selinux March 2009

selinux@lists.fedoraproject.org

29 participants
35 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

kde avc(SELinux prevented kde4-config from writing .kde.)will it be on next selinux policy update?
by Antonio Olivares 06 Apr '09

06 Apr '09

Dear selinux experts, I have a question about a repeated avc, I ask if I should apply the suggested fix or wait for an selinux policy update which addressses this? Summary: SELinux prevented kde4-config from writing .kde. Detailed Description: SELinux prevented kde4-config from writing .kde. If .kde is a core file, you may want to allow this. If .kde is not a core file, this could signal a intrusion attempt. Allowing Access: Changing the "allow_daemons_dump_core" boolean to true will allow this access: "setsebool -P allow_daemons_dump_core=1." Fix Command: setsebool -P allow_daemons_dump_core=1 Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:root_t:s0 Target Objects .kde [ dir ] Source kde4-config Source Path /usr/bin/kde4-config Port <Unknown> Host riohigh Source RPM Packages kdelibs-4.2.1-2.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.7-1.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name allow_daemons_dump_core Host Name riohigh Platform Linux riohigh 2.6.29-0.197.rc7.fc11.i586 #1 SMP Tue Mar 3 23:01:11 EST 2009 i686 athlon Alert Count 20 First Seen Tue 17 Feb 2009 08:36:03 AM CST Last Seen Wed 04 Mar 2009 07:44:55 PM CST Local ID 6d47417b-4b4b-4c4f-9c12-6210059fc418 Line Numbers Raw Audit Messages node=riohigh type=AVC msg=audit(1236217495.274:8): avc: denied { create } for pid=2386 comm="kde4-config" name=".kde" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=dir node=riohigh type=SYSCALL msg=audit(1236217495.274:8): arch=40000003 syscall=39 success=no exit=-13 a0=87163f8 a1=1c0 a2=49e32ec a3=0 items=0 ppid=2385 pid=2386 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kde4-config" exe="/usr/bin/kde4-config" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) Regards, Antonio

4 3

selinux does not like crontab :(, default_t, kde
by Antonio Olivares 31 Mar '09

31 Mar '09

Dear all, I have resolved one problem(Not getting internet at startup by default), but have not fixed the crontab one and other(s): This one does not go away :( Summary: SELinux is preventing crontab (admin_crontab_t) "read write" unconfined_t. Detailed Description: SELinux denied access requested by crontab. It is not expected that this access is required by crontab and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0 .c1023 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects socket [ unix_stream_socket ] Source crontab Source Path /usr/bin/crontab Port <Unknown> Host riohigh Source RPM Packages cronie-1.2-7.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.8-3.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name riohigh Platform Linux riohigh 2.6.29-0.258.2.3.rc8.git2.fc11.i586 #1 SMP Tue Mar 24 18:37:23 EDT 2009 i686 athlon Alert Count 177 First Seen Mon 02 Mar 2009 07:11:37 PM CST Last Seen Wed 25 Mar 2009 04:57:03 PM CST Local ID 3883b140-4d39-40f5-9262-ce2c4c4e2e16 Line Numbers Raw Audit Messages node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53528]" dev=sockfs ino=53528 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=SYSCALL msg=audit(1238021823.376:68): arch=40000003 syscall=11 success=yes exit=0 a0=9fcb5c8 a1=9fcbd10 a2=9fb5ae0 a3=9fcbd10 items=0 ppid=4295 pid=4331 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=2 comm="crontab" exe="/usr/bin/crontab" subj=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 key=(null) I can't modify my crontab file: [olivares@riohigh ~]$ crontab -l Authentication service cannot retrieve authentication info You (olivares) are not allowed to access to (crontab) because of pam configuration. [olivares@riohigh ~]$ if I disable selinux, I can modify it and view it, but not with selinux enabled. I got greeted with the following: Summary: SELinux is preventing access to files with the default label, default_t. Detailed Description: SELinux permission checks on files labeled default_t are being denied. These files/directories have the default label on them. This can indicate a labeling problem, especially if the files being referred to are not top level directories. Any files/directories under standard system directories, /usr, /var. /dev, /tmp, ..., should not be labeled with the default label. The default label is for files/directories which do not have a label on a parent directory. So if you create a new directory in / you might legitimately get this label. Allowing Access: If you want a confined domain to use these files you will probably need to relabel the file/directory with chcon. In some cases it is just easier to relabel the system, to relabel execute: "touch /.autorelabel; reboot" Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:default_t:s0 Target Objects /.kde [ dir ] Source kde4-config Source Path /usr/bin/kde4-config Port <Unknown> Host riohigh Source RPM Packages kdelibs-4.2.1-4.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.8-3.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name default Host Name riohigh Platform Linux riohigh 2.6.29-0.258.2.3.rc8.git2.fc11.i586 #1 SMP Tue Mar 24 18:37:23 EDT 2009 i686 athlon Alert Count 7 First Seen Wed 25 Mar 2009 04:38:14 PM CST Last Seen Wed 25 Mar 2009 04:38:14 PM CST Local ID d3d42e40-6a28-48cf-8717-b85579c55bad Line Numbers Raw Audit Messages node=riohigh type=AVC msg=audit(1238020694.487:40): avc: denied { getattr } for pid=2434 comm="kde4-config" path="/.kde" dev=sda5 ino=14897 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=dir node=riohigh type=SYSCALL msg=audit(1238020694.487:40): arch=40000003 syscall=196 success=no exit=-13 a0=bfc3730b a1=bfc37258 a2=a12ff4 a3=a036c59 items=0 ppid=2433 pid=2434 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kde4-config" exe="/usr/bin/kde4-config" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing access to files with the default label, default_t. Detailed Description: SELinux permission checks on files labeled default_t are being denied. These files/directories have the default label on them. This can indicate a labeling problem, especially if the files being referred to are not top level directories. Any files/directories under standard system directories, /usr, /var. /dev, /tmp, ..., should not be labeled with the default label. The default label is for files/directories which do not have a label on a parent directory. So if you create a new directory in / you might legitimately get this label. Allowing Access: If you want a confined domain to use these files you will probably need to relabel the file/directory with chcon. In some cases it is just easier to relabel the system, to relabel execute: "touch /.autorelabel; reboot" Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:default_t:s0 Target Objects .kde [ dir ] Source kde4-config Source Path /usr/bin/kde4-config Port <Unknown> Host riohigh Source RPM Packages kdelibs-4.2.1-4.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.8-3.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name default Host Name riohigh Platform Linux riohigh 2.6.29-0.258.2.3.rc8.git2.fc11.i586 #1 SMP Tue Mar 24 18:37:23 EDT 2009 i686 athlon Alert Count 23 First Seen Wed 25 Mar 2009 04:38:14 PM CST Last Seen Wed 25 Mar 2009 04:38:14 PM CST Local ID 711eec22-2695-4e57-91ad-622e9c5f3b53 Line Numbers Raw Audit Messages node=riohigh type=AVC msg=audit(1238020694.489:42): avc: denied { search } for pid=2434 comm="kde4-config" name=".kde" dev=sda5 ino=14897 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=dir node=riohigh type=SYSCALL msg=audit(1238020694.489:42): arch=40000003 syscall=196 success=no exit=-13 a0=a036c58 a1=bfc37230 a2=a12ff4 a3=a031250 items=0 ppid=2433 pid=2434 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kde4-config" exe="/usr/bin/kde4-config" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) Startup did not take the 20 seconds, it took like 8 to 10 minutes with the relabeling and still see the same things. Is there an update that will fix this or do I have to disable selinux or boot in permissive in order to have a working machine. Please help this is no longer fun as it once was. Regards, Antonio

