Memory protection and system-config-securitylevel
by Kamil J. Dudek
Hello everybody
Forgive me, if this subject has already been mentioned here, but I
simply couldn't find answer anywhere.
Few days ago I started system-config-securitylevel. I found something
interesting in "Modify SELinux policies". A memory protection - there
are four options in there. Two of them are enabled, with a description
that if having this enabled is required by some program, it should be
reported to bugzilla. I didn't do it, because of very strange effects
after turning it off.
Disabling
"Allow all executable files to map memory areas as executable and
readable, which is dangerous and such program should be reported to
bugzilla"
and
"Allow all executable files to mark stack as executable.That shouldn't
ever be required"
option(translation from polish) made system act very strange. First
thing I've observed was that Kobo game stopped working. GMPC stopped
playing. Also stuff outside of Fedora like Java and NVidia drivers
failed. So I should have "reported to bugzilla" to many application to
make it have any sense. Such bug report would be only annoying but
according to system-config-securitylevel...
What is it with these two options? To make everything work properly they
should be enabled, but their description that they should be disabled is
confusing.
Thank you and forgive me any mess I've done by this post
--
Pozdrawiam - Kamil J. Dudek
14 years, 8 months
- 2
- 3
mount point labels
by Clarkson, Mike R (US SSA)
I'm attempting to create the labeled mount point with the following
command:
mount -t nfs -o context=system_u:object_r:import_file_t:s0
nas:/vol/home /home/SimulatedImport/output/home
The mount point is created without any errors, but the label that I
specify in the mount command is not used. Instead of
system_u:object_r:import_file_t, the context of the
/home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0.
ls -dZ /home/SimulatedImport/output/home
drwxr-xr-x root root system_u:object_r:nfs_t:s0
/home/m252/SimulatedImport/output/home
I'm running RHEL5 with a policy built as mls off of the targeted policy.
Does anyone know why the context label is not taking?
Thanks
14 years, 9 months
- 3
- 7
xinetd rsync --daemon problems
by Chuck Anderson
I'm using Fedora Core 6, and trying to start a rsync daemon via
xinetd. The default configuration is:
# default: off
# description: The rsync server is a good addition to an ftp server, as it \
# allows crc checksumming etc.
service rsync
{
disable = no
socket_type = stream
wait = no
user = root
server = /usr/bin/rsync
server_args = --daemon
log_on_failure += USERID
}
With this rsyncd.conf:
motd file = /etc/rsyncd.motd
pid file = /var/run/rsyncd.pid
port = 873
uid = rsyncd
gid = mirror
use chroot = yes
max connections = 10
log file = /var/log/rsyncd.log
read only = yes
hosts allow = 127.0.0.1, ::1, etc....
#hosts deny = 0.0.0.0/0, ::
ignore nonreadable = yes
transfer logging = yes
timeout = 600
dont compress = *
[fedora-linux-core]
path = /srv/ftp/pub/fedora/linux/core
comment = Fedora Linux Core
[fedora-linux-core-updates]
path = /srv/ftp/pub/fedora/linux/core/updates
comment = Fedora Linux Core Updates
[fedora-linux-extras]
path = /srv/ftp/pub/fedora/linux/extras
comment = Fedora Linux Extras
[fedora-linux-core-test]
path = /srv/ftp/pub/fedora/linux/core/test
comment = Fedora Linux Core Test
[fedora-linux-releases]
path = /srv/ftp/pub/fedora/linux/releases
comment = Fedora Linux Releases
[fedora-linux-development]
path = /srv/ftp/pub/fedora/linux/development
comment = Fedora Linux Development
[fedora-enchilada]
path = /srv/ftp/pub/fedora
comment = Fedora - The whole enchilada
[fedora-linux-updates]
path = /srv/ftp/pub/fedora/linux/updates
comment = Fedora Linux Updates
[fedora-web]
path = /srv/ftp/pub/fedora/web
comment = Web content for Fedora Linux mirrors
I get these AVCs when running from xinetd and making a client
connection that I don't get if I start the daemon directly via "rsync
--daemon" as root:
type=AVC msg=audit(1192132336.713:3464): avc: denied { lock } for
pid=8488 comm="rsync" name="rsyncd.lock" dev=dm-4 ino=2064435
scontext=user_u:system_r:rsync_t:s0
tcontext=root:object_r:var_run_t:s0 tclass=file
type=SYSCALL msg=audit(1192132336.713:3464): arch=40000003 syscall=221
success=no exit=-13 a0=4 a1=d a2=bff80730 a3=bff80730 items=0
ppid=8167 pid=8488 auid=10002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="rsync" exe="/usr/bin/rsync"
subj=user_u:system_r:rsync_t:s0 key=(null)
type=AVC_PATH msg=audit(1192132336.713:3464):
path="/var/run/rsyncd.lock"
type=AVC msg=audit(1192132400.044:3465): avc: denied { bind } for
pid=8499 comm="rsync" scontext=user_u:system_r:rsync_t:s0
tcontext=user_u:system_r:rsync_t:s0 tclass=netlink_route_socket
type=SYSCALL msg=audit(1192132400.044:3465): arch=40000003 syscall=102
success=no exit=-13 a0=2 a1=bf8f4674 a2=4df50ff4 a3=3 items=0
ppid=8167 pid=8499 auid=10002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="rsync" exe="/usr/bin/rsync"
subj=user_u:system_r:rsync_t:s0 key=(null)
I tried creating and loading a policy module:
# grep "rsync" /var/log/audit/audit.log | audit2allow -M rsyncd
# semodule -i rsyncd.pp
Here is rsyncd.te:
module rsyncd 1.0;
require {
type var_run_t;
type rsync_t;
class netlink_route_socket create;
class file { read write };
}
#============= rsync_t ==============
allow rsync_t self:netlink_route_socket create;
allow rsync_t var_run_t:file { read write };
But I still get these AVCs:
type=AVC msg=audit(1192139751.238:3586): avc: denied { bind } for
pid=9311 comm="rsync" scontext=user_u:system_r:rsync_t:s0
tcontext=user_u:system_r:rsync_t:s0 tclass=netlink_route_socket
type=SYSCALL msg=audit(1192139751.238:3586): arch=40000003 syscall=102
success=no exit=-13 a0=2 a1=bfbb6144 a2=4df50ff4 a3=3 items=0
ppid=8732 pid=9311 auid=10002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="rsync" exe="/usr/bin/rsync"
subj=user_u:system_r:rsync_t:s0 key=(null)
Additionally, when using xinetd I don't ever get any log messages in
/var/log/rsyncd.log like I do when I run "rsync --daemon" directly:
2007/10/11 17:08:01 [8613] rsyncd version 2.6.9 starting, listening on port 873
2007/10/11 17:08:13 [8616] connect from dustpuppy.wpi.edu (2001:468:616:8c9:213:72ff:fe74:da15)
2007/10/11 17:08:13 [8616] rsync on fedora-enchilada/linux/ from dustpuppy.wpi.edu (2001:468:616:8c9:213:72ff:fe74:da15)
2007/10/11 21:08:13 [8616] building file list
2007/10/11 21:08:13 [8616] sent 1629 bytes received 106 bytes total size 19
15 years, 11 months
- 2
- 2
Sendmail milters in Fedora 8
by Paul Howarth
Since upgrading my mail server from Fedora 7 to Fedora 8, I've come
across some problems with the sockets used for communication between
sendmail and two of the "milter" plugins I'm using with it, namely
milter-regex and spamass-milter. It's very likely that other milters
will have similar issues.
