Memory protection and system-config-securitylevel
by Kamil J. Dudek
Hello everybody
Forgive me, if this subject has already been mentioned here, but I
simply couldn't find answer anywhere.
Few days ago I started system-config-securitylevel. I found something
interesting in "Modify SELinux policies". A memory protection - there
are four options in there. Two of them are enabled, with a description
that if having this enabled is required by some program, it should be
reported to bugzilla. I didn't do it, because of very strange effects
after turning it off.
Disabling
"Allow all executable files to map memory areas as executable and
readable, which is dangerous and such program should be reported to
bugzilla"
and
"Allow all executable files to mark stack as executable.That shouldn't
ever be required"
option(translation from polish) made system act very strange. First
thing I've observed was that Kobo game stopped working. GMPC stopped
playing. Also stuff outside of Fedora like Java and NVidia drivers
failed. So I should have "reported to bugzilla" to many application to
make it have any sense. Such bug report would be only annoying but
according to system-config-securitylevel...
What is it with these two options? To make everything work properly they
should be enabled, but their description that they should be disabled is
confusing.
Thank you and forgive me any mess I've done by this post
--
Pozdrawiam - Kamil J. Dudek
14 years, 6 months
- 2
- 3
mount point labels
by Clarkson, Mike R (US SSA)
I'm attempting to create the labeled mount point with the following
command:
mount -t nfs -o context=system_u:object_r:import_file_t:s0
nas:/vol/home /home/SimulatedImport/output/home
The mount point is created without any errors, but the label that I
specify in the mount command is not used. Instead of
system_u:object_r:import_file_t, the context of the
/home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0.
ls -dZ /home/SimulatedImport/output/home
drwxr-xr-x root root system_u:object_r:nfs_t:s0
/home/m252/SimulatedImport/output/home
I'm running RHEL5 with a policy built as mls off of the targeted policy.
Does anyone know why the context label is not taking?
Thanks
14 years, 7 months
- 3
- 7
kde avc(SELinux prevented kde4-config from writing .kde.)will it be on next selinux policy update?
by Antonio Olivares
Dear selinux experts,
I have a question about a repeated avc, I ask if I should apply the suggested fix or wait for an selinux policy update which addressses this?
Summary:
SELinux prevented kde4-config from writing .kde.
Detailed Description:
SELinux prevented kde4-config from writing .kde. If .kde is a core file, you may
want to allow this. If .kde is not a core file, this could signal a intrusion
attempt.
Allowing Access:
Changing the "allow_daemons_dump_core" boolean to true will allow this access:
"setsebool -P allow_daemons_dump_core=1."
Fix Command:
setsebool -P allow_daemons_dump_core=1
Additional Information:
Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context system_u:object_r:root_t:s0
Target Objects .kde [ dir ]
Source kde4-config
Source Path /usr/bin/kde4-config
Port <Unknown>
Host riohigh
Source RPM Packages kdelibs-4.2.1-2.fc11
Target RPM Packages
Policy RPM selinux-policy-3.6.7-1.fc11
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name allow_daemons_dump_core
Host Name riohigh
Platform Linux riohigh 2.6.29-0.197.rc7.fc11.i586 #1 SMP
Tue Mar 3 23:01:11 EST 2009 i686 athlon
Alert Count 20
First Seen Tue 17 Feb 2009 08:36:03 AM CST
Last Seen Wed 04 Mar 2009 07:44:55 PM CST
Local ID 6d47417b-4b4b-4c4f-9c12-6210059fc418
Line Numbers
Raw Audit Messages
node=riohigh type=AVC msg=audit(1236217495.274:8): avc: denied { create } for pid=2386 comm="kde4-config" name=".kde" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=dir
node=riohigh type=SYSCALL msg=audit(1236217495.274:8): arch=40000003 syscall=39 success=no exit=-13 a0=87163f8 a1=1c0 a2=49e32ec a3=0 items=0 ppid=2385 pid=2386 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kde4-config" exe="/usr/bin/kde4-config" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
Regards,
Antonio
15 years
- 4
- 3
selinux does not like crontab :(, default_t, kde
by Antonio Olivares
Dear all,
I have resolved one problem(Not getting internet at startup by default), but have not fixed the crontab one and other(s):
This one does not go away :(
Summary:
SELinux is preventing crontab (admin_crontab_t) "read write" unconfined_t.