3 13

Proftpd AVC
by Vadym Chepkov 30 Mar '09

30 Mar '09

Hi, I am not sure what is this about? type=AVC msg=audit(1238334358.188:369): avc: denied { write } for pid=4251 comm="proftpd" scontext=system_u:system_r:ftpd_t:s0 tco ntext=system_u:system_r:ftpd_t:s0 tclass=key audit2allow suggests allow ftpd_t self:key write; But I am not sure if I should do it or not. Sincerely yours, Vadym Chepkov

2 1

selinux stopping NetworkManager from doing its job.
by Antonio Olivares 26 Mar '09

26 Mar '09

Dear fellow testers and selinux experts, selinux is stopping NetworkManager from doing its job. To get internet, I have to manually type # dhclient eth0 and get internet connection. Summary: SELinux is preventing dhclient (dhcpc_t) "read write" unconfined_t. Detailed Description: SELinux denied access requested by dhclient. It is not expected that this access is required by dhclient and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects socket [ unix_stream_socket ] Source dhclient Source Path /sbin/dhclient Port <Unknown> Host riohigh Source RPM Packages dhclient-4.1.0-10.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.8-1.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name riohigh Platform Linux riohigh 2.6.29-0.215.rc7.fc11.i586 #1 SMP Sun Mar 8 23:25:31 EDT 2009 i686 athlon Alert Count 6 First Seen Fri 06 Mar 2009 04:16:01 PM CST Last Seen Mon 09 Mar 2009 05:22:13 PM CST Local ID a9c1d6de-334d-4f45-99bb-470f0f97e3ff Line Numbers Raw Audit Messages node=riohigh type=AVC msg=audit(1236640933.104:39): avc: denied { read write } for pid=3313 comm="dhclient" path="socket:[15009]" dev=sockfs ino=15009 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=SYSCALL msg=audit(1236640933.104:39): arch=40000003 syscall=11 success=yes exit=0 a0=85082b8 a1=8517f20 a2=8517f60 a3=8517f20 items=0 ppid=3265 pid=3313 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="dhclient" exe="/sbin/dhclient" subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null) Guess it applies over here: Summary: SELinux is preventing NetworkManager (NetworkManager_t) "read write" unconfined_t. Detailed Description: SELinux denied access requested by NetworkManager. It is not expected that this access is required by NetworkManager and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:system_r:NetworkManager_t:s0 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects socket [ unix_stream_socket ] Source NetworkManager Source Path /usr/sbin/NetworkManager Port <Unknown> Host riohigh Source RPM Packages NetworkManager-0.7.0.99-1.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.7-2.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name riohigh Platform Linux riohigh 2.6.29-0.203.rc7.fc11.i586 #1 SMP Wed Mar 4 18:03:29 EST 2009 i686 athlon Alert Count 5 First Seen Mon 23 Feb 2009 07:23:54 AM CST Last Seen Fri 06 Mar 2009 04:15:00 PM CST Local ID f192ed25-15af-43fd-aa2e-524cca16b88a Line Numbers Raw Audit Messages node=riohigh type=AVC msg=audit(1236377700.684:236): avc: denied { read write } for pid=14462 comm="NetworkManager" path="socket:[26116]" dev=sockfs ino=26116 scontext=unconfined_u:system_r:NetworkManager_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1236377700.684:236): avc: denied { read write } for pid=14462 comm="NetworkManager" path="socket:[26116]" dev=sockfs ino=26116 scontext=unconfined_u:system_r:NetworkManager_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1236377700.684:236): avc: denied { read write } for pid=14462 comm="NetworkManager" path="socket:[26116]" dev=sockfs ino=26116 scontext=unconfined_u:system_r:NetworkManager_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=SYSCALL msg=audit(1236377700.684:236): arch=40000003 syscall=11 success=yes exit=0 a0=84f2ee0 a1=84f2e30 a2=84f2268 a3=84f2e30 items=0 ppid=14461 pid=14462 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=10 comm="NetworkManager" exe="/usr/sbin/NetworkManager" subj=unconfined_u:system_r:NetworkManager_t:s0 key=(null) I do not get eth0 active upon starting up, since selinux stops NetworkManager from getting IP automagically :(. Regards, Antonio

