selinux November 2012

selinux@lists.fedoraproject.org

21 participants
13 discussions

file, executable, and policy
by ken 05 Nov '12

05 Nov '12

It's nice with selinux that a notification window pops up when a violation has been detected... and then that it's a simple matter to click on an icon to pop open a window with much more information. But lacking in that window is critical information necessary to identify and then perhaps resolve the issue. Fundamentally the action of some executable has tried, against policy, to access some file. So why doesn't this page list: - the name of the file, including full path, against which access was attempted; - the name of the executable, including full path, which tried to access that file; and -- text explaining the policy which was violated, or at least a link to it? I've had selinux installed for some years now (in permissive mode), but am considering uninstalling it because, lacking this obvious and critical information, there doesn't seem to be a point to it.

4 7

Re: Bug 539519: selinux doesn't like httpd trying to read /var/run/pcscd.pid
by mark 02 Nov '12

02 Nov '12

Since I posted about a week and a half ago, I haven't seen any response. This is an example of what I think Dan was asking about. time->Thu Nov 1 16:00:01 2012 type=SYSCALL msg=audit(1351800001.262:133107): arch=c000003e syscall=2 success=yes exit=18 a0=7ffea2fdde22 a1=0 a2=1b6 a3=0 items=0 ppid=20709 pid=20713 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=5118 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1351800001.262:133107): avc: denied { open } for pid=20713 comm="httpd" name="pcscd.pid" dev=sda3 ino=81412261 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:pcscd_var_run_t:s0 tclass=file type=AVC msg=audit(1351800001.262:133107): avc: denied { read } for pid=20713 comm="httpd" name="pcscd.pid" dev=sda3 ino=81412261 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:pcscd_var_run_t:s0 tclass=file And just to clarify, I believe what's doing this is that the webserver for svn is checking the user's smart card before allowing them to check files out. mark

2 1

AWStats Update-now link has permissions issues
by Dan Thurman 01 Nov '12

01 Nov '12

Did anyone get awstats "Update now" button to work? For me, awstats does not have permissions to access /tmp for locking (if enabled) and/or to open /var/log/httpd/access_log file in attempts to update the awstats data. I am running selinux, but not certain it is an selinux issue...

5 19

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux November 2012