Detailed Description:
SELinux denied access requested by crontab. It is not expected that this access
is required by crontab and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0
.c1023
Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
023
Target Objects socket [ unix_stream_socket ]
Source crontab
Source Path /usr/bin/crontab
Port <Unknown>
Host riohigh
Source RPM Packages cronie-1.2-7.fc11
Target RPM Packages
Policy RPM selinux-policy-3.6.8-3.fc11
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name riohigh
Platform Linux riohigh 2.6.29-0.258.2.3.rc8.git2.fc11.i586
#1 SMP Tue Mar 24 18:37:23 EDT 2009 i686 athlon
Alert Count 177
First Seen Mon 02 Mar 2009 07:11:37 PM CST
Last Seen Wed 25 Mar 2009 04:57:03 PM CST
Local ID 3883b140-4d39-40f5-9262-ce2c4c4e2e16
Line Numbers
Raw Audit Messages
node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53528]" dev=sockfs ino=53528 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1238021823.376:68): avc: denied { read write } for pid=4331 comm="crontab" path="socket:[53148]" dev=sockfs ino=53148 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=SYSCALL msg=audit(1238021823.376:68): arch=40000003 syscall=11 success=yes exit=0 a0=9fcb5c8 a1=9fcbd10 a2=9fb5ae0 a3=9fcbd10 items=0 ppid=4295 pid=4331 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=2 comm="crontab" exe="/usr/bin/crontab" subj=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 key=(null)
I can't modify my crontab file:
[olivares@riohigh ~]$ crontab -l
Authentication service cannot retrieve authentication info
You (olivares) are not allowed to access to (crontab) because of pam configuration.
[olivares@riohigh ~]$
if I disable selinux, I can modify it and view it, but not with selinux enabled.
I got greeted with the following:
Summary:
SELinux is preventing access to files with the default label, default_t.
Detailed Description:
SELinux permission checks on files labeled default_t are being denied. These
files/directories have the default label on them. This can indicate a labeling
problem, especially if the files being referred to are not top level
directories. Any files/directories under standard system directories, /usr,
/var. /dev, /tmp, ..., should not be labeled with the default label. The default
label is for files/directories which do not have a label on a parent directory.
So if you create a new directory in / you might legitimately get this label.
Allowing Access:
If you want a confined domain to use these files you will probably need to
relabel the file/directory with chcon. In some cases it is just easier to
relabel the system, to relabel execute: "touch /.autorelabel; reboot"
Additional Information:
Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context system_u:object_r:default_t:s0
Target Objects /.kde [ dir ]
Source kde4-config
Source Path /usr/bin/kde4-config
Port <Unknown>
Host riohigh
Source RPM Packages kdelibs-4.2.1-4.fc11
Target RPM Packages
Policy RPM selinux-policy-3.6.8-3.fc11
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name default
Host Name riohigh
Platform Linux riohigh 2.6.29-0.258.2.3.rc8.git2.fc11.i586
#1 SMP Tue Mar 24 18:37:23 EDT 2009 i686 athlon
Alert Count 7
First Seen Wed 25 Mar 2009 04:38:14 PM CST
Last Seen Wed 25 Mar 2009 04:38:14 PM CST
Local ID d3d42e40-6a28-48cf-8717-b85579c55bad
Line Numbers
Raw Audit Messages
node=riohigh type=AVC msg=audit(1238020694.487:40): avc: denied { getattr } for pid=2434 comm="kde4-config" path="/.kde" dev=sda5 ino=14897 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=dir
node=riohigh type=SYSCALL msg=audit(1238020694.487:40): arch=40000003 syscall=196 success=no exit=-13 a0=bfc3730b a1=bfc37258 a2=a12ff4 a3=a036c59 items=0 ppid=2433 pid=2434 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kde4-config" exe="/usr/bin/kde4-config" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
Summary:
SELinux is preventing access to files with the default label, default_t.
Detailed Description:
SELinux permission checks on files labeled default_t are being denied. These
files/directories have the default label on them. This can indicate a labeling
problem, especially if the files being referred to are not top level
directories. Any files/directories under standard system directories, /usr,
/var. /dev, /tmp, ..., should not be labeled with the default label. The default
label is for files/directories which do not have a label on a parent directory.
