selinux February 2008

selinux@lists.fedoraproject.org

34 participants
61 discussions

SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (consolekit_t) "execute" to <Unknown> (polkit_auth_exec_t).
by Antonio Olivares 05 Feb '08

05 Feb '08

Unknown, what is happening with console-kit-daemon? Summary: SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (consolekit_t) "execute" to <Unknown> (polkit_auth_exec_t). Detailed Description: SELinux denied access requested by console-kit-dae(/usr/sbin/console-kit-daemon). It is not expected that this access is required by console-kit-dae(/usr/sbin/console-kit-daemon) and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for <Unknown>, restorecon -v <Unknown> If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:consolekit_t Target Context system_u:object_r:polkit_auth_exec_t Target Objects None [ file ] Source console-kit-dae(/usr/sbin/console-kit-daemon) Port <Unknown> Host localhost.localdomain Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.2.5-20.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.24-9.fc9 #1 SMP Tue Jan 29 18:08:15 EST 2008 i686 i686 Alert Count 1 First Seen Wed 30 Jan 2008 06:58:11 PM CST Last Seen Wed 30 Jan 2008 06:58:11 PM CST Local ID f1411c87-1b39-4d5a-bec3-67e1feb8ec07 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1201741091.457:30): avc: denied { execute } for pid=2897 comm="console-kit-dae" name="polkit-read-auth-helper" dev=dm-0 ino=116712 scontext=system_u:system_r:consolekit_t:s0 tcontext=system_u:object_r:polkit_auth_exec_t:s0 tclass=file host=localhost.localdomain type=SYSCALL msg=audit(1201741091.457:30): arch=40000003 syscall=11 success=no exit=-13 a0=77097c a1=bff98da0 a2=bff9962c a3=0 items=0 ppid=2264 pid=2897 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="console-kit-dae" exe="/usr/sbin/console-kit-daemon" subj=system_u:system_r:consolekit_t:s0 key=(null) ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

3 2

Re: sendmail avc's - on a system upgraded from f7 to f8 - in <Unknown>
by Development discussions related to Fedora 05 Feb '08