The sockets used are created when the milter starts, as follows:
milter-regex:
/var/spool/milter-regex/sock (var_spool_t, inherited from parent directory)
spamass-milter:
/var/run/spamass-milter/spamass-milter.sock (spamd_var_run_t, in policy)
These are pretty well the upstream locations, though I'm open to moving
the milter-regex socket from /var/spool to /var/run or elsewhere for
consistency.
Since moving to Fedora 8, I've had to add the following to local policy
to get these milters working:
allow sendmail_t spamd_var_run_t:dir { search getattr };
allow sendmail_t spamd_var_run_t:sock_file { getattr write };
allow sendmail_t var_spool_t:sock_file { getattr write };
allow sendmail_t initrc_t:unix_stream_socket { read write connectto };
The last of these is the strangest, and relates to Bug #425958
(https://bugzilla.redhat.com/show_bug.cgi?id=425958). Whilst the socket
file itself has the context listed above, the unix domain socket that
sendmail connects to is still initrc_t, as can be seen from the output
of "netstat -lpZ":
...
unix 2 [ ACC ] STREAM LISTENING 14142
5853/spamass-milter system_u:system_r:initrc_t:s0
/var/run/spamass-milter/spamass-milter.sock
unix 2 [ ACC ] STREAM LISTENING 13794
5779/milter-regex system_u:system_r:initrc_t:s0
/var/spool/milter-regex/sock
...
So, my questions are:
1. Why are the sockets still initrc_t?
2. Is this a kernel issue or a userspace issue that should be fixed in
the milters?
3. Should there be a standard place for milter sockets to live, and if
so, where?
4. How come this worked OK in Fedora 7 and previous releases?
Paul.
16 years
- 2
- 13
Fedora buildsys and SELinux
by Karsten Wade
As announced on fedora-devel-list[1], we'd like to come to a resolution
(consensus, actions) on the challenges we have with SELinux in the
Fedora build system.
I expect the following:
* All the parties are here now needed to figure this out
* Someone better than me is going to reply with specifics about what is
not working in the buildsys
* We all agree it's pretty important to get this figured out in a good
way
One example of a project blocking on this work is the Fedora spin
server. We would have to put a non-SELinux secured server in the loop
somewhere for the actual spin building, and any way we do that is going
to be hacky and whacky.
The main problem I see outside of the technical issues is a marketing
one. Fedora's infrastructure is a set of open tools that anyone can
download and make work themselves. We know that people do that. Fedora
Infrastructure is a feature producer; just as Fedora Docs supplies a
full-course documentation toolchain, so does Infrastructure supply a
full-course FLOSS project toolset.[2]
We do *not* want to be explaining that a new feature doesn't work with
SELinux. At the very minimum, we have been consistent about the value
of SELinux in Fedora, and to ship something as a Fedora feature that
cannot run under SELinux ... well, that would be bad.
This is why other Fedora folks are asking the Fedora SELinux team to
take this off the backburner.
Thanks - Karsten
[1] https://www.redhat.com/archives/fedora-devel-list/2008-April/msg01064.html
[2] Yep, that's right; Fedora Infrastructure is a feature of Fedora.
For example, the new grid project 'Fedora Sleepwalker' is looking to get
integrated into firstboot or some kind of JoinBuddy. When that happens,
adding your install to the Fedora Sleepwalker grid is going to be touted
as a major feature for that release.
--
Karsten Wade, Sr. Developer Community Mgr.
Dev Fu : http://developer.redhatmagazine.com
Fedora : http://quaid.fedorapeople.org
gpg key : AD0E0C41
16 years, 1 month
- 13
- 50
Starting stunnel from xinetd
by Ian Pilcher
Running fully updated Fedora 8, trying to start stunnel from xinetd, and
getting a couple of denials:
type=AVC msg=audit(1205149512.996:2338): avc: denied { write } for
pid=14322 comm="stunnel" name="random_seed" dev=md1 ino=819429
scontext=unconfined_u:system_r:stunnel_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:stunnel_etc_t:s0 tclass=file
type=AVC msg=audit(1205149512.998:2339): avc: denied { name_bind } for
pid=14322 comm="stunnel" src=2873
scontext=unconfined_u:system_r:stunnel_t:s0-s0:c0.c1023
tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket
Aren't these things that stunnel should be expected to do?