3 4

setroubleshoot server listens out on inet
by lejeczek 25 Mar '09

25 Mar '09

dear all, that really baffles me, I don't seem to be able to set it up :) and that port by default in conf file?? setroubleshoot server should be able to listen on network so remote sealert could connect to it, right? on my boxes(f9;f10) it does even look like binding to a port please advise cheers ___________________________________________________________ Try the all-new Yahoo! Mail. "The New Version is radically easier to use" � The Wall Street Journal http://uk.docs.yahoo.com/nowyoucan.html

3 3

dhcpd_write and .kde4 revisited + crontab trouble, ntp too
by Antonio Olivares 24 Mar '09

24 Mar '09

Summary: SELinux is preventing dhclient (dhcpc_t) "read write" unconfined_t. Detailed Description: SELinux denied access requested by dhclient. It is not expected that this access is required by dhclient and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects socket [ unix_stream_socket ] Source dhclient Source Path /sbin/dhclient Port <Unknown> Host riohigh Source RPM Packages dhclient-4.1.0-11.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.8-3.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name riohigh Platform Linux riohigh 2.6.29-0.258.rc8.git2.fc11.i586 #1 SMP Mon Mar 16 20:53:59 EDT 2009 i686 athlon Alert Count 22 First Seen Fri 06 Mar 2009 04:16:01 PM CST Last Seen Tue 24 Mar 2009 04:35:56 PM CST Local ID a9c1d6de-334d-4f45-99bb-470f0f97e3ff Line Numbers Raw Audit Messages node=riohigh type=AVC msg=audit(1237934156.758:26): avc: denied { read write } for pid=3372 comm="dhclient" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1237934156.758:26): avc: denied { read write } for pid=3372 comm="dhclient" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=SYSCALL msg=audit(1237934156.758:26): arch=40000003 syscall=11 success=yes exit=0 a0=921ff38 a1=9207390 a2=9203bc0 a3=9207390 items=0 ppid=3332 pid=3372 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="dhclient" exe="/sbin/dhclient" subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null) Summary: SELinux prevented kde4-config from writing .kde. Detailed Description: SELinux prevented kde4-config from writing .kde. If .kde is a core file, you may want to allow this. If .kde is not a core file, this could signal a intrusion attempt. Allowing Access: Changing the "allow_daemons_dump_core" boolean to true will allow this access: "setsebool -P allow_daemons_dump_core=1." Fix Command: setsebool -P allow_daemons_dump_core=1 Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:root_t:s0 Target Objects .kde [ dir ] Source kde4-config Source Path /usr/bin/kde4-config Port <Unknown> Host riohigh Source RPM Packages kdelibs-4.2.1-4.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.8-3.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name allow_daemons_dump_core Host Name riohigh Platform Linux riohigh 2.6.29-0.258.rc8.git2.fc11.i586 #1 SMP Mon Mar 16 20:53:59 EDT 2009 i686 athlon Alert Count 43 First Seen Tue 17 Feb 2009 08:36:03 AM CST Last Seen Tue 24 Mar 2009 04:34:07 PM CST Local ID 6d47417b-4b4b-4c4f-9c12-6210059fc418 Line Numbers Raw Audit Messages node=riohigh type=AVC msg=audit(1237934047.415:8): avc: denied { create } for pid=2410 comm="kde4-config" name=".kde" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=dir node=riohigh type=SYSCALL msg=audit(1237934047.415:8): arch=40000003 syscall=39 success=no exit=-13 a0=8ac6418 a1=1c0 a2=296f2ec a3=0 items=0 ppid=2409 pid=2410 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kde4-config" exe="/usr/bin/kde4-config" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) Now I see why crontab does not work :( Summary: SELinux is preventing crontab (admin_crontab_t) "read write" unconfined_t. Detailed Description: SELinux denied access requested by crontab. It is not expected that this access is required by crontab and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0 .c1023 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects socket [ unix_stream_socket ] Source crontab Source Path /usr/bin/crontab Port <Unknown> Host riohigh Source RPM Packages cronie-1.2-7.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.8-3.