So if you create a new directory in / you might legitimately get this label.
Allowing Access:
If you want a confined domain to use these files you will probably need to
relabel the file/directory with chcon. In some cases it is just easier to
relabel the system, to relabel execute: "touch /.autorelabel; reboot"
Additional Information:
Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context system_u:object_r:default_t:s0
Target Objects .kde [ dir ]
Source kde4-config
Source Path /usr/bin/kde4-config
Port <Unknown>
Host riohigh
Source RPM Packages kdelibs-4.2.1-4.fc11
Target RPM Packages
Policy RPM selinux-policy-3.6.8-3.fc11
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name default
Host Name riohigh
Platform Linux riohigh 2.6.29-0.258.2.3.rc8.git2.fc11.i586
#1 SMP Tue Mar 24 18:37:23 EDT 2009 i686 athlon
Alert Count 23
First Seen Wed 25 Mar 2009 04:38:14 PM CST
Last Seen Wed 25 Mar 2009 04:38:14 PM CST
Local ID 711eec22-2695-4e57-91ad-622e9c5f3b53
Line Numbers
Raw Audit Messages
node=riohigh type=AVC msg=audit(1238020694.489:42): avc: denied { search } for pid=2434 comm="kde4-config" name=".kde" dev=sda5 ino=14897 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=dir
node=riohigh type=SYSCALL msg=audit(1238020694.489:42): arch=40000003 syscall=196 success=no exit=-13 a0=a036c58 a1=bfc37230 a2=a12ff4 a3=a031250 items=0 ppid=2433 pid=2434 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kde4-config" exe="/usr/bin/kde4-config" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
Startup did not take the 20 seconds, it took like 8 to 10 minutes with the relabeling and still see the same things. Is there an update that will fix this or do I have to disable selinux or boot in permissive in order to have a working machine.
Please help this is no longer fun as it once was.
Regards,
Antonio
15 years
- 3
- 13
Proftpd AVC
by Vadym Chepkov
Hi,
I am not sure what is this about?
type=AVC msg=audit(1238334358.188:369): avc: denied { write } for pid=4251 comm="proftpd" scontext=system_u:system_r:ftpd_t:s0 tco ntext=system_u:system_r:ftpd_t:s0 tclass=key
audit2allow suggests
allow ftpd_t self:key write;
But I am not sure if I should do it or not.
Sincerely yours,
Vadym Chepkov
15 years
- 2
- 1
selinux stopping NetworkManager from doing its job.
by Antonio Olivares
Dear fellow testers and selinux experts,
selinux is stopping NetworkManager from doing its job. To get internet, I have to manually type # dhclient eth0
and get internet connection.
Summary:
SELinux is preventing dhclient (dhcpc_t) "read write" unconfined_t.
Detailed Description:
SELinux denied access requested by dhclient. It is not expected that this access
is required by dhclient and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023
Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
023
Target Objects socket [ unix_stream_socket ]
Source dhclient
Source Path /sbin/dhclient
Port <Unknown>
Host riohigh
Source RPM Packages dhclient-4.1.0-10.fc11
Target RPM Packages
Policy RPM selinux-policy-3.6.8-1.fc11
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name riohigh
Platform Linux riohigh 2.6.29-0.215.rc7.fc11.i586 #1 SMP
Sun Mar 8 23:25:31 EDT 2009 i686 athlon
Alert Count 6
First Seen Fri 06 Mar 2009 04:16:01 PM CST
Last Seen Mon 09 Mar 2009 05:22:13 PM CST
Local ID a9c1d6de-334d-4f45-99bb-470f0f97e3ff
Line Numbers
Raw Audit Messages
node=riohigh type=AVC msg=audit(1236640933.104:39): avc: denied { read write } for pid=3313 comm="dhclient" path="socket:[15009]" dev=sockfs ino=15009 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=SYSCALL msg=audit(1236640933.104:39): arch=40000003 syscall=11 success=yes exit=0 a0=85082b8 a1=8517f20 a2=8517f60 a3=8517f20 items=0 ppid=3265 pid=3313 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="dhclient" exe="/sbin/dhclient" subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null)
Guess it applies over here:
Summary:
SELinux is preventing NetworkManager (NetworkManager_t) "read write"
unconfined_t.