05 Feb '08

Daniel J Walsh wrote: > David Timms wrote: >> AFAICS, I haven't made any configs to sendmail, yet I've started to get >> lots of AVC warnings in setroubleshoot, of three particular types: >> >> 1:======== >> Summary >> SELinux is preventing the /usr/sbin/sendmail.sendmail from using >> potentially mislabeled files (<Unknown>). >> >> Detailed Description >> SELinux has denied /usr/sbin/sendmail.sendmail access to potentially >> mislabeled file(s) (<Unknown>). This means that SELinux will not allow > A postinstall script has ruined the labeling on your /etc/services file. > > # restorecon -v /etc/services > will fix # ls -lZ /etc/services -rw-r--r-- root root unconfined_u:object_r:rpm_script_tmp_t /etc/services Yes, you are correct. # restorecon -v /etc/services restorecon reset /etc/services context unconfined_u:object_r:rpm_script_tmp_t:s0->system_u:object_r:etc_t:s0 I guess experience rather than reading the troubleshoot message led you to /etc/services ? > If you any idea which rpm did this. I would like to know. yum.logs--- I'l try to narrow it down, not sure how. I can't remember now exactly what I was doing around the date that it started occurring. === Jan 27 18:17:06 Installed: apr-util - 1.2.10-2.fc8.i386 Jan 27 18:17:10 Installed: subversion - 1.4.4-7.i386 Jan 27 18:21:36 Installed: libxkbfile - 1.0.4-3.fc8.i386 Jan 27 18:21:37 Installed: xorg-x11-xkb-utils - 7.2-3.fc8.i386 Jan 27 18:23:39 Installed: wireshark - 0.99.7-2.fc8.i386 Jan 27 18:25:58 Installed: torcs-data - 1.3.0-2.noarch Jan 27 18:26:58 Installed: libgnomeui-devel - 2.20.1.1-1.fc8.i386 Jan 27 18:30:28 Installed: libcaca - 0.99-0.3.beta11.fc8.i386 Jan 27 18:30:31 Installed: xine - 0.99.5-1.fc7.i386 Jan 27 18:33:26 Installed: gettext - 0.16.1-12.fc8.i386 Jan 27 18:33:27 Installed: redhat-lsb - 3.1-19.fc8.i386 Jan 27 18:34:23 Installed: bluez-libs - 3.20-1.fc8.i386 Jan 27 18:34:25 Installed: gnokii - 0.6.18-3.fc8.i386 Jan 27 18:37:01 Installed: ffmpeg - 0.4.9-0.8.20070530.fc7.i386 Jan 27 18:42:45 Installed: indent - 2.2.9-16.fc7.i386 Jan 27 18:48:09 Erased: perl-LDAP Jan 27 18:50:05 Installed: fuse - 2.7.0-8.fc8.i386 Jan 27 18:51:32 Erased: audacity Jan 27 18:52:00 Installed: compat-wxGTK26 - 2.6.4-0.8.i386 Jan 27 18:52:03 Installed: audacity - 1.3.2-17.fc8.i386 Jan 27 18:53:02 Erased: dvdrip Jan 27 18:53:04 Erased: subtitleripper Jan 27 18:53:06 Erased: transcode Jan 27 18:53:43 Installed: ffmpeg-libpostproc - 0.4.9-0.8.20070530.fc7.i386 Jan 27 18:53:48 Installed: transcode - 1.0.3-1.fc7.i386 Jan 27 18:54:20 Erased: x264-devel Jan 27 18:54:47 Installed: x264-devel - 0.0.0-0.3.20070529.fc7.i386 Jan 27 18:55:25 Erased: timmsy-servers Jan 27 18:59:20 Erased: gkrellm Jan 27 18:59:26 Erased: timmsy-apps Jan 27 18:59:58 Installed: lm_sensors - 2.10.5-1.fc8.i386 Jan 27 19:00:00 Installed: gkrellm - 2.3.0-4.fc8.i386 Jan 27 19:02:23 Erased: faad2-devel Jan 27 19:02:55 Installed: setroubleshoot-server - 1.10.7-1.fc8.noarch Jan 27 19:03:31 Erased: ocsinventory-client Jan 27 19:05:47 Installed: lincity-ng-data - 1.1.1-2.fc8.i386 Jan 27 19:10:25 Installed: libquicktime - 1.0.0-1.fc7.i386 Jan 27 19:11:45 Installed: tcl - 1:8.4.15-5.fc8.i386 Jan 27 19:11:49 Installed: ppracer - 0.3.1-13.fc8.i386 Jan 27 19:14:09 Erased: perl-AnyEvent Jan 27 19:14:10 Erased: perl-Event-ExecFlow Jan 27 19:14:11 Erased: perl-Coro Jan 27 19:15:04 Erased: perl-Net-Jabber Jan 27 19:15:06 Erased: perl-SOAP-Lite Jan 27 20:02:54 Installed: thunderbird-debuginfo - 2.0.0.9-1.fc8.i386 Jan 27 21:30:09 Erased: thunderbird Jan 27 21:35:35 Installed: thunderbird - 2.0.0.9-1.fc8.i386 Jan 27 22:31:47 Installed: tetex-fonts - 3.0-44.3.fc8.i386 ----started here for one of the 3. Yum log was rolled over at this time as well. Jan 27 22:37:03 Installed: pulseaudio-libs - 0.9.8-5.fc8.i386 Jan 27 22:41:21 Installed: dialog - 1.1-2.20070704.fc8.i386 Jan 27 22:44:43 Installed: fedora-screensaver-theme - 1.0.0-1.fc8.noarch Jan 27 22:46:53 Installed: SDL - 1.2.13-1.fc8.i386 Jan 27 23:06:07 Erased: libswscale0 Jan 27 23:09:38 Erased: kernel-devel Jan 27 23:09:43 Erased: timmsy-development Jan 28 00:04:30 Updated: pulseaudio-core-libs - 0.9.8-5.fc8.i386 Jan 28 00:04:33 Updated: glib-java - 0.2.6-10.fc8.i386 Jan 28 00:04:36 Updated: pulseaudio - 0.9.8-5.fc8.i386 Jan 28 00:04:38 Updated: cairo-java - 1.0.5-8.fc8.i386 Jan 28 00:04:40 Updated: libgtk-java - 2.8.7-5.fc8.i386 Jan 28 00:04:40 Updated: pulseaudio-module-x11 - 0.9.8-5.fc8.i386 Jan 28 00:04:41 Updated: pulseaudio-libs-zeroconf - 0.9.8-5.fc8.i386 Jan 28 00:04:42 Updated: glew - 1.4.0-5.fc8.i386 Jan 28 00:04:43 Updated: libbeagle - 0.2.18-4.fc8.i386 Jan 28 00:05:03 Updated: allegro - 4.2.2-7.fc8.i386 Jan 28 00:05:03 Updated: pulseaudio-libs-glib2 - 0.9.8-5.fc8.i386 Jan 28 00:05:05 Updated: libgconf-java - 2.12.4-9.fc8.i386 Jan 28 00:05:06 Updated: xterm - 231-1.fc8.i386 Jan 28 00:05:07 Updated: pulseaudio-esound-compat - 0.9.8-5.fc8.i386 Jan 28 00:05:50 Installed: kernel - 2.6.23.14-107.fc8.i686 Jan 28 00:05:51 Updated: hwdata - 0.215-1.fc8.noarch Jan 28 00:05:52 Updated: pulseaudio-module-gconf - 0.9.8-5.fc8.i386 Jan 28 00:05:53 Updated: pulseaudio-utils - 0.9.8-5.fc8.i386 Jan 28 00:05:56 Updated: liberation-fonts - 1.0-1.fc8.noarch Jan 28 00:06:08 Updated: docbook-style-xsl - 1.73.2-5.fc8.noarch Jan 28 00:06:08 Updated: python-turbokid - 1.0.4-1.fc8.noarch Jan 28 00:06:09 Updated: logrotate - 3.7.6-2.2.fc8.i386 Jan 28 00:06:17 Updated: kernel-headers - 2.6.23.14-107.fc8.i386 Jan 28 00:31:15 Installed: kernel-devel - 2.6.23.14-107.fc8.i686 Jan 28 10:13:10 Installed: memtest86+ - 1.70-4.fc8.i386 Jan 30 20:09:14 Updated: bash - 3.2-20.fc8.i386 Jan 30 20:09:18 Updated: libacl - 2.2.39-13.fc8.i386