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name riohigh Platform Linux riohigh 2.6.29-0.258.rc8.git2.fc11.i586 #1 SMP Mon Mar 16 20:53:59 EDT 2009 i686 athlon Alert Count 114 First Seen Mon 02 Mar 2009 07:11:37 PM CST Last Seen Tue 24 Mar 2009 04:10:37 PM CST Local ID 3883b140-4d39-40f5-9262-ce2c4c4e2e16 Line Numbers Raw Audit Messages node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17513]" dev=sockfs ino=17513 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=SYSCALL msg=audit(1237932637.221:85): arch=40000003 syscall=11 success=yes exit=0 a0=8e005a0 a1=8e004d0 a2=8dfa9f8 a3=8e004d0 items=0 ppid=5324 pid=5361 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts3 ses=1 comm="crontab" exe="/usr/bin/crontab" subj=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 key=(null) [olivares@riohigh ~]$ crontab -l Authentication service cannot retrieve authentication info You (olivares) are not allowed to access to (crontab) because of pam configuration. [olivares@riohigh ~]$ crontab -e Authentication service cannot retrieve authentication info You (olivares) are not allowed to access to (crontab) because of pam configuration. [olivares@riohigh ~]$ setroubleshooter kicks in and returns: Summary: SELinux is preventing ntpd (ntpd_t) "read write" unconfined_t. Detailed Description: SELinux denied access requested by ntpd. It is not expected that this access is required by ntpd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:system_r:ntpd_t:s0 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects socket [ unix_stream_socket ] Source ntpd Source Path /usr/sbin/ntpd Port <Unknown> Host riohigh Source RPM Packages ntp-4.2.4p6-3.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.8-3.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name riohigh Platform Linux riohigh 2.6.29-0.258.rc8.git2.fc11.i586 #1 SMP Mon Mar 16 20:53:59 EDT 2009 i686 athlon Alert Count 1 First Seen Mon 23 Mar 2009 04:07:29 PM CST Last Seen Mon 23 Mar 2009 04:07:29 PM CST Local ID 718bc628-af85-4d41-a5c1-838d9d3208bd Line Numbers Raw Audit Messages node=riohigh type=AVC msg=audit(1237846049.986:105): avc: denied { read write } for pid=18588 comm="ntpd" path="socket:[4898784]" dev=sockfs ino=4898784 scontext=unconfined_u:system_r:ntpd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=SYSCALL msg=audit(1237846049.986:105): arch=40000003 syscall=11 success=yes exit=0 a0=9e21f80 a1=9e22280 a2=9e21248 a3=9e22280 items=0 ppid=18587 pid=18588 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=10 comm="ntpd" exe="/usr/sbin/ntpd" subj=unconfined_u:system_r:ntpd_t:s0 key=(null) The time was not changed on this machine, I tried to call ntp and it did not work, why here's the reason: Summary: SELinux is preventing ntpd (ntpd_t) "read write" unconfined_t. Detailed Description: SELinux denied access requested by ntpd. It is not expected that this access is required by ntpd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:system_r:ntpd_t:s0 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects socket [ unix_stream_socket ] Source ntpd Source Path /usr/sbin/ntpd Port <Unknown> Host riohigh Source RPM Packages ntp-4.2.4p6-3.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.8-3.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name riohigh Platform Linux riohigh 2.6.29-0.258.rc8.git2.fc11.i586 #1 SMP Mon Mar 16 20:53:59 EDT 2009 i686 athlon Alert Count 1 First Seen Mon 23 Mar 2009 04:07:29 PM CST Last Seen Mon 23 Mar 2009 04:07:29 PM CST Local ID 718bc628-af85-4d41-a5c1-838d9d3208bd Line Numbers Raw Audit Messages node=riohigh type=AVC msg=audit(1237846049.986:105): avc: denied { read write } for pid=18588 comm="ntpd" path="socket:[4898784]" dev=sockfs ino=4898784 scontext=unconfined_u:system_r:ntpd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=SYSCALL msg=audit(1237846049.986:105): arch=40000003 syscall=11 success=yes exit=0 a0=9e21f80 a1=9e22280 a2=9e21248 a3=9e22280 items=0 ppid=18587 pid=18588 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=10 comm="ntpd" exe="/usr/sbin/ntpd" subj=unconfined_u:system_r:ntpd_t:s0 key=(null) I appreciate any help I can get. It has been a while since NetworkManager gives me a successfull connection. I have to become root and use dhclient to get internet access. If I need to file bug reports, please let me know against which components and I will do it. Thanks, Antonio