Detailed Description:
SELinux denied access requested by NetworkManager. It is not expected that this
access is required by NetworkManager and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context unconfined_u:system_r:NetworkManager_t:s0
Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
023
Target Objects socket [ unix_stream_socket ]
Source NetworkManager
Source Path /usr/sbin/NetworkManager
Port <Unknown>
Host riohigh
Source RPM Packages NetworkManager-0.7.0.99-1.fc11
Target RPM Packages
Policy RPM selinux-policy-3.6.7-2.fc11
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name riohigh
Platform Linux riohigh 2.6.29-0.203.rc7.fc11.i586 #1 SMP
Wed Mar 4 18:03:29 EST 2009 i686 athlon
Alert Count 5
First Seen Mon 23 Feb 2009 07:23:54 AM CST
Last Seen Fri 06 Mar 2009 04:15:00 PM CST
Local ID f192ed25-15af-43fd-aa2e-524cca16b88a
Line Numbers
Raw Audit Messages
node=riohigh type=AVC msg=audit(1236377700.684:236): avc: denied { read write } for pid=14462 comm="NetworkManager" path="socket:[26116]" dev=sockfs ino=26116 scontext=unconfined_u:system_r:NetworkManager_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1236377700.684:236): avc: denied { read write } for pid=14462 comm="NetworkManager" path="socket:[26116]" dev=sockfs ino=26116 scontext=unconfined_u:system_r:NetworkManager_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1236377700.684:236): avc: denied { read write } for pid=14462 comm="NetworkManager" path="socket:[26116]" dev=sockfs ino=26116 scontext=unconfined_u:system_r:NetworkManager_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=SYSCALL msg=audit(1236377700.684:236): arch=40000003 syscall=11 success=yes exit=0 a0=84f2ee0 a1=84f2e30 a2=84f2268 a3=84f2e30 items=0 ppid=14461 pid=14462 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=10 comm="NetworkManager" exe="/usr/sbin/NetworkManager" subj=unconfined_u:system_r:NetworkManager_t:s0 key=(null)
I do not get eth0 active upon starting up, since selinux stops NetworkManager from getting IP automagically :(.
Regards,
Antonio
15 years
- 3
- 4
setroubleshoot server listens out on inet
by lejeczek
dear all,
that really baffles me, I don't seem to be able to set it up :)
and that port by default in conf file??
setroubleshoot server should be able to listen on network so remote
sealert could connect to it, right?
on my boxes(f9;f10) it does even look like binding to a port
please advise
cheers
___________________________________________________________
Try the all-new Yahoo! Mail. "The New Version is radically easier to use" � The Wall Street Journal
http://uk.docs.yahoo.com/nowyoucan.html
15 years, 1 month
- 3
- 3
dhcpd_write and .kde4 revisited + crontab trouble, ntp too
by Antonio Olivares
Summary:
SELinux is preventing dhclient (dhcpc_t) "read write" unconfined_t.
Detailed Description:
SELinux denied access requested by dhclient. It is not expected that this access
is required by dhclient and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023
Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
023
Target Objects socket [ unix_stream_socket ]
Source dhclient
Source Path /sbin/dhclient
Port <Unknown>
Host riohigh
Source RPM Packages dhclient-4.1.0-11.fc11
Target RPM Packages
Policy RPM selinux-policy-3.6.8-3.fc11
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name riohigh
Platform Linux riohigh 2.6.29-0.258.rc8.git2.fc11.i586 #1
SMP Mon Mar 16 20:53:59 EDT 2009 i686 athlon
Alert Count 22
First Seen Fri 06 Mar 2009 04:16:01 PM CST
Last Seen Tue 24 Mar 2009 04:35:56 PM CST
Local ID a9c1d6de-334d-4f45-99bb-470f0f97e3ff
Line Numbers
Raw Audit Messages
node=riohigh type=AVC msg=audit(1237934156.758:26): avc: denied { read write } for pid=3372 comm="dhclient" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1237934156.758:26): avc: denied { read write } for pid=3372 comm="dhclient" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=SYSCALL msg=audit(1237934156.758:26): arch=40000003 syscall=11 success=yes exit=0 a0=921ff38 a1=9207390 a2=9203bc0 a3=9207390 items=0 ppid=3332 pid=3372 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="dhclient" exe="/sbin/dhclient" subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null)
Summary:
SELinux prevented kde4-config from writing .kde.