--
========================================================================
Ian Pilcher arequipeno(a)gmail.com
========================================================================
16 years, 1 month
- 2
- 9
postfix with maildir delivery
by freeslkr
Hello,
I'm trying out SELinux on Fedora 8 in permissive mode. I get AVCs
everytime postfix delivers mail to the maildir directories. It looks
like postfix doesn't have permission to create files. For example,
from /var/log/messages:
SELinux is preventing local (postfix_local_t) "link" to
./1208923427.P3686.myhost (mail_spool_t)
from /var/log/audit/audit.log:
type=AVC msg=audit(1208923427.350:95): avc: denied { link } for
pid=3686 comm="local" name="1208923427.P3686.myhost" dev=dm-3
ino=819271 scontext=system_u:system_r:postfix_local_t:s0
tcontext=system_u:object_r:mail_spool_t:s0 tclass=file
type=SYSCALL msg=audit(1208923427.350:95): arch=c000003e
syscall=86 success=yes exit=0 a0=2aaaaad599c0 a1=2aaaaad59ba0
a2=0 a3=0 items=0 ppid=2371 pid=3686 auid=4294967295 uid=0 gid=0
euid=1000 suid=0 fsuid=1000 egid=1000 sgid=0 fsgid=1000 tty=(none)
comm="local" exe="/usr/libexec/postfix/local"
subj=system_u:system_r:postfix_local_t:s0 key=(null)
Is my interpretation correct. If so, is it likely that this could be
corrected in a future policy version?
Thank you for you help
16 years, 1 month
- 3
- 7
Portuguese documentation available
by Jeronimo Zucco
I wrote some documentation about selinux in portuguese. If you want to read it,
please access:
http://jczucco.googlepages.com/selinux.html
--
Jeronimo Zucco
LPIC-1 Linux Professional Institute Certified
http://jczucco.blogspot.com
---------------------------------------
Essa mensagem foi enviada pelo UCS Mail
16 years, 1 month
- 1
- 0
port numbers for sctp support?
by Chuck Anderson
Is sctp support planned?
#semanage port -a -t ssh_sctp_port_t -p sctp 22
/usr/sbin/semanage: Protocol udp or tcp is required
16 years, 2 months
- 3
- 4
Re: Fail2ban and SELinux
by max
On Thu, Apr 17, 2008 at 1:37 PM, max bianco <maximilianbianco(a)gmail.com> wrote:
>
> On Thu, Apr 17, 2008 at 1:22 PM, max bianco <maximilianbianco(a)gmail.com> wrote:
> >
> > On Thu, Apr 17, 2008 at 11:25 AM, Daniel J Walsh <dwalsh(a)redhat.com> wrote:
> > >
> > > -----BEGIN PGP SIGNED MESSAGE-----
> > > Hash: SHA1
> > >
> > > max bianco wrote:
> > > > On Wed, Apr 16, 2008 at 8:37 AM, Daniel J Walsh <dwalsh(a)redhat.com> wrote:
> > > >> -----BEGIN PGP SIGNED MESSAGE-----
> > > >> Hash: SHA1
> > > >>
> > > >>
> > > >>
> > > >> max wrote:
> > > >> > Daniel J Walsh wrote:
> > > >> >> -----BEGIN PGP SIGNED MESSAGE-----
> > > >> >> Hash: SHA1
> > > >> >>
> > > >> >> max bianco wrote:
> > > >> >>> I recently installed fail2ban on my F8 box. I don't allow remote
> > > >> >>> access to my box but it had been mentioned recently so I decided to
> > > >> >>> test it out. I installed it a few days ago but didn't do anything with
> > > >> >>> it till last night. I had forgotten about it but I was perusing log
> > > >> >>> files and saw 21 AVC's related it to it. I pulled up my services gui
> > > >> >>> and sure enough it wasn't running. I tried to start it and got
> > > >> >>> denied(it wouldn't start from a terminal at all, complaining that the
> > > >> >>> service is unrecognized). No problem , i expected as much when I saw
> > > >> >>> the AVC's in my log files but I always try things more than once so I
> > > >> >>> tried to start it a second time and this time and every time after it
> > > >> >>> started without generating a denial. Is this because I manually
> > > >> >>> started the service? That doesn't make sense because then it would
> > > >> >>> have worked the first time as well but it didn't. I see that there is
> > > >> >>> a policy module for fail2ban but if the module is in place then
> > > >> >>> shouldn't it have run without issues? Why 21 AVC's and then its
> > > >> >>> working? I am learning my way around SELinux but I don't feel
> > > >> >>> comfortable enough to troubleshoot this problem correctly, so where do
> > > >> >>> I start?
> > > >> >>>
> > > >> >>> Max
> > > >> >>>
> > > >> >>> --
> > > >> >>> fedora-selinux-list mailing list
> > > >> >>> fedora-selinux-list(a)redhat.com
> > > >> >>> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
> > > >> >> Was there a policy upgrade during this time? Problem might have been
> > > >> >> fixed.