1 0

F10 and synce selinux troubles.
by Albert Bartoszko 23 Mar '09

23 Mar '09

Hi all! It's my first post. I last try to connect Palm to computer with F10 using synce-hal. I got several selinux alerts. All files has default context, pppd works fine with command line. SELinux is preventing pppd (hald_t) "read" ./options (pppd_etc_rw_t). Additional Information: Source Context system_u:system_r:hald_t Target Context system_u:object_r:pppd_etc_rw_t Target Objects ./options [ file ] Source pppd Source Path /usr/sbin/pppd Port <Unknown> Host localhost.localdomain Source RPM Packages ppp-2.4.4-8.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-48.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon Feb 23 13:21:22 EST 2009 i686 i686 Alert Count 2 First Seen Fri Mar 20 19:13:17 2009 Last Seen Fri Mar 20 20:17:07 2009 Local ID 746a1a3e-6177-42e3-9a45-44beb2856c56 Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1237576627.818:385): avc: denied { read } for pid=11770 comm="pppd" name="options" dev=dm-0 ino=360195 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:pppd_etc_rw_t:s0 tclass=file node=localhost.localdomain type=SYSCALL msg=audit(1237576627.818:385): arch=40000003 syscall=5 success=yes exit=4 a0=a10303 a1=0 a2=1b6 a3=0 items=0 ppid=11756 pid=11770 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pppd" exe="/usr/sbin/pppd" subj=system_u:system_r:hald_t:s0 key=(null) SELinux is preventing pppd (hald_t) "getattr" /etc/ppp/options (pppd_etc_rw_t). Additional Information: Source Context system_u:system_r:hald_t Target Context system_u:object_r:pppd_etc_rw_t Target Objects /etc/ppp/options [ file ] Source pppd Source Path /usr/sbin/pppd Port <Unknown> Host localhost.localdomain Source RPM Packages ppp-2.4.4-8.fc10 Target RPM Packages ppp-2.4.4-8.fc10 Policy RPM selinux-policy-3.5.13-48.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon Feb 23 13:21:22 EST 2009 i686 i686 Alert Count 2 First Seen Fri Mar 20 19:13:17 2009 Last Seen Fri Mar 20 20:17:07 2009 Local ID c291b3a2-1c71-4baf-a2c5-f854f049f31a Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1237576627.818:386): avc: denied { getattr } for pid=11770 comm="pppd" path="/etc/ppp/options" dev=dm-0 ino=360195 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:pppd_etc_rw_t:s0 tclass=file node=localhost.localdomain type=SYSCALL msg=audit(1237576627.818:386): arch=40000003 syscall=197 success=yes exit=0 a0=4 a1=bfa6ee14 a2=40eff4 a3=e0e080 items=0 ppid=11756 pid=11770 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pppd" exe="/usr/sbin/pppd" subj=system_u:system_r:hald_t:s0 key=(null) SELinux is preventing pppd (hald_t) "read write" ./pppd2.tdb (pppd_var_run_t). Additional Information: Source Context system_u:system_r:hald_t Target Context system_u:object_r:pppd_var_run_t Target Objects ./pppd2.tdb [ file ] Source pppd Source Path /usr/sbin/pppd Port <Unknown> Host localhost.localdomain Source RPM Packages ppp-2.4.4-8.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-48.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon Feb 23 13:21:22 EST 2009 i686 i686 Alert Count 2 First Seen Fri Mar 20 19:13:17 2009 Last Seen Fri Mar 20 20:17:07 2009 Local ID 1bef60ad-3bca-46eb-bb03-64983c6e80e0 Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1237576627.878:387): avc: denied { read write } for pid=11770 comm="pppd" name="pppd2.tdb" dev=dm-0 ino=5272278 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:pppd_var_run_t:s0 tclass=file node=localhost.localdomain type=SYSCALL msg=audit(1237576627.878:387): arch=40000003 syscall=5 success=yes exit=7 a0=a10333 a1=42 a2=1a4 a3=0 items=0 ppid=11756 pid=11770 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pppd" exe="/usr/sbin/pppd" subj=system_u:system_r:hald_t:s0 key=(null) SELinux is preventing pppd (hald_t) "getattr" /var/run/pppd2.tdb (pppd_var_run_t). Additional Information: Source Context system_u:system_r:hald_t Target Context system_u:object_r:pppd_var_run_t Target Objects /var/run/pppd2.tdb [ file ] Source pppd Source Path /usr/sbin/pppd Port <Unknown> Host localhost.localdomain Source RPM Packages ppp-2.4.4-8.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-48.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon Feb 23 13:21:22 EST 2009 i686 i686 Alert Count 2 First Seen Fri Mar 20 19:13:17 2009 Last Seen Fri Mar 20 20:17:07 2009 Local ID 07544813-1176-427b-ab4a-dded6daaf56e Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1237576627.878:388): avc: denied { getattr } for pid=11770 comm="pppd" path="/var/run/pppd2.tdb" dev=dm-0 ino=5272278 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:pppd_var_run_t:s0 tclass=file node=localhost.localdomain type=SYSCALL msg=audit(1237576627.878:388): arch=40000003 syscall=197 success=yes exit=0 a0=7 a1=bfa6f674 a2=40eff4 a3=e10f98 items=0 ppid=11756 pid=11770 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pppd" exe="/usr/sbin/pppd" subj=system_u:system_r:hald_t:s0 key=(null) SELinux is preventing pppd (hald_t) "create" ./LCK..ttyUSB0 (var_lock_t). Additional Information: Source Context system_u:system_r:hald_t Target Context system_u:object_r:var_lock_t Target Objects ./LCK..ttyUSB0 [ file ] Source pppd Source Path /usr/sbin/pppd Port <Unknown> Host localhost.localdomain Source RPM Packages ppp-2.4.4-8.