Detailed Description:
SELinux prevented kde4-config from writing .kde. If .kde is a core file, you may
want to allow this. If .kde is not a core file, this could signal a intrusion
attempt.
Allowing Access:
Changing the "allow_daemons_dump_core" boolean to true will allow this access:
"setsebool -P allow_daemons_dump_core=1."
Fix Command:
setsebool -P allow_daemons_dump_core=1
Additional Information:
Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context system_u:object_r:root_t:s0
Target Objects .kde [ dir ]
Source kde4-config
Source Path /usr/bin/kde4-config
Port <Unknown>
Host riohigh
Source RPM Packages kdelibs-4.2.1-4.fc11
Target RPM Packages
Policy RPM selinux-policy-3.6.8-3.fc11
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name allow_daemons_dump_core
Host Name riohigh
Platform Linux riohigh 2.6.29-0.258.rc8.git2.fc11.i586 #1
SMP Mon Mar 16 20:53:59 EDT 2009 i686 athlon
Alert Count 43
First Seen Tue 17 Feb 2009 08:36:03 AM CST
Last Seen Tue 24 Mar 2009 04:34:07 PM CST
Local ID 6d47417b-4b4b-4c4f-9c12-6210059fc418
Line Numbers
Raw Audit Messages
node=riohigh type=AVC msg=audit(1237934047.415:8): avc: denied { create } for pid=2410 comm="kde4-config" name=".kde" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=dir
node=riohigh type=SYSCALL msg=audit(1237934047.415:8): arch=40000003 syscall=39 success=no exit=-13 a0=8ac6418 a1=1c0 a2=296f2ec a3=0 items=0 ppid=2409 pid=2410 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kde4-config" exe="/usr/bin/kde4-config" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
Now I see why crontab does not work :(
Summary:
SELinux is preventing crontab (admin_crontab_t) "read write" unconfined_t.
Detailed Description:
SELinux denied access requested by crontab. It is not expected that this access
is required by crontab and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0
.c1023
Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
023
Target Objects socket [ unix_stream_socket ]
Source crontab
Source Path /usr/bin/crontab
Port <Unknown>
Host riohigh
Source RPM Packages cronie-1.2-7.fc11
Target RPM Packages
Policy RPM selinux-policy-3.6.8-3.fc11
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name riohigh
Platform Linux riohigh 2.6.29-0.258.rc8.git2.fc11.i586 #1
SMP Mon Mar 16 20:53:59 EDT 2009 i686 athlon
Alert Count 114
First Seen Mon 02 Mar 2009 07:11:37 PM CST
Last Seen Tue 24 Mar 2009 04:10:37 PM CST
Local ID 3883b140-4d39-40f5-9262-ce2c4c4e2e16
Line Numbers
Raw Audit Messages
node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17513]" dev=sockfs ino=17513 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=AVC msg=audit(1237932637.221:85): avc: denied { read write } for pid=5361 comm="crontab" path="socket:[17209]" dev=sockfs ino=17209 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=SYSCALL msg=audit(1237932637.221:85): arch=40000003 syscall=11 success=yes exit=0 a0=8e005a0 a1=8e004d0 a2=8dfa9f8 a3=8e004d0 items=0 ppid=5324 pid=5361 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts3 ses=1 comm="crontab" exe="/usr/bin/crontab" subj=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 key=(null)
[olivares@riohigh ~]$ crontab -l
Authentication service cannot retrieve authentication info
You (olivares) are not allowed to access to (crontab) because of pam configuration.
[olivares@riohigh ~]$ crontab -e
Authentication service cannot retrieve authentication info
You (olivares) are not allowed to access to (crontab) because of pam configuration.
[olivares@riohigh ~]$
setroubleshooter kicks in and returns:
Summary:
SELinux is preventing ntpd (ntpd_t) "read write" unconfined_t.