> > > >> >>
> > > >> > The time between my first manual attempt to start fail2ban,which
> > > >> > generated an SELinux Denial, and the second, which started the service,
> > > >> > was about 30 seconds. I checked the logs again today this is a portion
> > > >> > of the output from yesterday and today :
> > > >> >
> > > >> >> Apr 14 23:24:32 localhost setroubleshoot: [program.ERROR]
> > > >> >> setroubleshoot generated AVC, exiting to avoid recursion,
> > > >> >> context=system_u:system_r:setroubleshootd_t:s0, AVC
> > > >> >> scontext=system_u:system_r:setroubleshootd_t:s0
> > > >> >> Apr 14 23:24:32 localhost setroubleshoot: [program.ERROR] audit
> > > >> >> event#012host=localhost.localdomain type=AVC
> > > >> >> msg=audit(1208229871.594:256): avc: denied { write } for pid=2530
> > > >> >> comm="setroubleshootd" name="rpm" dev=dm-0 ino=229382
> > > >> >> scontext=system_u:system_r:setroubleshootd_t:s0
> > > >> >> tcontext=system_u:object_r:rpm_var_lib_t:s0
> > > >> >> tclass=dir#012#012host=localhost.localdomain type=SYSCALL
> > > >> >> msg=audit(1208229871.594:256): arch=c000003e syscall=21 success=no
> > > >> >> exit=-13 a0=eaf2f0 a1=2 a2=0 a3=0 items=0 ppid=1 pid=2530
> > > >> >> auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
> > > >> >> fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python"
> > > >> >> subj=system_u:system_r:setroubleshootd_t:s0 key=(null)
> > > >> >> Apr 14 23:24:32 localhost setroubleshoot: [program.ERROR]
> > > >> >> setroubleshoot generated AVC, exiting to avoid recursion,
> > > >> >> context=system_u:system_r:setroubleshootd_t:s0, AVC
> > > >> >> scontext=system_u:system_r:setroubleshootd_t:s0
> > > >> >> Apr 14 23:24:32 localhost setroubleshoot: [program.ERROR] audit
> > > >> >> event#012host=localhost.localdomain type=AVC
> > > >> >> msg=audit(1208229871.595:257): avc: denied { write } for pid=2530
> > > >> >> comm="setroubleshootd" name="rpm" dev=dm-0 ino=229382
> > > >> >> scontext=system_u:system_r:setroubleshootd_t:s0
> > > >> >> tcontext=system_u:object_r:rpm_var_lib_t:s0
> > > >> >> tclass=dir#012#012host=localhost.localdomain type=SYSCALL
> > > >> >> msg=audit(1208229871.595:257): arch=c000003e syscall=21 success=no
> > > >> >> exit=-13 a0=d684a0 a1=2 a2=0 a3=0 items=0 ppid=1 pid=2530
> > > >> >> auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
> > > >> >> fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python"
> > > >> >> subj=system_u:system_r:setroubleshootd_t:s0 key=(null)
> > > >> >> Apr 15 17:26:32 localhost setroubleshoot: SELinux is preventing
> > > >> >> fail2ban-server (fail2ban_t) "getattr" to / (security_t). For complete
> > > >> >> SELinux messages. run sealert -l fe77e9af-a0e1-442b-a176-08f2db381144
> > > >> >> Apr 15 17:26:36 localhost setroubleshoot: SELinux is preventing
> > > >> >> fail2ban-server (fail2ban_t) "read" to ./config (selinux_config_t).
> > > >> >> For complete SELinux messages. run sealert -l
> > > >> >> 99f22448-5c31-4a6f-8f55-02f7404fba5d
> > > >> >> Apr 15 17:26:36 localhost setroubleshoot: SELinux is preventing
> > > >> >> fail2ban-server (fail2ban_t) "search" to / (security_t). For complete
> > > >> >> SELinux messages. run sealert -l 85b915f3-5a0b-4a2b-9bf1-c3a88bdd5951
> > > >> >> Apr 15 17:26:36 localhost setroubleshoot: SELinux is preventing
> > > >> >> fail2ban-server (fail2ban_t) "search" to / (security_t). For complete
> > > >> >> SELinux messages. run sealert -l 85b915f3-5a0b-4a2b-9bf1-c3a88bdd5951
> > > >> >> Apr 15 17:26:37 localhost setroubleshoot: [program.ERROR]
> > > >> >> setroubleshoot generated AVC, exiting to avoid recursion,
> > > >> >> context=system_u:system_r:setroubleshootd_t:s0, AVC
> > > >> >> scontext=system_u:system_r:setroubleshootd_t:s0
> > > >> >> Apr 15 17:26:37 localhost setroubleshoot: SELinux is preventing
> > > >> >> iptables (iptables_t) "read write" to socket (fail2ban_t). For
> > > >> >> complete SELinux messages. run sealert -l
> > > >> >> 6cb9955a-b9cf-470c-87d1-e72bfa4b1fe2
> > > >> >> Apr 15 17:26:37 localhost setroubleshoot: [program.ERROR] audit
> > > >> >> event#012host=localhost.localdomain type=AVC
> > > >> >> msg=audit(1208294790.920:161): avc: denied { write } for pid=2506
> > > >> >> comm="setroubleshootd" name="rpm" dev=dm-0 ino=229382
> > > >> >> scontext=system_u:system_r:setroubleshootd_t:s0
> > > >> >> tcontext=system_u:object_r:rpm_var_lib_t:s0
> > > >> >> tclass=dir#012#012host=localhost.localdomain type=SYSCALL
> > > >> >> msg=audit(1208294790.920:161): arch=c000003e syscall=21 success=no
> > > >> >> exit=-13 a0=dbf500 a1=2 a2=0 a3=0 items=0 ppid=1 pid=2506
> > > >> >> auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
> > > >> >> fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python"
> > > >> >> subj=system_u:system_r:setroubleshootd_t:s0 key=(null)
> > > >> >
> > > >> > At this point Fail2ban reports it is running .That is only a small
> > > >> > portion of what is generated but maybe it can give you an idea.