3 5

Exporting selinux labels via network file systems
by Andreas Thienemann 04 Feb '08

04 Feb '08

Hey, is there any way of exporting selinux labels via nfs or any other network file systems? I've found some statements on the NSA selinux page indicating that NFS4 might be able to do this, but does current fedora and rhel support this? I know about the workaround of setting a general filecontext through the context mount option, but I'm looking at something a bit more fine-grained. regards, andreas

2 1

Denial when calling /bin/mail from initscripts
by Jason L Tibbitts III 04 Feb '08

04 Feb '08

This is a bit odd; I have my machines send an email when they reboot, and this worked previous to F8 but no F8 it seems that selinux is preventing that from working properly. rc.local has something like: HN=`hostname` date | mail -s $HN obscured@address When the mail is sent I get the following denial: audit(1202140440.123:4): avc: denied { read } for pid=2752 comm="sendmail" path=2F746D702F527357566E686E52202864656C6574656429 dev=dm-3 ino=98307 scontext=system_u:system_r:sendmail_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file and a message is sent, but it's mostly empty (no body and no subject). audit2allow just says #============= sendmail_t ============== allow sendmail_t initrc_tmp_t:file read; but as is unfortunately almost always the case with selinux things, I understand that would work but I don't understand if it exposes me to anything or could cause problems later. - J<

1 0

Question on semanage fcontext -a
by Shintaro Fujiwara 04 Feb '08

04 Feb '08

Hi, I read man semanage and found that semanage fcontext -a uses restorecon. Does that mean I don't have to restorecon after I semanage fcontext -a ? I just did restorecon fcontext -a and relabeled the system and found that file context survived. Thanks in advance. -- http://intrajp.no-ip.com/ Home Page

2 3

More selinux questions
by Gene Heskett 03 Feb '08

03 Feb '08

Greetings; After several failures on Sunday mornings to properly rotate some logs generated by fetchmail, I give up and need help. logrotate can kill fetchmail ok, but cannot restart it, and I've now tried both of these invocations in the postrotate script, and both fail, sending me emails to that effect: system_u:system_r:unconfined_t:s0 is not a valid context error: error running non-shared postrotate script for /var/log/fetchmail.log of '/var/log/fetchmail.log /var/log/procmail.log ' fetchmail: no process killed system_u:system_r:unconfined_t:s0 is not a valid context error: error running non-shared postrotate script for /var/log/procmail.log of '/var/log/fetchmail.log /var/log/procmail.log ' I had tried your recommended launching line this week after the su gene -c version failed last week: runcon -t unconfined_t -- runuser -l -c "fetchmail -d 90 --fetchmailrc /home/gene/.fetchmailrc" gene Which generated the above message, and this one: su gene -c "fetchmail -d 90 --fetchmailrc /home/gene/.fetchmailrc" which works to restart it from a shell just fine. The runcon version works at bootup time just fine, so why can't I use it in a logrotation script? I think I see one problem though, with both logs named in the same script, its doing 2 killalls of fetchmail, so I'll make those 2 separate scripts I guess. Done. But how DO I relaunch fetchmail in the postrotate section? Also, in /etc/croon.daily, tmpwatch is having trouble, from the same email from cron as above: /etc/cron.daily/tmpwatch: error: failed to lstat /tmp/.spamassassin5459PpduEPtmp: Permission denied What is this? I thought anything could use /tmp for anything... It exists: -rw------- 1 gene gene 3298 2008-01-07 20:49 .spamassassin5459PpduEPtmp Humm, from the cli: [root@coyote logrotate.d]# lstat /tmp/.spamassassin5459PpduEPtmp -bash: lstat: command not found But, take off the el and just run stat [root@coyote logrotate.d]# stat /tmp/.spamassassin5459PpduEPtmp File: `/tmp/.spamassassin5459PpduEPtmp' Size: 3298 Blocks: 8 IO Block: 4096 regular file Device: fe00h/65024d Inode: 26378244 Links: 1 Access: (0600/-rw-------) Uid: ( 500/ gene) Gid: ( 500/ gene) Access: 2008-02-01 02:24:19.000000000 -0500 Modify: 2008-01-07 20:49:23.000000000 -0500 Change: 2008-01-07 20:49:23.000000000 -0500 Typu in a script someplace? Thanks for any clarification offered here. -- Cheers, Gene "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) How much of their influence on you is a result of your influence on them?