Detailed Description:
SELinux denied access requested by ntpd. It is not expected that this access is
required by ntpd and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context unconfined_u:system_r:ntpd_t:s0
Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
023
Target Objects socket [ unix_stream_socket ]
Source ntpd
Source Path /usr/sbin/ntpd
Port <Unknown>
Host riohigh
Source RPM Packages ntp-4.2.4p6-3.fc11
Target RPM Packages
Policy RPM selinux-policy-3.6.8-3.fc11
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name riohigh
Platform Linux riohigh 2.6.29-0.258.rc8.git2.fc11.i586 #1
SMP Mon Mar 16 20:53:59 EDT 2009 i686 athlon
Alert Count 1
First Seen Mon 23 Mar 2009 04:07:29 PM CST
Last Seen Mon 23 Mar 2009 04:07:29 PM CST
Local ID 718bc628-af85-4d41-a5c1-838d9d3208bd
Line Numbers
Raw Audit Messages
node=riohigh type=AVC msg=audit(1237846049.986:105): avc: denied { read write } for pid=18588 comm="ntpd" path="socket:[4898784]" dev=sockfs ino=4898784 scontext=unconfined_u:system_r:ntpd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=SYSCALL msg=audit(1237846049.986:105): arch=40000003 syscall=11 success=yes exit=0 a0=9e21f80 a1=9e22280 a2=9e21248 a3=9e22280 items=0 ppid=18587 pid=18588 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=10 comm="ntpd" exe="/usr/sbin/ntpd" subj=unconfined_u:system_r:ntpd_t:s0 key=(null)
The time was not changed on this machine, I tried to call ntp and it did not work, why here's the reason:
Summary:
SELinux is preventing ntpd (ntpd_t) "read write" unconfined_t.
Detailed Description:
SELinux denied access requested by ntpd. It is not expected that this access is
required by ntpd and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context unconfined_u:system_r:ntpd_t:s0
Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
023
Target Objects socket [ unix_stream_socket ]
Source ntpd
Source Path /usr/sbin/ntpd
Port <Unknown>
Host riohigh
Source RPM Packages ntp-4.2.4p6-3.fc11
Target RPM Packages
Policy RPM selinux-policy-3.6.8-3.fc11
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name riohigh
Platform Linux riohigh 2.6.29-0.258.rc8.git2.fc11.i586 #1
SMP Mon Mar 16 20:53:59 EDT 2009 i686 athlon
Alert Count 1
First Seen Mon 23 Mar 2009 04:07:29 PM CST
Last Seen Mon 23 Mar 2009 04:07:29 PM CST
Local ID 718bc628-af85-4d41-a5c1-838d9d3208bd
Line Numbers
Raw Audit Messages
node=riohigh type=AVC msg=audit(1237846049.986:105): avc: denied { read write } for pid=18588 comm="ntpd" path="socket:[4898784]" dev=sockfs ino=4898784 scontext=unconfined_u:system_r:ntpd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
node=riohigh type=SYSCALL msg=audit(1237846049.986:105): arch=40000003 syscall=11 success=yes exit=0 a0=9e21f80 a1=9e22280 a2=9e21248 a3=9e22280 items=0 ppid=18587 pid=18588 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=10 comm="ntpd" exe="/usr/sbin/ntpd" subj=unconfined_u:system_r:ntpd_t:s0 key=(null)
I appreciate any help I can get. It has been a while since NetworkManager gives me a successfull connection. I have to become root and use dhclient to get internet access. If I need to file bug reports, please let me know against which components and I will do it.
Thanks,
Antonio
15 years, 1 month
- 1
- 0
F10 and synce selinux troubles.
by Albert Bartoszko
Hi all!
It's my first post.
I last try to connect Palm to computer with F10 using synce-hal.
I got several selinux alerts.
All files has default context, pppd works fine with command line.
SELinux is preventing pppd (hald_t) "read" ./options (pppd_etc_rw_t).