> > > >> > Subsequently SETroubleshoot crashes, specifically it says: connection
> > > >> > lost /var/run/setroubleshoot/setroubleshoot_server. The other thing is
> > > >> > that I stopped the fail2ban service and rebooted but SETroubleshoot is
> > > >> > still crashing, it will generate an AVC when I try to run it then all
> > > >> > the output is lost before I can read the AVC. As i have been flipping
> > > >> > back and forth typing this, checking logs, restarting
> > > >> > SETroubleshoot(about six or seven times now), SETroubleshoot is now up
> > > >> > and running like nothing happened. Now that SETroubleshoot is running I
> > > >> > expected to find additional AVC's from today but the last one is from
> > > >> > yesterday concerning fail2ban. The Alert Count should show 22 not 21
> > > >> > like it does (if we count the one I got the first time i tried to start
> > > >> > fail2ban manually)
> > > >> >
> > > >> > This is the AVC i was getting from Fail2ban before all this ....stuff
> > > >> > went haywire on me.
> > > >> >
> > > >> >
> > > >> > Summary:
> > > >> >
> > > >> > SELinux is preventing fail2ban-server (fail2ban_t) "connectto" to
> > > >> >
> > > >> > 002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > >> >
> > > >> > (rpm_t).
> > > >> >
> > > >> > Detailed Description:
> > > >> >
> > > >> > SELinux denied access requested by fail2ban-server. It is not expected
> > > >> > that this
> > > >> > access is required by fail2ban-server and this access may signal an
> > > >> > intrusion
> > > >> > attempt. It is also possible that the specific version or configuration
> > > >> > of the
> > > >> > application is causing it to require additional access.
> > > >> >
> > > >> > Allowing Access:
> > > >> >
> > > >> > You can generate a local policy module to allow this access - see FAQ
> > > >> > (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can
> > > >> > disable
> > > >> > SELinux protection altogether. Disabling SELinux protection is not
> > > >> > recommended.
> > > >> > Please file a bug report
> > > >> > (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
> > > >> > against this package.
> > > >> >
> > > >> > Additional Information:
> > > >> >
> > > >> > Source Context system_u:system_r:fail2ban_t:s0
> > > >> > Target Context system_u:system_r:rpm_t:s0
> > > >> > Target Objects 002F746D702F66616D2D726F6F742D00000000000000000000
> > > >> >
> > > >> > 00000000000000000000000000000000000000000000000000
> > > >> >
> > > >> > 00000000000000000000000000000000000000000000000000
> > > >> >
> > > >> > 00000000000000000000000000000000000000000000000000
> > > >> > 0000000000000000 [ unix_stream_socket ]
> > > >> > Source fail2ban-server
> > > >> > Source Path /usr/bin/python
> > > >> > Port <Unknown>
> > > >> > Host localhost.localdomain
> > > >> > Source RPM Packages python-2.5.1-15.fc8
> > > >> > Target RPM Packages
> > > >> > Policy RPM selinux-policy-3.0.8-95.fc8
> > > >> > Selinux Enabled True
> > > >> > Policy Type targeted
> > > >> > MLS Enabled True
> > > >> > Enforcing Mode Enforcing
> > > >> > Plugin Name catchall
> > > >> > Host Name localhost.localdomain
> > > >> > Platform Linux localhost.localdomain
> > > >> > 2.6.24.4-64.fc8 #1 SMP
> > > >> > Sat Mar 29 09:15:49 EDT 2008 x86_64 x86_64
> > > >> > Alert Count 21
> > > >> > First Seen Mon 14 Apr 2008 10:38:42 PM EDT
> > > >> > Last Seen Mon 14 Apr 2008 10:38:43 PM EDT
> > > >> > Local ID 13bee4e4-ca74-488b-a4df-15f5bf78987f
> > > >> > Line Numbers
> > > >> >
> > > >> > Raw Audit Messages
> > > >> >
> > > >> > host=localhost.localdomain type=AVC msg=audit(1208227123.34:107): avc:
> > > >> > denied { connectto } for pid=6314 comm="fail2ban-server"
> > > >> > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > >> > scontext=system_u:system_r:fail2ban_t:s0
> > > >> > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > >> >
> > > >> > host=localhost.localdomain type=SYSCALL msg=audit(1208227123.34:107):
> > > >> > arch=c000003e syscall=42 success=no exit=-13 a0=6 a1=7fffe5116700 a2=6e
> > > >> > a3=0 items=0 ppid=1 pid=6314 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0
> > > >> > egid=0 sgid=0 fsgid=0 tty=(none) comm="fail2ban-server"
> > > >> > exe="/usr/bin/python" subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > >> >
> > > >> >
> > > >> > Now that I have SETroubleshoot running i tried the sealert command
> > > >> > suggested in the log files :
> > > >> >
> > > >> > [root@localhost log]# sealert -l 6cb9955a-b9cf-470c-87d1-e72bfa4b1fe2
> > > >> > failed to connect to server: Connection refused
> > > >> > [root@localhost log]# sealert -l 6cb9955a-b9cf-470c-87d1-e72bfa4b1fe2
> > > >> > query_alerts error (1003): id (6cb9955a-b9cf-470c-87d1-e72bfa4b1fe2) not
> > > >> > found
> > > >> >
> > > >> > Ran it twice, second time it worked.
> > > >> > I hope i'm not confusing anyone , i'll repost the order of events if
> > > >> > need be. I hesitate to file a bug when it could just be me making rookie
> > > >> > mistakes. I will try to reproduce again tomorrow on this box and my
> > > >> > other F8 to see what I can see but if you have any advice it would be
> > > >> > gratefully received.