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-48.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon Feb 23 13:21:22 EST 2009 i686 i686 Alert Count 2 First Seen Fri Mar 20 19:13:17 2009 Last Seen Fri Mar 20 20:17:07 2009 Local ID e59e15b8-a651-430a-9581-79bd1e36e4f7 Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1237576627.879:389): avc: denied { create } for pid=11771 comm="pppd" name="LCK..ttyUSB0" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lock_t:s0 tclass=file node=localhost.localdomain type=AVC msg=audit(1237576627.879:389): avc: denied { read write } for pid=11771 comm="pppd" name="LCK..ttyUSB0" dev=dm-0 ino=5265361 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lock_t:s0 tclass=file node=localhost.localdomain type=SYSCALL msg=audit(1237576627.879:389): arch=40000003 syscall=5 success=yes exit=8 a0=a27520 a1=c2 a2=1a4 a3=bfa6e6ec items=0 ppid=1 pid=11771 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pppd" exe="/usr/sbin/pppd" subj=system_u:system_r:hald_t:s0 key=(null) SELinux is preventing hal-dccm (hald_dccm_t) "getattr" hald_dccm_t. Additional Information: Source Context system_u:system_r:hald_dccm_t Target Context system_u:system_r:hald_dccm_t Target Objects pipe [ fifo_file ] Source hal-dccm Source Path /usr/libexec/hal-dccm Port <Unknown> Host localhost.localdomain Source RPM Packages synce-hal-0.1-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-48.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon Feb 23 13:21:22 EST 2009 i686 i686 Alert Count 2 First Seen Fri Mar 20 19:13:17 2009 Last Seen Fri Mar 20 20:17:07 2009 Local ID 03e073b1-7c9a-41d6-9eea-c736309b5f8f Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1237576627.903:390): avc: denied { getattr } for pid=11756 comm="hal-dccm" path="pipe:[209228]" dev=pipefs ino=209228 scontext=system_u:system_r:hald_dccm_t:s0 tcontext=system_u:system_r:hald_dccm_t:s0 tclass=fifo_file node=localhost.localdomain type=SYSCALL msg=audit(1237576627.903:390): arch=40000003 syscall=197 success=yes exit=0 a0=5 a1=bfcb2aac a2=6aeff4 a3=5 items=0 ppid=2129 pid=11756 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="hal-dccm" exe="/usr/libexec/hal-dccm" subj=system_u:system_r:hald_dccm_t:s0 key=(null) SELinux is preventing hal-dccm (hald_dccm_t) "create" hald_dccm_t. Additional Information: Source Context system_u:system_r:hald_dccm_t Target Context system_u:system_r:hald_dccm_t Target Objects None [ unix_dgram_socket ] Source hal-dccm Source Path /usr/libexec/hal-dccm Port <Unknown> Host localhost.localdomain Source RPM Packages synce-hal-0.1-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-48.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon Feb 23 13:21:22 EST 2009 i686 i686 Alert Count 2 First Seen Fri Mar 20 19:13:17 2009 Last Seen Fri Mar 20 20:17:07 2009 Local ID c1f75682-ab61-46ea-85f2-3e081eedfc01 Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1237576627.903:391): avc: denied { create } for pid=11756 comm="hal-dccm" scontext=system_u:system_r:hald_dccm_t:s0 tcontext=system_u:system_r:hald_dccm_t:s0 tclass=unix_dgram_socket node=localhost.localdomain type=SYSCALL msg=audit(1237576627.903:391): arch=40000003 syscall=102 success=yes exit=0 a0=1 a1=bfcb2540 a2=6aeff4 a3=6b23cc items=0 ppid=2129 pid=11756 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="hal-dccm" exe="/usr/libexec/hal-dccm" subj=system_u:system_r:hald_dccm_t:s0 key=(null) SELinux is preventing hal-dccm (hald_dccm_t) "connect" hald_dccm_t. Additional Information: Source Context system_u:system_r:hald_dccm_t Target Context system_u:system_r:hald_dccm_t Target Objects None [ unix_dgram_socket ] Source hal-dccm Source Path /usr/libexec/hal-dccm Port <Unknown> Host localhost.localdomain Source RPM Packages synce-hal-0.1-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-48.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon Feb 23 13:21:22 EST 2009 i686 i686 Alert Count 2 First Seen Fri Mar 20 19:13:17 2009 Last Seen Fri Mar 20 20:17:07 2009 Local ID b2c25766-1a6d-4453-a81b-9a895be0a06b Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1237576627.903:392): avc: denied { connect } for pid=11756 comm="hal-dccm" scontext=system_u:system_r:hald_dccm_t:s0 tcontext=system_u:system_r:hald_dccm_t:s0 tclass=unix_dgram_socket node=localhost.localdomain type=AVC msg=audit(1237576627.903:392): avc: denied { write } for pid=11756 comm="hal-dccm" name="log" dev=tmpfs ino=7412 scontext=system_u:system_r:hald_dccm_t:s0 tcontext=system_u:object_r:devlog_t:s0 tclass=sock_file node=localhost.localdomain type=AVC msg=audit(1237576627.903:392): avc: denied { sendto } for pid=11756 comm="hal-dccm" path="/dev/log" scontext=system_u:system_r:hald_dccm_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=unix_dgram_socket node=localhost.localdomain type=SYSCALL msg=audit(1237576627.903:392): arch=40000003 syscall=102 success=yes exit=0 a0=3 a1=bfcb2540 a2=6aeff4 a3=0 items=0 ppid=2129 pid=11756 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="hal-dccm" exe="/usr/libexec/hal-dccm" subj=system_u:system_r:hald_dccm_t:s0 key=(null) SELinux is preventing hal-dccm (hald_dccm_t) "search" ./dbus (system_dbusd_var_run_t). Additional Information: Source Context system_u:system_r:hald_dccm_t Target Context system_u:object_r:system_dbusd_var_run_t Target Objects ./dbus [ dir ] Source hal-dccm Source Path /usr/libexec/hal-dccm Port <Unknown> Host localhost.localdomain Source RPM Packages synce-hal-0.1-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-48.