Additional Information:
Source Context system_u:system_r:hald_t
Target Context system_u:object_r:pppd_etc_rw_t
Target Objects ./options [ file ]
Source pppd
Source Path /usr/sbin/pppd
Port <Unknown>
Host localhost.localdomain
Source RPM Packages ppp-2.4.4-8.fc10
Target RPM Packages
Policy RPM selinux-policy-3.5.13-48.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon
Feb 23
13:21:22 EST 2009 i686 i686
Alert Count 2
First Seen Fri Mar 20 19:13:17 2009
Last Seen Fri Mar 20 20:17:07 2009
Local ID 746a1a3e-6177-42e3-9a45-44beb2856c56
Line Numbers
Raw Audit Messages
node=localhost.localdomain type=AVC msg=audit(1237576627.818:385): avc:
denied { read } for pid=11770 comm="pppd" name="options" dev=dm-0
ino=360195 scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:pppd_etc_rw_t:s0 tclass=file
node=localhost.localdomain type=SYSCALL msg=audit(1237576627.818:385):
arch=40000003 syscall=5 success=yes exit=4 a0=a10303 a1=0 a2=1b6 a3=0
items=0 ppid=11756 pid=11770 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pppd"
exe="/usr/sbin/pppd" subj=system_u:system_r:hald_t:s0 key=(null)
SELinux is preventing pppd (hald_t) "getattr" /etc/ppp/options
(pppd_etc_rw_t).
Additional Information:
Source Context system_u:system_r:hald_t
Target Context system_u:object_r:pppd_etc_rw_t
Target Objects /etc/ppp/options [ file ]
Source pppd
Source Path /usr/sbin/pppd
Port <Unknown>
Host localhost.localdomain
Source RPM Packages ppp-2.4.4-8.fc10
Target RPM Packages ppp-2.4.4-8.fc10
Policy RPM selinux-policy-3.5.13-48.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon
Feb 23
13:21:22 EST 2009 i686 i686
Alert Count 2
First Seen Fri Mar 20 19:13:17 2009
Last Seen Fri Mar 20 20:17:07 2009
Local ID c291b3a2-1c71-4baf-a2c5-f854f049f31a
Line Numbers
Raw Audit Messages
node=localhost.localdomain type=AVC msg=audit(1237576627.818:386): avc:
denied { getattr } for pid=11770 comm="pppd" path="/etc/ppp/options"
dev=dm-0 ino=360195 scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:pppd_etc_rw_t:s0 tclass=file
node=localhost.localdomain type=SYSCALL msg=audit(1237576627.818:386):
arch=40000003 syscall=197 success=yes exit=0 a0=4 a1=bfa6ee14 a2=40eff4
a3=e0e080 items=0 ppid=11756 pid=11770 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="pppd" exe="/usr/sbin/pppd" subj=system_u:system_r:hald_t:s0
key=(null)
SELinux is preventing pppd (hald_t) "read write" ./pppd2.tdb
(pppd_var_run_t).
Additional Information:
Source Context system_u:system_r:hald_t
Target Context system_u:object_r:pppd_var_run_t
Target Objects ./pppd2.tdb [ file ]
Source pppd
Source Path /usr/sbin/pppd
Port <Unknown>
Host localhost.localdomain
Source RPM Packages ppp-2.4.4-8.fc10
Target RPM Packages
Policy RPM selinux-policy-3.5.13-48.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon
Feb 23
13:21:22 EST 2009 i686 i686
Alert Count 2
First Seen Fri Mar 20 19:13:17 2009
Last Seen Fri Mar 20 20:17:07 2009
Local ID 1bef60ad-3bca-46eb-bb03-64983c6e80e0
Line Numbers
Raw Audit Messages
node=localhost.localdomain type=AVC msg=audit(1237576627.878:387): avc:
denied { read write } for pid=11770 comm="pppd" name="pppd2.tdb"
dev=dm-0 ino=5272278 scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:pppd_var_run_t:s0 tclass=file
node=localhost.localdomain type=SYSCALL msg=audit(1237576627.878:387):
arch=40000003 syscall=5 success=yes exit=7 a0=a10333 a1=42 a2=1a4 a3=0
items=0 ppid=11756 pid=11770 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pppd"
exe="/usr/sbin/pppd" subj=system_u:system_r:hald_t:s0 key=(null)
SELinux is preventing pppd (hald_t) "getattr" /var/run/pppd2.tdb
(pppd_var_run_t).