> > > >> >
> > > >> >
> > > >> > Max
> > > >> >
> > > >> Please send me your /var/log/audit/audit.log
> > > >>
> > > >> -----BEGIN PGP SIGNATURE-----
> > > >> Version: GnuPG v1.4.9 (GNU/Linux)
> > > >> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
> > > >>
> > > >> iEYEARECAAYFAkgF8xsACgkQrlYvE4MpobN1owCdEbzCCIj7piE2fFt+PgK/nnEW
> > > >> GtgAnRk1OXQzWbBAelxUsa5xR/P5QX6c
> > > >> =ayhr
> > > >> -----END PGP SIGNATURE-----
> > > >>
> > > > Looks like several drafts of my mail hit the list, sorry about that
> > > > but I had to revise once setroubleshoot started working. Strange, i'll
> > > > have to look into it later or maybe its just gmail or thunderbird(time
> > > > to fire up wireshark!!). Anyway I'll send the audit.log from that box
> > > > once I get back to it. Different F8 box(i686), installed fail2ban,
> > > > started service and generated AVC(almost identical) but SETroubleshoot
> > > > doesn't crash like it does on the x86_64 box at least not so far. All
> > > > of the following is from the i686 box , a portion of audit.log follows
> > > > this AVC:
> > > >
> > > >
> > > > Summary:
> > > >
> > > > SELinux is preventing fail2ban-server (fail2ban_t) "connectto" to
> > > > 002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > (rpm_t).
> > > >
> > > > Detailed Description:
> > > >
> > > > SELinux denied access requested by fail2ban-server. It is not expected that this
> > > > access is required by fail2ban-server and this access may signal an intrusion
> > > > attempt. It is also possible that the specific version or configuration of the
> > > > application is causing it to require additional access.
> > > >
> > > > Allowing Access:
> > > >
> > > > You can generate a local policy module to allow this access - see FAQ
> > > > (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
> > > > SELinux protection altogether. Disabling SELinux protection is not recommended.
> > > > Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
> > > > against this package.
> > > >
> > > > Additional Information:
> > > >
> > > > Source Context system_u:system_r:fail2ban_t
> > > > Target Context system_u:system_r:rpm_t
> > > > Target Objects 002F746D702F66616D2D726F6F742D00000000000000000000
> > > > 00000000000000000000000000000000000000000000000000
> > > > 00000000000000000000000000000000000000000000000000
> > > > 00000000000000000000000000000000000000000000000000
> > > > 0000000000000000 [ unix_stream_socket ]
> > > > Source fail2ban-server
> > > > Source Path /usr/bin/python
> > > > Port <Unknown>
> > > > Host localhost.localdomain
> > > > Source RPM Packages python-2.5.1-15.fc8
> > > > Target RPM Packages
> > > > Policy RPM selinux-policy-3.0.8-95.fc8
> > > > Selinux Enabled True
> > > > Policy Type targeted
> > > > MLS Enabled True
> > > > Enforcing Mode Enforcing
> > > > Plugin Name catchall
> > > > Host Name localhost.localdomain
> > > > Platform Linux localhost.localdomain 2.6.24.4-64.fc8 #1 SMP
> > > > Sat Mar 29 09:54:46 EDT 2008 i686 athlon
> > > > Alert Count 26
> > > > First Seen Wed 16 Apr 2008 08:39:06 AM EDT
> > > > Last Seen Wed 16 Apr 2008 08:39:08 AM EDT
> > > > Local ID ede0cda2-138a-4222-936b-289297d95cee
> > > > Line Numbers
> > > >
> > > > Raw Audit Messages
> > > >
> > > > host=localhost.localdomain type=AVC msg=audit(1208349548.205:47): avc:
> > > > denied { connectto } for pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > >
> > > > host=localhost.localdomain type=SYSCALL msg=audit(1208349548.205:47):
> > > > arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfefa2b0
> > > > a2=165110 a3=b7f9602c items=0 ppid=1 pid=3045 auid=500 uid=0 gid=0
> > > > euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
> > > > comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > > I am posting a portion of the audit.log relating to fail2ban as the
> > > > entire log is quite large. If you want the whole thing unedited then I
> > > > will attach it. I think this should be more than enough, i didn't
> > > > parse it , just a simple copy and paste. I don't know what you may or
> > > > may not find relevant here so it goes from a couple of entries before
> > > > fail2ban is mentioned and a few after the last mention of fail2ban.
> > > > Most of the entries look identical and end in key=(null) maybe i could
> > > > just dismiss it but i take all the AVC's seriously until I know
> > > > better:
> > > >
> > > >
> > > > type=USER_START msg=audit(1208349505.423:21): user pid=2891 uid=500
> > > > auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023
> > > > msg='op=PAM:session_open acct=root exe="/usr/sbin/userhelper"
> > > > (hostname=?, addr=?, terminal=? res=success)'
> > > > type=AVC msg=audit(1208349546.967:22): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349546.967:22): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349546.976:23): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349546.976:23): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.028:24): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.028:24): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.080:25): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.080:25): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.132:26): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.132:26): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.184:27): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.184:27): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.236:28): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.236:28): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.288:29): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.288:29): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.341:30): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.341:30): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.393:31): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.393:31): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.445:32): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.445:32): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.497:33): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.497:33): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.549:34): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.549:34): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.601:35): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.601:35): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.651:36): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.651:36): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.702:37): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.702:37): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.752:38): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.752:38): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.803:39): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.803:39): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.853:40): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.853:40): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.904:41): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.904:41): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349547.954:42): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349547.954:42): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349548.004:43): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349548.004:43): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349548.054:44): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349548.054:44): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349548.105:45): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349548.105:45): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349548.155:46): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349548.155:46): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=AVC msg=audit(1208349548.205:47): avc: denied { connectto } for
> > > > pid=3045 comm="fail2ban-server"
> > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> > > > scontext=system_u:system_r:fail2ban_t:s0
> > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket
> > > > type=SYSCALL msg=audit(1208349548.205:47): arch=40000003 syscall=102
> > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0
> > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python"
> > > > subj=system_u:system_r:fail2ban_t:s0 key=(null)
> > > > type=USER_AUTH msg=audit(1208350171.618:48): user pid=3098 uid=500
> > > > auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023
> > > > msg='op=PAM:authentication acct=root exe="/usr/sbin/userhelper"
> > > > (hostname=?, addr=?, terminal=? res=success)'
> > > > type=USER_ACCT msg=audit(1208350171.620:49): user pid=3098 uid=500
> > > > auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023
> > > > msg='op=PAM:accounting acct=root exe="/usr/sbin/userhelper"
> > > > (hostname=?, addr=?, terminal=? res=success)'
> > > > type=USER_START msg=audit(1208350171.650:50): user pid=3098 uid=500
> > > > auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023
> > > > msg='op=PAM:session_open acct=root exe="/usr/sbin/userhelper"
> > > > (hostname=?, addr=?, terminal=? res=success)'
> > > > type=USER_AUTH msg=audit(1208350461.693:51): user pid=3142 uid=500
> > > > auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023
> > > > msg='op=PAM:authentication acct=root exe="/bin/su" (hostname=?,
> > > > addr=?, terminal=pts/1 res=success)'
> > > > type=USER_ACCT msg=audit(1208350461.697:52): user pid=3142 uid=500
> > > > auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023
> > > > msg='op=PAM:accounting acct=root exe="/bin/su" (hostname=?, addr=?,
> > > > terminal=pts/1 res=success)'
> > > > type=USER_START msg=audit(1208350461.711:53): user pid=3142 uid=500
> > > > auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023
> > > > msg='op=PAM:session_open acct=root exe="/bin/su" (hostname=?, addr=?,
> > > > terminal=pts/1 res=success)'
> > > >
> > > > Thanks for the help,
> > > >
> > > This is either a leaked file descriptor or gam_server running as rpm_t.
