New subject: motion

18 Apr 2018


      On Sun, 15 Apr 2018 20:48. ukas Vrabec lvrabec@redhat.com wrote:
...
On 04/12/2018 10:49 PM, m.roth@5-cent.us wrote:
...
Got a CentOS 7 box running motion. Selinux is complaining that one of the
scripts motion runs is mislabeled. Here's what it is.
system_u:object_r:nfs_t:s0       /home/motion/bin/on_move_end
Now, ~motion is NFS mounted, and we've got use_nfs_home_dirs --> on, so
what *would* the proper label be, or do I really need to create a policy
for this?
Could you please reproduce issue on your system and then attach output of:
# ausearch -m AVC -ts today
It's been a busy week - sorry it took this long to respond. Do you
*really* want all of it - this happens whenever someone goes into the
secure room and is on video... and there are four cameras. Just today, I
get 79k worth of o/p.
Here's the most recent minute's o/p:
time->Wed Apr 18 11:21:32 2018
type=PROCTITLE msg=audit(1524064892.294:35325):
proctitle=7368002D63002F686F6D652F6D6F74696F6E2F62696E2F6F6E5F6D6F76655F656E64202F686F6D652F6D6F74696F6E2F63616D6572612F323031382D30342D31382F323031382D30342D31382D3131313134352D31322D6172676F2D312E617669203120323031382D30342D3138002026
type=SYSCALL msg=audit(1524064892.294:35325): arch=c000003e syscall=59
success=yes exit=0 a0=af4fe0 a1=af5040 a2=af3b90 a3=7ffd1c86d700 items=0
ppid=1438 pid=11961 auid=4294967295 uid=489 gid=39 euid=489 suid=489
fsuid=489 egid=39 sgid=39 fsgid=39 tty=(none) ses=4294967295
comm="on_move_end" exe="/usr/bin/bash" subj=system_u:system_r:motion_t:s0
key=(null)
type=AVC msg=audit(1524064892.294:35325): avc:  denied  { execute_no_trans
} for  pid=11961 comm="sh" path="/home/motion/bin/on_move_end" dev="0:46"
ino=53198849 scontext=system_u:system_r:motion_t:s0
tcontext=system_u:object_r:nfs_t:s0 tclass=file
type=AVC msg=audit(1524064892.294:35325): avc:  denied  { execute } for 
pid=11961 comm="sh" name="on_move_end" dev="0:46" ino=53198849
scontext=system_u:system_r:motion_t:s0 tcontext=system_u:object_r:nfs_t:s0
tclass=file
----
time->Wed Apr 18 11:21:32 2018
type=PROCTITLE msg=audit(1524064892.291:35324):
proctitle=7368002D63002F686F6D652F6D6F74696F6E2F62696E2F6F6E5F6D6F76655F656E64202F686F6D652F6D6F74696F6E2F63616D6572612F323031382D30342D31382F323031382D30342D31382D3131313134352D31322D6172676F2D312E617669203120323031382D30342D3138002026
type=SYSCALL msg=audit(1524064892.291:35324): arch=c000003e syscall=59
success=yes exit=0 a0=432503 a1=7ff42f7f9b00 a2=7ffc2ba4b760
a3=7ff42f7fb730 items=0 ppid=1438 pid=11961 auid=4294967295 uid=489 gid=39
euid=489 suid=489 fsuid=489 egid=39 sgid=39 fsgid=39 tty=(none)
ses=4294967295 comm="sh" exe="/usr/bin/bash"
subj=system_u:system_r:motion_t:s0 key=(null)
type=AVC msg=audit(1524064892.291:35324): avc:  denied  { execute_no_trans
} for  pid=11961 comm="motion" path="/usr/bin/bash" dev="dm-1" ino=98
scontext=system_u:system_r:motion_t:s0
tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
----
time->Wed Apr 18 11:22:22 2018
type=PROCTITLE msg=audit(1524064942.249:35327):
proctitle=2F62696E2F7368002F686F6D652F6D6F74696F6E2F62696E2F6F6E5F6D6F76655F656E64002F686F6D652F6D6F74696F6E2F63616D6572612F323031382D30342D31382F323031382D30342D31382D3131323033342D30362D6172676F2D332E617669003300323031382D30342D3138
type=SYSCALL msg=audit(1524064942.249:35327): arch=c000003e syscall=59
success=yes exit=0 a0=78eb50 a1=78eb70 a2=78e8b0 a3=7ffdcf4d8af0 items=0
ppid=12042 pid=12043 auid=4294967295 uid=489 gid=39 euid=489 suid=489
fsuid=489 egid=39 sgid=39 fsgid=39 tty=(none) ses=4294967295 comm="uname"
exe="/usr/bin/uname" subj=system_u:system_r:motion_t:s0 key=(null)
type=AVC msg=audit(1524064942.249:35327): avc:  denied  { execute_no_trans
} for  pid=12043 comm="on_move_end" path="/usr/bin/uname" dev="dm-1"
ino=259829 scontext=system_u:system_r:motion_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=file
----
time->Wed Apr 18 11:22:22 2018
type=PROCTITLE msg=audit(1524064942.249:35326):
proctitle=2F62696E2F7368002F686F6D652F6D6F74696F6E2F62696E2F6F6E5F6D6F76655F656E64002F686F6D652F6D6F74696F6E2F63616D6572612F323031382D30342D31382F323031382D30342D31382D3131323033342D30362D6172676F2D332E617669003300323031382D30342D3138
type=SYSCALL msg=audit(1524064942.249:35326): arch=c000003e syscall=21
success=yes exit=0 a0=78eb50 a1=1 a2=7ffdcf4d8d40 a3=7ffdcf4d89d0 items=0
ppid=12042 pid=12043 auid=4294967295 uid=489 gid=39 euid=489 suid=489
fsuid=489 egid=39 sgid=39 fsgid=39 tty=(none) ses=4294967295
comm="on_move_end" exe="/usr/bin/bash" subj=system_u:system_r:motion_t:s0
key=(null)
type=AVC msg=audit(1524064942.249:35326): avc:  denied  { execute } for 
pid=12043 comm="on_move_end" name="uname" dev="dm-1" ino=259829
scontext=system_u:system_r:motion_t:s0 tcontext=system_u:object_r:bin_t:s0
tclass=file
mark

Re: motion