1 0

sendmail avc's - on a system upgraded from f7 to f8 - in <Unknown>
by Development discussions related to Fedora 02 Feb '08

02 Feb '08

AFAICS, I haven't made any configs to sendmail, yet I've started to get lots of AVC warnings in setroubleshoot, of three particular types: 1:======== Summary SELinux is preventing the /usr/sbin/sendmail.sendmail from using potentially mislabeled files (<Unknown>). Detailed Description SELinux has denied /usr/sbin/sendmail.sendmail access to potentially mislabeled file(s) (<Unknown>). This means that SELinux will not allow /usr/sbin/sendmail.sendmail to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access. Allowing Access If you want /usr/sbin/sendmail.sendmail to access this files, you need to relabel them using restorecon -v <Unknown>. You might want to relabel the entire directory using restorecon -R -v <Unknown>. Additional Information Source Context system_u:system_r:sendmail_t Target Context unconfined_u:object_r:rpm_script_tmp_t Target Objects None [ file ] Affected RPM Packages sendmail-8.14.2-1.fc8 [application] Policy RPM selinux-policy-3.0.8-81.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.home_tmp_bad_labels Host Name davidtdesktop Platform Linux davidtdesktop 2.6.23.14-107.fc8 #1 SMP Mon Jan 14 21:37:30 EST 2008 i686 athlon Alert Count 52 First Seen Mon 28 Jan 2008 18:32:36 EST Last Seen Sun 03 Feb 2008 14:31:08 EST Local ID e5d4104c-605b-473f-aa9a-0bc219636676 Line Numbers Raw Audit Messages avc: denied { read } for comm=sendmail dev=dm-0 egid=51 euid=51 exe=/usr/sbin/sendmail.sendmail exit=-13 fsgid=51 fsuid=51 gid=51 items=0 name=services pid=4791 scontext=system_u:system_r:sendmail_t:s0 sgid=51 subj=system_u:system_r:sendmail_t:s0 suid=51 tclass=file tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tty=(none) uid=51 2:===== Summary SELinux is preventing the /usr/sbin/sendmail.sendmail from using potentially mislabeled files (<Unknown>). Detailed Description SELinux has denied /usr/sbin/sendmail.sendmail access to potentially mislabeled file(s) (<Unknown>). This means that SELinux will not allow /usr/sbin/sendmail.sendmail to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access. Allowing Access If you want /usr/sbin/sendmail.sendmail to access this files, you need to relabel them using restorecon -v <Unknown>. You might want to relabel the entire directory using restorecon -R -v <Unknown>. Additional Information Source Context system_u:system_r:system_mail_t:SystemLow- SystemHigh Target Context unconfined_u:object_r:rpm_script_tmp_t Target Objects None [ file ] Affected RPM Packages sendmail-8.14.2-1.fc8 [application] Policy RPM selinux-policy-3.0.8-81.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.home_tmp_bad_labels Host Name davidtdesktop Platform Linux davidtdesktop 2.6.23.14-107.fc8 #1 SMP Mon Jan 14 21:37:30 EST 2008 i686 athlon Alert Count 21 First Seen Mon 28 Jan 2008 00:00:02 EST Last Seen Sun 03 Feb 2008 12:00:01 EST Local ID 61f52ef3-2fca-4607-ade4-b8e117ca7a06 Line Numbers Raw Audit Messages avc: denied { read } for comm=sendmail dev=dm-0 egid=51 euid=51 exe=/usr/sbin/sendmail.sendmail exit=-13 fsgid=51 fsuid=51 gid=51 items=0 name=services pid=4402 scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 sgid=51 subj=system_u:system_r:system_mail_t:s0-s0:c0.c1023 suid=51 tclass=file tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tty=(none) uid=51 3:====== Summary SELinux is preventing the /usr/sbin/sendmail.sendmail from using potentially mislabeled files (<Unknown>). Detailed Description SELinux has denied /usr/sbin/sendmail.sendmail access to potentially mislabeled file(s) (<Unknown>). This means that SELinux will not allow /usr/sbin/sendmail.sendmail to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access. Allowing Access If you want /usr/sbin/sendmail.sendmail to access this files, you need to relabel them using restorecon -v <Unknown>. You might want to relabel the entire directory using restorecon -R -v <Unknown>. Additional Information Source Context system_u:system_r:system_mail_t Target Context unconfined_u:object_r:rpm_script_tmp_t Target Objects None [ file ] Affected RPM Packages sendmail-8.14.2-1.fc8 [application] Policy RPM selinux-policy-3.0.8-81.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.home_tmp_bad_labels Host Name davidtdesktop Platform Linux davidtdesktop 2.6.23.14-107.fc8 #1 SMP Mon Jan 14 21:37:30 EST 2008 i686 athlon Alert Count 14 First Seen Sun 27 Jan 2008 22:31:52 EST Last Seen Sun 03 Feb 2008 09:07:52 EST Local ID 426efd22-09c0-4e57-9975-03c2ec8ad840 Line Numbers Raw Audit Messages avc: denied { read } for comm=sendmail dev=dm-0 egid=51 euid=51 exe=/usr/sbin/sendmail.sendmail exit=-13 fsgid=51 fsuid=51 gid=51 items=0 name=services pid=3416 scontext=system_u:system_r:system_mail_t:s0 sgid=51 subj=system_u:system_r:system_mail_t:s0 suid=51 tclass=file tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tty=(none) uid=51 ===== I'm not sure of the significance of <unknown> in the report. But for eg: # rpm -V sendmail S.5....T c /var/log/mail/statistics #rpm -ql sendmail|xargs ls -lZ -rw-r--r-- root root system_u:object_r:etc_mail_t /etc/mail/access -rw-r----- root root system_u:object_r:etc_mail_t /etc/mail/access.db -rw-r--r-- root root system_u:object_r:etc_mail_t /etc/mail/domaintable -rw-r----- root root system_u:object_r:etc_mail_t /etc/mail/domaintable.db -r--r--r-- root root system_u:object_r:etc_mail_t /etc/mail/helpfile -rw-r--r-- root root system_u:object_r:etc_mail_t /etc/mail/local-host-names -rw-r--r-- root root system_u:object_r:etc_mail_t /etc/mail/mailertable -rw-r----- root root system_u:object_r:etc_mail_t /etc/mail/mailertable.db -rw-r--r-- root root system_u:object_r:etc_mail_t /etc/mail/Makefile -rw-r--r-- root root system_u:object_r:etc_mail_t /etc/mail/sendmail.cf -rw-r--r-- root root system_u:object_r:etc_mail_t /etc/mail/sendmail.mc -r--r--r-- root root system_u:object_r:etc_mail_t /etc/mail/submit.cf -rw-r--r-- root root system_u:object_r:etc_mail_t /etc/mail/submit.mc -rw-r--r-- root root system_u:object_r:etc_mail_t /etc/mail/trusted-users -rw-r--r-- root root system_u:object_r:etc_mail_t /etc/mail/virtusertable -rw-r----- root root system_u:object_r:etc_mail_t /etc/mail/virtusertable.db -rw-r--r-- root root system_u:object_r:etc_t /etc/pam.d/smtp.sendmail -rwxr-xr-x root root system_u:object_r:initrc_exec_t /etc/rc.d/init.d/sendmail -rw-r--r-- root root system_u:object_r:etc_t /etc/sysconfig/sendmail lrwxrwxrwx root root system_u:object_r:bin_t /usr/bin/hoststat lrwxrwxrwx root root system_u:object_r:bin_t /usr/bin/mailq.sendmail lrwxrwxrwx root root system_u:object_r:bin_t /usr/bin/makemap lrwxrwxrwx root root system_u:object_r:bin_t /usr/bin/newaliases.sendmail lrwxrwxrwx root root system_u:object_r:bin_t /usr/bin/purgestat -rwxr-xr-x root root system_u:object_r:bin_t /usr/bin/rmail.sendmail -rw-r--r-- root root system_u:object_r:lib_t /usr/lib/sasl2/Sendmail.conf lrwxrwxrwx root root system_u:object_r:lib_t /usr/lib/sendmail.sendmail -rwxr-xr-x root root system_u:object_r:bin_t /usr/sbin/mailstats -rwxr-xr-x root root system_u:object_r:bin_t /usr/sbin/makemap -rwxr-xr-x root root system_u:object_r:bin_t /usr/sbin/praliases -rwxr-sr-x root smmsp system_u:object_r:sendmail_exec_t /usr/sbin/sendmail.sendmail -rwxr-xr-x root root system_u:object_r:shell_exec_t /usr/sbin/smrsh -rw-r--r-- root root system_u:object_r:usr_t /usr/share/doc/sendmail-8.14.2/FAQ -rw-r--r-- root root system_u:object_r:usr_t /usr/share/doc/sendmail-8.14.2/KNOWNBUGS -rw-r--r-- root root system_u:object_r:usr_t /usr/share/doc/sendmail-8.14.2/LICENSE -rw-r--r-- root root system_u:object_r:usr_t /usr/share/doc/sendmail-8.14.2/README -rw-r--r-- root root system_u:object_r:usr_t /usr/share/doc/sendmail-8.14.2/RELEASE_NOTES -rw-r--r-- root root system_u:object_r:man_t /usr/share/man/man1/mailq.sendmail.1.gz -rw-r--r-- root root system_u:object_r:man_t /usr/share/man/man1/newaliases.sendmail.1.gz -rw-r--r-- root root system_u:object_r:man_t /usr/share/man/man5/aliases.sendmail.5.gz -rw-r--r-- root root system_u:object_r:man_t /usr/share/man/man8/mailstats.8.gz -rw-r--r-- root root system_u:object_r:man_t /usr/share/man/man8/makemap.8.gz -rw-r--r-- root root system_u:object_r:man_t /usr/share/man/man8/praliases.8.gz -rw-r--r-- root root system_u:object_r:man_t /usr/share/man/man8/rmail.8.gz -rw-r--r-- root root system_u:object_r:man_t /usr/share/man/man8/sendmail.sendmail.8.gz -rw-r--r-- root root system_u:object_r:man_t /usr/share/man/man8/smrsh.8.gz -rw------- root root system_u:object_r:sendmail_log_t /var/log/mail/statistics /etc/mail: -rw-r--r-- root root system_u:object_r:etc_mail_t access -rw-r----- root root system_u:object_r:etc_mail_t access.db -rw-r--r-- root root system_u:object_r:etc_mail_t domaintable -rw-r----- root root system_u:object_r:etc_mail_t domaintable.db -r--r--r-- root root system_u:object_r:etc_mail_t helpfile -rw-r--r-- root root system_u:object_r:etc_mail_t local-host-names -rw-r--r-- root root system_u:object_r:etc_mail_t mailertable -rw-r----- root root system_u:object_r:etc_mail_t mailertable.db -rw-r--r-- root root system_u:object_r:etc_mail_t Makefile -rw-r--r-- root root system_u:object_r:etc_mail_t sendmail.cf -rw-r--r-- root root system_u:object_r:etc_mail_t sendmail.mc drwxr-xr-x root root system_u:object_r:etc_mail_t spamassassin -r--r--r-- root root system_u:object_r:etc_mail_t submit.cf -rw-r--r-- root root system_u:object_r:etc_mail_t submit.mc -rw-r--r-- root root system_u:object_r:etc_mail_t trusted-users -rw-r--r-- root root system_u:object_r:etc_mail_t virtusertable -rw-r----- root root system_u:object_r:etc_mail_t virtusertable.db /etc/smrsh: /usr/share/doc/sendmail-8.14.2: -rw-r--r-- root root system_u:object_r:usr_t FAQ -rw-r--r-- root root system_u:object_r:usr_t KNOWNBUGS -rw-r--r-- root root system_u:object_r:usr_t LICENSE -rw-r--r-- root root system_u:object_r:usr_t README -rw-r--r-- root root system_u:object_r:usr_t RELEASE_NOTES /var/log/mail: -rw------- root root system_u:object_r:sendmail_log_t statistics /var/spool/clientmqueue: -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0TAL2Z4002179 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0TAL2Z5002179 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0TAL2Z6002179 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0TBuDQl003422 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0TBvh2R003889 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0TD017m005694 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0TKmEhp002179 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0TKmEhq002179 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0TKmEhr002179 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0U9cIeG006258 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0U9ZDWF004246 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0UA01ED006312 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0V8sBCp002180 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0V8sBCq002180 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0V8sBCr002180 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0VA02Ur004010 -rw-rw---- davidt smmsp system_u:object_r:mqueue_spool_t dfm0VAT2Kl005308 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0VATPCh005580 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0VAVCQU006128 -rw-rw---- davidt smmsp system_u:object_r:mqueue_spool_t dfm0VBe2tP006857 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0VD02fi007007 -rw-rw---- davidt smmsp system_u:object_r:mqueue_spool_t dfm0VEe13G007185 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0VEsBCp007222 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0VEsBCq007222 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0VEsBCr007222 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0VEsBCs007222 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0VFsBCp007322 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0VG01XF007335 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0VHsBCp008314 -rw-rw---- smmsp smmsp unconfined_u:object_r:mqueue_spool_t dfm0VHW6HF007736 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0VHW8cm008025 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0VIsBCp008420 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0VJ01Xa008433 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm0VKsBCp008627 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm117jvOI002185 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm117jvOJ002185 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm117jvOK002185 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm11A01jB003317 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm11D03rF004596 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm11KVEe6002181 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm11KVEe7002181 