2385 pid=3226 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="00-netreport" exe="/bin/bash" subj=system_u:system_r:NetworkManager_t:s0 key=(null) Thanks, Antonio ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

2 2

postgresql with httpd and dotclear
by Nicolas Chauvet 06 Feb '08

06 Feb '08

Hello ! I try to use apache and postgresql with the dotclear blog engine. When I try to enter the database information from the admin config wizard within the browser, have a selinux denial : audit(1202182131.382:34): avc: denied { name_connect } for pid=2604 comm="httpd" dest=5432 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:postgresql_port_t:s0 tclass=tcp_socket [root@haderach ~]# ls -Z /home/www/ drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 dotclear [root@haderach ~]# rpm -q sepostgresql sepostgresql-8.2.6-1.158.fc8 selinux-policy-3.0.8-81.fc8 selinux-policy-targeted-3.0.8-81.fc8 [root@haderach data]# semodule -l |grep postgre sepostgresql 1.158 On the other hand, when i try to use phpPgAdmin, it works. But i need to change: /var/lib/pgsql/data/pg_hba.conf from ident sameuser to md5.(tryed the same for dotclear without sucess). Also, from: http://code.google.com/p/sepgsql/wiki/install_memo_Fedora7 As i'm using F-8, i expect not to need the additional recompiled selinux-policy-2.6.4-38.sepgsql.fc7.noarch.rpm. (don't know if current F-7 users will still need it?) - At least the .sepsql doen't fit the same version number Any tips for this ? Nicolas (kwizart)

3 5

Re: Fedora 8 odds and sods
by Paul Howarth 06 Feb '08

06 Feb '08

On Thu, 17 Jan 2008 12:51:33 -0500 Daniel J Walsh <dwalsh(a)redhat.com> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Paul Howarth wrote: > > Today I've done a bit of a clean-up of the local policy modules > > I've had in use over the last couple of Fedora releases, removing > > bits that are no longer needed and consolidating the remaining ones > > into a single "localmisc" module. The results of this is: > > > > policy_module(localmisc, 0.1.34) > > > > require { > > attribute mailserver_delivery; > > type depmod_t; > > type httpd_t; > > type load_policy_t; > > type procmail_t; > > type procmail_tmp_t; > > type pptp_t; > > type restorecon_t; > > type sendmail_t; > > type setfiles_t; > > type soundd_port_t; > > type squid_t; > > type useradd_t; > > type var_t; > > }; > > > > # ======================================== > > # Things that probably need to go upstream > > # ======================================== > > > > # Milter sockets, why did this work before? > > #allow sendmail_t initrc_t:unix_stream_socket { read write > > connectto }; init_stream_connect_script(mailserver_delivery) > > init_rw_script_stream_sockets(mailserver_delivery) > > > Already added. > > # Allow misc command output to be sent to a pipe, needed for rpm > > scriptlets # Probably not needed since Fedora 8 > > #unconfined_rw_pipes(depmod_t) > > #unconfined_rw_pipes(load_policy_t) > > #unconfined_rw_pipes(setfiles_t) > > #unconfined_rw_pipes(useradd_t) > > > > # Allow pptp to manage its own processes > > allow pptp_t self:process signal; > > > Added. > > # Allow sendmail to read procmail tempfiles for forwarding > > # (would need a new interface in procmail.if to do this properly) > > allow sendmail_t procmail_tmp_t:file { read write getattr ioctl }; > > > Added Policy now has procmail_read_tmp_files(sendmail_t) but this doesn't allow write access by sendmail. Sendmail needs to write into procmail_tmp_t when a procmail recipe pipes a message into a filter and that filter creates a temp file I believe. I'm getting the AVCs anyway: type=AVC msg=audit(1202162399.034:320138): avc: denied { write } for pid=16452 comm="sendmail" path="/tmp/choplist.16383" dev=dm-1 ino=13 scontext=system_u:system_r:sendmail_t:s0 tcontext=system_u:object_r:procmail_tmp_t:s0 tclass=file type=SYSCALL msg=audit(1202162399.034:320138): arch=40000003 syscall=11 success=yes exit=0 a0=bf8febff a1=84ffe44 a2=bf8fe3a4 a3=84ffe44 items=0 ppid=16384 pid=16452 auid=0 uid=502 gid=502 euid=502 suid=502 fsuid=502 egid=51 sgid=51 fsgid=51 tty=(none) comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:sendmail_t:s0 key=(null) type=AVC msg=audit(1202162401.083:320139): avc: denied { write } for pid=16453 comm="sendmail" path=2F746D702F63686F706C6973742E3136333833202864656C6574656429 dev=dm-1 ino=13 scontext=system_u:system_r:sendmail_t:s0 tcontext=system_u:object_r:procmail_tmp_t:s0 tclass=file Paul.

2 1

semanage segmentation fault? (awstats)
by "Stanisław T. Findeisen" 05 Feb '08

05 Feb '08

Look I tried to intall awstats-6.6-1.fc7.noarch.rpm from Fedora release on Fedora 7 64-bit and got segmentation fault in semanage I think. First I tried this: [root@srv-1 download]# rpm --install ./awstats-6.6-1.fc7.noarch.rpm /var/tmp/rpm-tmp.71040: line 12: 3964 Segmentation fault semanage fcontext -a -t httpd_sys_script_exec_t '/usr/share/awstats/wwwroot/cgi-bin(/.*)?' 2> /dev/null /var/tmp/rpm-tmp.71040: line 13: 3965 Segmentation fault semanage fcontext -a -t httpd_sys_script_rw_t '/var/lib/awstats(/.*)?' 2> /dev/null Then I realised I have HTTP server on, so I thought I will turn it off and try again (on the way I had to erase the RPM because it was considered "installed"). Then this happened: [root@srv-1 download]# rpm --install ./awstats-6.6-1.fc7.noarch.rpm /var/tmp/rpm-tmp.21042: line 12: 3995 Segmentation fault semanage fcontext -a -t httpd_sys_script_exec_t '/usr/share/awstats/wwwroot/cgi-bin(/.*)?' 2> /dev/null /var/tmp/rpm-tmp.21042: line 13: 3996 Segmentation fault semanage fcontext -a -t httpd_sys_script_rw_t '/var/lib/awstats(/.*)?' 2> /dev/null I do not know what /var/tmp/rpm-tmp.* is, but I suppose that is an RPM install script or something which comes with RPM (right?). After these 2 steps the /var/tmp directory was empty so I couldn't examine that file. After that I downloaded awstats-6.7-2.fc7.noarch.rpm from Fedora updates and it installed fine (although I haven't tested it yet). I have also found this in /var/log/messages: Feb 5 15:53:44 srv-1 kernel: semanage[3964]: segfault at 0000000000000000 rip 00002b610d7e9b49 rsp 00007fffa20be6b0 error 4 Feb 5 15:53:44 srv-1 kernel: semanage[3965]: segfault at 0000000000000000 rip 00002b2754535b49 rsp 00007fff5b3744b0 error 4 Feb 5 15:56:33 srv-1 kernel: semanage[3995]: segfault at 0000000000000000 rip 00002b0a226c9b49 rsp 00007fff8d1e0300 error 4 Feb 5 15:56:33 srv-1 kernel: semanage[3996]: segfault at 0000000000000000 rip 00002b0feea21b49 rsp 00007fffc0e86fc0 error 4 What do you think guys? STF

2 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux February 2008