> > >
> > > ps -eZ | grep rpm_t
> > >
> > > failtoban should not be trying to communicate with a service running
> > > rpm_t. If you find gam_server running as rpm_t kill it and fail2ban
> > > should work.
> > >
> > >
> > [root@localhost ~]# ps -eZ | grep rpm_t
> > system_u:system_r:rpm_t 2585 ? 00:00:00 yum-updatesd
> > system_u:system_r:rpm_t 2587 ? 00:00:00 gam_server
> >
> > I'll kill the gam_server as you suggest. I will try same on x86_64 box
> > to see if its the same problem. If its not then i will post the
> > audit.log from it that I promised yesterday. Either way I'll post back
> > once i get in front of other f8 box.
> >
> > Thanks again,
> >
> > Max
> >
> I'm not in front of the other box yet but I killed the other instance
> of gam_server and reran the command.
>
> [root@localhost ~]# ps -eZ | grep rpm_t
> system_u:system_r:rpm_t 2585 ? 00:00:00 yum-updatesd
> system_u:system_r:rpm_t 4074 ? 00:00:00 gam_server
>
> it came back right away so I killed it again and rechecked several
> times and now it appears to have finally died.
> [root@localhost ~]# kill 4074
>
>
> [root@localhost ~]# ps -eZ | grep rpm_t
> system_u:system_r:rpm_t 2585 ? 00:00:00 yum-updatesd
>
>
> Max
>
Gmail is buggy for some reason. I' ll try and keep this coherent. On
the i686 box, after I found and killed gam_server( i had to do it
twice for it to stay dead) I then got a couple more AVC's (posting
AVC's and observations follow):
SELinux is preventing iptables (iptables_t) "read write" to socket (fail2ban_t).
Detailed Description:
SELinux denied access requested by iptables. It is not expected that this access
is required by iptables and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context system_u:system_r:iptables_t
Target Context system_u:system_r:fail2ban_t
Target Objects socket [ unix_stream_socket ]
Source iptables
Source Path /sbin/iptables
Port <Unknown>
Host localhost.localdomain
Source RPM Packages iptables-1.3.8-6.fc8
Target RPM Packages
Policy RPM selinux-policy-3.0.8-95.fc8
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name localhost.localdomain
Platform Linux localhost.localdomain 2.6.24.4-64.fc8 #1 SMP
Sat Mar 29 09:54:46 EDT 2008 i686 athlon
Alert Count 12
First Seen Thu 17 Apr 2008 01:47:41 PM EDT
Last Seen Thu 17 Apr 2008 02:19:47 PM EDT
Local ID b0d85376-fbd1-48a7-8dff-65a0ff3c4148
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1208456387.335:77): avc:
denied { read write } for pid=4622 comm="iptables"
path="socket:[35210]" dev=sockfs ino=35210
scontext=system_u:system_r:iptables_t:s0
tcontext=system_u:system_r:fail2ban_t:s0 tclass=unix_stream_socket
host=localhost.localdomain type=AVC msg=audit(1208456387.335:77): avc:
denied { read write } for pid=4622 comm="iptables"
path="socket:[35227]" dev=sockfs ino=35227
scontext=system_u:system_r:iptables_t:s0
tcontext=system_u:system_r:fail2ban_t:s0 tclass=unix_stream_socket
host=localhost.localdomain type=AVC msg=audit(1208456387.335:77): avc:
denied { read write } for pid=4622 comm="iptables"
path="socket:[35683]" dev=sockfs ino=35683
scontext=system_u:system_r:iptables_t:s0
tcontext=system_u:system_r:fail2ban_t:s0 tclass=unix_stream_socket
host=localhost.localdomain type=SYSCALL msg=audit(1208456387.335:77):
arch=40000003 syscall=11 success=yes exit=0 a0=9a5af50 a1=9a5a998
a2=9a5afa8 a3=40 items=0 ppid=4571 pid=4622 auid=500 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="iptables"
exe="/sbin/iptables" subj=system_u:system_r:iptables_t:s0 key=(null)
Ok. That one is about iptables. Soon as I started fail2ban , the log
showed 3 AVC's as above. Stop Fail2ban and three more generated. Did
it twice to see if it was consistent. Started fail2ban twice, each
time I started it generated 3 AVC's as above, same when I stopped it ,
generated 3 AVC's per instance. So 12 total. When I stopped Fail2ban,
within a couple of minutes(can't be more exact didn't have a stop
watch) saw a new AVC(only after it stops, observations follow AVC):
Summary:
SELinux is preventing gam_server (fail2ban_t) "getattr" to / (fs_t).