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm11M01sH002693 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm11M6OET002942 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm11M7vs1003405 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm12102m9004637 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm122VEe6006707 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm122VEe7006707 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm122VEe8006707 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm12402pG008037 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm125VEe6009373 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm12701Q0010624 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm128VEe6011891 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm129VEe6012792 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm129VEe7012792 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm12A02F1013291 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm12AVEe6013796 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm12BVEe6017595 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm12D02Dr019018 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm12KV8PK002188 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm12KV8PL002188 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm12M01K2002693 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm12M6Jvg002942 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm12M7qnO003416 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm13101hF004402 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm132V8PK004643 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm132V8PL004643 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t dfm132V8PM004643 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0TAL2Z4002179 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0TAL2Z5002179 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0TAL2Z6002179 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0TBuDQl003422 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0TBvh2R003889 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0TD017m005694 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0TKmEhp002179 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0TKmEhq002179 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0TKmEhr002179 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0U9cIeG006258 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0U9ZDWF004246 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0UA01ED006312 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0V8sBCp002180 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0V8sBCq002180 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0V8sBCr002180 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VA02Ur004010 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VAT2Kl005308 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VATPCh005580 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VAVCQU006128 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VBe2tP006857 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VD02fi007007 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VEe13G007185 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VEsBCp007222 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VEsBCq007222 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VEsBCr007222 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VEsBCs007222 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VFsBCp007322 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VG01XF007335 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VHsBCp008314 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VHW6HF007736 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VHW8cm008025 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VIsBCp008420 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VJ01Xa008433 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm0VKsBCp008627 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm117jvOI002185 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm117jvOJ002185 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm117jvOK002185 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm11A01jB003317 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm11D03rF004596 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm11KVEe6002181 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm11KVEe7002181 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm11M01sH002693 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm11M6OET002942 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm11M7vs1003405 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm12102m9004637 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm122VEe6006707 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm122VEe7006707 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm122VEe8006707 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm12402pG008037 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm125VEe6009373 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm12701Q0010624 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm128VEe6011891 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm129VEe6012792 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm129VEe7012792 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm12A02F1013291 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm12AVEe6013796 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm12BVEe6017595 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm12D02Dr019018 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm12KV8PK002188 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm12KV8PL002188 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm12M01K2002693 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm12M6Jvg002942 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm12M7qnO003416 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm13101hF004402 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm132V8PK004643 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm132V8PL004643 -rw-rw---- smmsp smmsp system_u:object_r:mqueue_spool_t qfm132V8PM004643 /var/spool/mqueue: The counts are so high because cron jobs trigger the warnings. Is this a problem for others - or I have I messed something up. Note I'm not trying to use sendmail - cron tasks are. DaveT.