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon Feb 23 13:21:22 EST 2009 i686 i686 Alert Count 2 First Seen Fri Mar 20 19:13:17 2009 Last Seen Fri Mar 20 20:17:07 2009 Local ID 418b2252-1561-4209-ba8d-8ed9f4917c7b Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1237576627.907:393): avc: denied { search } for pid=11756 comm="hal-dccm" name="dbus" dev=dm-0 ino=5265901 scontext=system_u:system_r:hald_dccm_t:s0 tcontext=system_u:object_r:system_dbusd_var_run_t:s0 tclass=dir node=localhost.localdomain type=AVC msg=audit(1237576627.907:393): avc: denied { write } for pid=11756 comm="hal-dccm" name="system_bus_socket" dev=dm-0 ino=5265775 scontext=system_u:system_r:hald_dccm_t:s0 tcontext=system_u:object_r:system_dbusd_var_run_t:s0 tclass=sock_file node=localhost.localdomain type=AVC msg=audit(1237576627.907:393): avc: denied { connectto } for pid=11756 comm="hal-dccm" path="/var/run/dbus/system_bus_socket" scontext=system_u:system_r:hald_dccm_t:s0 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=localhost.localdomain type=SYSCALL msg=audit(1237576627.907:393): arch=40000003 syscall=102 success=yes exit=0 a0=3 a1=bfcb28a0 a2=87bff4 a3=1f items=0 ppid=2129 pid=11756 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="hal-dccm" exe="/usr/libexec/hal-dccm" subj=system_u:system_r:hald_dccm_t:s0 key=(null) SELinux is preventing pppd (hald_t) "read" ./pap-secrets (pppd_secret_t). Additional Information: Source Context system_u:system_r:hald_t Target Context system_u:object_r:pppd_secret_t Target Objects ./pap-secrets [ file ] Source pppd Source Path /usr/sbin/pppd Port <Unknown> Host localhost.localdomain Source RPM Packages ppp-2.4.4-8.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-48.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon Feb 23 13:21:22 EST 2009 i686 i686 Alert Count 1 First Seen Fri Mar 20 20:17:08 2009 Last Seen Fri Mar 20 20:17:08 2009 Local ID 8790ca12-4cd3-468f-917b-b29956652895 Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1237576628.453:394): avc: denied { read } for pid=11771 comm="pppd" name="pap-secrets" dev=dm-0 ino=360200 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:pppd_secret_t:s0 tclass=file node=localhost.localdomain type=SYSCALL msg=audit(1237576628.453:394): arch=40000003 syscall=5 success=yes exit=11 a0=a135e5 a1=0 a2=1b6 a3=0 items=0 ppid=1 pid=11771 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyUSB0 ses=4294967295 comm="pppd" exe="/usr/sbin/pppd" subj=system_u:system_r:hald_t:s0 key=(null) SELinux is preventing pppd (hald_t) "getattr" /etc/ppp/pap-secrets (pppd_secret_t). Additional Information: Source Context system_u:system_r:hald_t Target Context system_u:object_r:pppd_secret_t Target Objects /etc/ppp/pap-secrets [ file ] Source pppd Source Path /usr/sbin/pppd Port <Unknown> Host localhost.localdomain Source RPM Packages ppp-2.4.4-8.fc10 Target RPM Packages ppp-2.4.4-8.fc10 Policy RPM selinux-policy-3.5.13-48.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon Feb 23 13:21:22 EST 2009 i686 i686 Alert Count 1 First Seen Fri Mar 20 20:17:08 2009 Last Seen Fri Mar 20 20:17:08 2009 Local ID a4d794e1-18d5-41fd-a755-2f68eb4aefc4 Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1237576628.453:395): avc: denied { getattr } for pid=11771 comm="pppd" path="/etc/ppp/pap-secrets" dev=dm-0 ino=360200 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:pppd_secret_t:s0 tclass=file node=localhost.localdomain type=SYSCALL msg=audit(1237576628.453:395): arch=40000003 syscall=197 success=yes exit=0 a0=b a1=bfa6f1c4 a2=40eff4 a3=a135e5 items=0 ppid=1 pid=11771 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyUSB0 ses=4294967295 comm="pppd" exe="/usr/sbin/pppd" subj=system_u:system_r:hald_t:s0 key=(null) SELinux is preventing pppd (hald_t) "getattr" /etc/ppp/ip-up (pppd_initrc_exec_t). Additional Information: Source Context system_u:system_r:hald_t Target Context system_u:object_r:pppd_initrc_exec_t Target Objects /etc/ppp/ip-up [ file ] Source pppd Source Path /usr/sbin/pppd Port <Unknown> Host localhost.localdomain Source RPM Packages ppp-2.4.4-8.fc10 Target RPM Packages initscripts-8.86-1 Policy RPM selinux-policy-3.5.13-48.