Detailed Description:
SELinux denied access requested by gam_server. It is not expected that this
access is required by gam_server and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context system_u:system_r:fail2ban_t
Target Context system_u:object_r:fs_t
Target Objects / [ filesystem ]
Source gam_server
Source Path <Unknown>
Port <Unknown>
Host localhost.localdomain
Source RPM Packages
Target RPM Packages filesystem-2.4.11-1.fc8
Policy RPM selinux-policy-3.0.8-95.fc8
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name localhost.localdomain
Platform Linux localhost.localdomain 2.6.24.4-64.fc8 #1 SMP
Sat Mar 29 09:54:46 EDT 2008 i686 athlon
Alert Count 2
First Seen Thu 17 Apr 2008 01:52:02 PM EDT
Last Seen Thu 17 Apr 2008 02:20:17 PM EDT
Local ID 9ce8514d-7677-4bb5-a59d-f70c8e8c755f
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1208456417.400:78): avc:
denied { getattr } for pid=4573 comm="gam_server" name="/" dev=dm-0
ino=2 scontext=system_u:system_r:fail2ban_t:s0
tcontext=system_u:object_r:fs_t:s0 tclass=filesystem
Ok. After I stop Fail2ban i get one instance of this AVC related to
gam_server. I started and stopped Fail2ban twice so two AVC's related
to gam_server, once after each time I stop fail2ban. No I don't think
anyone is stupid, just being clear for my sake and yours. Also ran :
ps -eZ | grep rpm_t gam_server still dead. That was on i686 box. BTW
had to kill gam_server twice on x86_64 box for it to stay dead, same
as on i686. The x86_64 box is the same for the iptables AVC. Same
ratio, 3 AVC's generated when starting fail2ban and 3 AVC's when
stopping fail2ban. The difference is that the AVC generated after you
stop fail2ban is related to sendmail(observations follow AVC):
Summary:
SELinux is preventing sendmail (system_mail_t) "read write" to socket
(fail2ban_t).
Detailed Description:
SELinux denied access requested by sendmail. It is not expected that this access
is required by sendmail and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context system_u:system_r:system_mail_t:s0
Target Context system_u:system_r:fail2ban_t:s0
Target Objects socket [ unix_stream_socket ]
Source sendmail
Source Path /usr/sbin/sendmail.sendmail
Port <Unknown>
Host localhost.localdomain
Source RPM Packages sendmail-8.14.2-1.fc8
Target RPM Packages
Policy RPM selinux-policy-3.0.8-95.fc8
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name localhost.localdomain
Platform Linux localhost.localdomain 2.6.24.4-64.fc8 #1 SMP
Sat Mar 29 09:15:49 EDT 2008 x86_64 x86_64
Alert Count 2
First Seen Thu 17 Apr 2008 08:28:37 PM EDT
Last Seen Thu 17 Apr 2008 08:30:34 PM EDT
Local ID 10c3cca0-4bc2-4fcf-845a-0b0cc2793482
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1208478634.133:31): avc:
denied { read write } for pid=3345 comm="sendmail"
path="socket:[22805]" dev=sockfs ino=22805
scontext=system_u:system_r:system_mail_t:s0
tcontext=system_u:system_r:fail2ban_t:s0 tclass=unix_stream_socket
host=localhost.localdomain type=AVC msg=audit(1208478634.133:31): avc:
denied { read write } for pid=3345 comm="sendmail"
path="socket:[22823]" dev=sockfs ino=22823
scontext=system_u:system_r:system_mail_t:s0
tcontext=system_u:system_r:fail2ban_t:s0 tclass=unix_stream_socket
host=localhost.localdomain type=AVC msg=audit(1208478634.133:31): avc:
denied { read write } for pid=3345 comm="sendmail"
path="socket:[23071]" dev=sockfs ino=23071
scontext=system_u:system_r:system_mail_t:s0
tcontext=system_u:system_r:fail2ban_t:s0 tclass=unix_stream_socket
host=localhost.localdomain type=SYSCALL msg=audit(1208478634.133:31):
arch=c000003e syscall=59 success=yes exit=0 a0=8c9860 a1=8c98a0
a2=8c96f0 a3=37e81529f0 items=0 ppid=3343 pid=3345 auid=500 uid=0
gid=0 euid=0 suid=0 fsuid=0 egid=51 sgid=51 fsgid=51 tty=(none)
comm="sendmail" exe="/usr/sbin/sendmail.sendmail"
subj=system_u:system_r:system_mail_t:s0 key=(null)
Checked processes on x86_64 no sendmail was or is running. Service
isn't usually running and isn't now.
Looks like a policy bug or both boxes have been tampered with, you
tell me, Sulphur is here so they will get nuked soon enough. The
sendmail bug may explain the strange behavior I have seen out of
Thunderbird and Gmail but sendmail AVC is only generated on x86_64
box, which incidentally is where I saw wierd behavior out of
Thunderbird but that may be separate issue, I don't think there is
enough evidence yet to make that conclusion despite my feeling that it
is related, i'll just have to keep my eyes peeled. I would file a bug
report but I'd like to understand this first so I might suggest, even
if I can't code, a fix but if you have to explain it ...the bug would
end up being read by someone that subscribes to this list so.....let
me know, I will file it if you ask me to. If logs, etc are needed I
will supply them but if its a genuine bug it should be easily
reproducible in under 30 minutes. I checked for processes running as
fs_t and system_mail_t before, during, and after starting/stopping
fail2ban on x86_64 box, I don't see anything. I feel like i am
forgetting something, anyway let me know about the bug report or if
you want more logs etc...
Thanks,
Max
16 years, 2 months
- 4
- 8