1 0

more AVCs from shutdown....
by Tom London 02 Feb '08

02 Feb '08

Shutdown from gnome menu still doesn't work for me and generates an AVC: type=AVC msg=audit(1201976243.041:34): avc: denied { search } for pid=2470 comm="console-kit-dae" name="PolicyKit-public" dev=dm-0 ino=67632 scontext=system_u:system_r:consolekit_t:s0 tcontext=system_u:object_r:polkit_var_lib_t:s0 tclass=dir type=SYSCALL msg=audit(1201976243.041:34): arch=40000003 syscall=5 success=no exit=-13 a0=9c28880 a1=8000 a2=0 a3=8000 items=0 ppid=1 pid=2470 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="console-kit-dae" exe="/usr/sbin/console-kit-daemon" subj=system_u:system_r:consolekit_t:s0 key=(null) and [root@localhost ~]# locate PolicyKit-public /var/lib/PolicyKit-public [root@localhost ~]# Setting to permissive mode and retrying, shutdown works, but generates more AVC (attached): #============= consolekit_t ============== allow consolekit_t init_exec_t:file { read execute execute_no_trans }; allow consolekit_t initctl_t:fifo_file write; allow consolekit_t initrc_var_run_t:file { read write lock }; allow consolekit_t lib_t:file execute_no_trans; allow consolekit_t polkit_var_lib_t:dir search; allow consolekit_t shell_exec_t:file { read execute }; #============= vmware_host_t ============== allow vmware_host_t var_run_t:sock_file unlink; [vmware AVC seems not to bother anything, btw. dontaudit?] -- Tom London