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon Feb 23 13:21:22 EST 2009 i686 i686 Alert Count 2 First Seen Fri Mar 20 19:13:18 2009 Last Seen Fri Mar 20 20:17:08 2009 Local ID 231cc7e5-6eb3-4cb8-8f3c-f901c9e464b8 Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1237576628.498:396): avc: denied { getattr } for pid=11771 comm="pppd" path="/etc/ppp/ip-up" dev=dm-0 ino=361994 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:pppd_initrc_exec_t:s0 tclass=file node=localhost.localdomain type=SYSCALL msg=audit(1237576628.498:396): arch=40000003 syscall=195 success=yes exit=0 a0=a12036 a1=bfa6f584 a2=40eff4 a3=bfa6f6d8 items=0 ppid=1 pid=11771 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyUSB0 ses=4294967295 comm="pppd" exe="/usr/sbin/pppd" subj=system_u:system_r:hald_t:s0 key=(null) SELinux is preventing ip-up (hald_t) "execute" ./ip-up (pppd_initrc_exec_t). Additional Information: Source Context system_u:system_r:hald_t Target Context system_u:object_r:pppd_initrc_exec_t Target Objects ./ip-up [ file ] Source ip-up Source Path /bin/bash Port <Unknown> Host localhost.localdomain Source RPM Packages bash-3.2-30.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-48.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon Feb 23 13:21:22 EST 2009 i686 i686 Alert Count 2 First Seen Fri Mar 20 19:13:18 2009 Last Seen Fri Mar 20 20:17:08 2009 Local ID 9c0bf4d7-e98d-46b5-8e98-b727169803af Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1237576628.498:397): avc: denied { execute } for pid=11784 comm="pppd" name="ip-up" dev=dm-0 ino=361994 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:pppd_initrc_exec_t:s0 tclass=file node=localhost.localdomain type=AVC msg=audit(1237576628.498:397): avc: denied { read } for pid=11784 comm="pppd" name="ip-up" dev=dm-0 ino=361994 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:pppd_initrc_exec_t:s0 tclass=file node=localhost.localdomain type=AVC msg=audit(1237576628.498:397): avc: denied { execute_no_trans } for pid=11784 comm="pppd" path="/etc/ppp/ip-up" dev=dm-0 ino=361994 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:pppd_initrc_exec_t:s0 tclass=file node=localhost.localdomain type=SYSCALL msg=audit(1237576628.498:397): arch=40000003 syscall=11 success=yes exit=0 a0=a12036 a1=bfa6f6b8 a2=e0e018 a3=0 items=0 ppid=11771 pid=11784 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip-up" exe="/bin/bash" subj=system_u:system_r:hald_t:s0 key=(null) SELinux is preventing ip-up (hald_t) "ioctl" /etc/ppp/ip-up (pppd_initrc_exec_t). Additional Information: Source Context system_u:system_r:hald_t Target Context system_u:object_r:pppd_initrc_exec_t Target Objects /etc/ppp/ip-up [ file ] Source ip-up Source Path /bin/bash Port <Unknown> Host localhost.localdomain Source RPM Packages bash-3.2-30.fc10 Target RPM Packages initscripts-8.86-1 Policy RPM selinux-policy-3.5.13-48.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon Feb 23 13:21:22 EST 2009 i686 i686 Alert Count 2 First Seen Fri Mar 20 19:13:18 2009 Last Seen Fri Mar 20 20:17:08 2009 Local ID 0ec7c0de-0086-4c13-b618-bf4858af6f41 Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1237576628.500:398): avc: denied { ioctl } for pid=11784 comm="ip-up" path="/etc/ppp/ip-up" dev=dm-0 ino=361994 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:pppd_initrc_exec_t:s0 tclass=file node=localhost.localdomain type=SYSCALL msg=audit(1237576628.500:398): arch=40000003 syscall=54 success=no exit=-25 a0=3 a1=5401 a2=bf832bd8 a3=bf832c18 items=0 ppid=11771 pid=11784 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip-up" exe="/bin/bash" subj=system_u:system_r:hald_t:s0 key=(null) SELinux is preventing hal-dccm (hald_dccm_t) "write" hald_dccm_t. Additional Information: Source Context system_u:system_r:hald_dccm_t Target Context system_u:system_r:hald_dccm_t Target Objects None [ unix_dgram_socket ] Source hal-dccm Source Path /usr/libexec/hal-dccm Port <Unknown> Host localhost.localdomain Source RPM Packages synce-hal-0.1-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-48.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon Feb 23 13:21:22 EST 2009 i686 i686 Alert Count 3 First Seen Fri Mar 20 19:13:18 2009 Last Seen Fri Mar 20 20:17:08 2009 Local ID bc1a16c5-af3f-42c0-9563-62a8cdf9eb69 Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1237576628.514:405): avc: denied { write } for pid=11756 comm="hal-dccm" scontext=system_u:system_r:hald_dccm_t:s0 tcontext=system_u:system_r:hald_dccm_t:s0 tclass=unix_dgram_socket node=localhost.localdomain type=SYSCALL msg=audit(1237576628.514:405): arch=40000003 syscall=102 success=yes exit=86 a0=9 a1=bfcb23f4 a2=6aeff4 a3=14 items=0 ppid=2129 pid=11756 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="hal-dccm" exe="/usr/libexec/hal-dccm" subj=system_u:system_r:hald_dccm_t:s0 key=(null) Albert

1 0

Newbie Q
by Aaron Gray 21 Mar '09

21 Mar '09

I am trying to audit2allow on F10 to allow a cgi-bin perl script to run on Apache. Runs fine in permissive mode not in enforcing. I bought the O'Reilly SE Linux book and learned the basics but it does not really seem to help me on Fedora. there was no /var/log/kernel so I tried /var/log/secure with the following command sequence setenforce 0 # access the cgi from the web setenforce 1 audit2allow -l -i /var/log/secure What is strange also is the system is not flagging things up as a notification icon anymore in enforcing mode. If someone could guide me or push me in the right direction I would be most thankful. Aaron

3 7

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux March 2009