1 1

firefox3beta and selinux
by Antonio Olivares 01 Feb '08

01 Feb '08

Dear all, When I try out the new firefox, setroubleshoot browser tells me \begin{QUOTE} Summary: SELinux is preventing firefox from making the program stack executable. Detailed Description: The firefox application attempted to make its stack executable. This is a potential security problem. This should never ever be necessary. Stack memory is not executable on most OSes these days and this will not change. Executable stack memory is one of the biggest security problems. An execstack error might in fact be most likely raised by malicious code. Applications are sometimes coded incorrectly and request this permission. The SELinux Memory Protection Tests (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to remove this requirement. If firefox does not work and you need it to work, you can configure SELinux temporarily to allow this access until the application is fixed. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Allowing Access: Sometimes a library is accidentally marked with the execstack flag, if you find a library with this flag you can clear it with the execstack -c LIBRARY_PATH. Then retry your application. If the app continues to not work, you can turn the flag back on with execstack -s LIBRARY_PATH. Otherwise, if you trust firefox to run correctly, you can change the context of the executable to unconfined_execmem_exec_t. "chcon -t unconfined_execmem_exec_t '/usr/lib/firefox-3.0b3pre/firefox'" You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t unconfined_execmem_exec_t '/usr/lib/firefox-3.0b3pre/firefox'" The following command will allow this access: chcon -t unconfined_execmem_exec_t '/usr/lib/firefox-3.0b3pre/firefox' Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Objects None [ process ] Source firefox Source Path /usr/lib/firefox-3.0b3pre/firefox Port <Unknown> Host localhost Source RPM Packages firefox-3.0-0.beta2.15.nightly20080130.fc9 Target RPM Packages Policy RPM selinux-policy-3.2.5-24.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name allow_execstack Host Name localhost Platform Linux localhost 2.6.24-9.fc9 #1 SMP Tue Jan 29 18:08:15 EST 2008 i686 athlon Alert Count 2 First Seen Fri 01 Feb 2008 05:08:54 PM CST Last Seen Fri 01 Feb 2008 05:08:54 PM CST Local ID c4806f30-a6dc-43b0-8901-5531075795f7 Line Numbers Raw Audit Messages host=localhost type=AVC msg=audit(1201907334.440:23): avc: denied { execstack } for pid=2743 comm="firefox" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process host=localhost type=SYSCALL msg=audit(1201907334.440:23): arch=40000003 syscall=125 success=no exit=-13 a0=bfd47000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=2729 pid=2743 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) comm="firefox" exe="/usr/lib/firefox-3.0b3pre/firefox" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) \end{QUOTE} I have done this two or three time so that I can use firefox-beta 3, is this by design or will it eventually be incorporated. If I decide to file a bug report, should it be against firefox, selinux-policy? see here ---------- The firefox application attempted to make its stack executable. This is a potential security problem. This should never ever be necessary. Stack memory is not executable on most OSes these days and this will not change. Executable stack memory is one of the biggest security problems. An execstack error might in fact be most likely raised by malicious code. Applications are sometimes coded incorrectly and request this permission. The SELinux Memory Protection Tests web page explains how to remove this requirement. If firefox does not work and you need it to work, you can configure SELinux temporarily to allow this access until the application is fixed. Please file a bug report against this package. Thanks, Antonio ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

F8 avc: denied during NFS mount
by Lamont Peterson 01 Feb '08

01 Feb '08

All, I got this while mounting via "ls /net/server/": Summary SELinux is preventing rpc.statd (rpcd_t) "write" to pipe (automount_t). Detailed Description SELinux denied access requested by rpc.statd. It is not expected that this access is required by rpc.statd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access You can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Additional Information Source Context system_u:system_r:rpcd_t:s0 Target Context system_u:system_r:automount_t:s0 Target Objects pipe [ fifo_file ] Affected RPM Packages Policy RPM selinux-policy-3.0.8-74.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.catchall Host Name reaver.lamontpeterson.net Platform Linux reaver.lamontpeterson.net 2.6.23.9-85.fc8 #1 SMP Fri Dec 7 15:49:36 EST 2007 x86_64 x86_64 Alert Count 1 First Seen Fri 18 Jan 2008 05:35:16 PM MST Last Seen Fri 18 Jan 2008 05:35:16 PM MST Local ID 1b3c736c-2edb-4c23-8440-c423dca231f0 Line Numbers Raw Audit Messages avc: denied { write } for comm=rpc.statd dev=pipefs path=pipe:[605687] pid=8732 scontext=system_u:system_r:rpcd_t:s0 tclass=fifo_file tcontext=system_u:system_r:automount_t:s0 -- Lamont Peterson <lamont(a)lamontpeterson.org [ http://lamontpeterson.org/ ] GPG Key fingerprint: C51E DD83 B03F D147 A974 939C 5D13 289C 17F1 FFBE

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux February 2008