Additional Information:
Source Context system_u:system_r:hald_t
Target Context system_u:object_r:pppd_var_run_t
Target Objects /var/run/pppd2.tdb [ file ]
Source pppd
Source Path /usr/sbin/pppd
Port <Unknown>
Host localhost.localdomain
Source RPM Packages ppp-2.4.4-8.fc10
Target RPM Packages
Policy RPM selinux-policy-3.5.13-48.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon
Feb 23
13:21:22 EST 2009 i686 i686
Alert Count 2
First Seen Fri Mar 20 19:13:17 2009
Last Seen Fri Mar 20 20:17:07 2009
Local ID 07544813-1176-427b-ab4a-dded6daaf56e
Line Numbers
Raw Audit Messages
node=localhost.localdomain type=AVC msg=audit(1237576627.878:388): avc:
denied { getattr } for pid=11770 comm="pppd" path="/var/run/pppd2.tdb"
dev=dm-0 ino=5272278 scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:pppd_var_run_t:s0 tclass=file
node=localhost.localdomain type=SYSCALL msg=audit(1237576627.878:388):
arch=40000003 syscall=197 success=yes exit=0 a0=7 a1=bfa6f674 a2=40eff4
a3=e10f98 items=0 ppid=11756 pid=11770 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="pppd" exe="/usr/sbin/pppd" subj=system_u:system_r:hald_t:s0
key=(null)
SELinux is preventing pppd (hald_t) "create" ./LCK..ttyUSB0
(var_lock_t).
Additional Information:
Source Context system_u:system_r:hald_t
Target Context system_u:object_r:var_lock_t
Target Objects ./LCK..ttyUSB0 [ file ]
Source pppd
Source Path /usr/sbin/pppd
Port <Unknown>
Host localhost.localdomain
Source RPM Packages ppp-2.4.4-8.fc10
Target RPM Packages
Policy RPM selinux-policy-3.5.13-48.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon
Feb 23
13:21:22 EST 2009 i686 i686
Alert Count 2
First Seen Fri Mar 20 19:13:17 2009
Last Seen Fri Mar 20 20:17:07 2009
Local ID e59e15b8-a651-430a-9581-79bd1e36e4f7
Line Numbers
Raw Audit Messages
node=localhost.localdomain type=AVC msg=audit(1237576627.879:389): avc:
denied { create } for pid=11771 comm="pppd" name="LCK..ttyUSB0"
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:var_lock_t:s0 tclass=file
node=localhost.localdomain type=AVC msg=audit(1237576627.879:389): avc:
denied { read write } for pid=11771 comm="pppd" name="LCK..ttyUSB0"
dev=dm-0 ino=5265361 scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:var_lock_t:s0 tclass=file
node=localhost.localdomain type=SYSCALL msg=audit(1237576627.879:389):
arch=40000003 syscall=5 success=yes exit=8 a0=a27520 a1=c2 a2=1a4
a3=bfa6e6ec items=0 ppid=1 pid=11771 auid=4294967295 uid=0 gid=0 euid=0
suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="pppd" exe="/usr/sbin/pppd" subj=system_u:system_r:hald_t:s0
key=(null)
SELinux is preventing hal-dccm (hald_dccm_t) "getattr" hald_dccm_t.
Additional Information:
Source Context system_u:system_r:hald_dccm_t
Target Context system_u:system_r:hald_dccm_t
Target Objects pipe [ fifo_file ]
Source hal-dccm
Source Path /usr/libexec/hal-dccm
Port <Unknown>
Host localhost.localdomain
Source RPM Packages synce-hal-0.1-1.fc10
Target RPM Packages
Policy RPM selinux-policy-3.5.13-48.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon
Feb 23
13:21:22 EST 2009 i686 i686
Alert Count 2
First Seen Fri Mar 20 19:13:17 2009
Last Seen Fri Mar 20 20:17:07 2009
Local ID 03e073b1-7c9a-41d6-9eea-c736309b5f8f
Line Numbers
Raw Audit Messages
node=localhost.localdomain type=AVC msg=audit(1237576627.903:390): avc:
denied { getattr } for pid=11756 comm="hal-dccm" path="pipe:[209228]"
dev=pipefs ino=209228 scontext=system_u:system_r:hald_dccm_t:s0
tcontext=system_u:system_r:hald_dccm_t:s0 tclass=fifo_file
node=localhost.localdomain type=SYSCALL msg=audit(1237576627.903:390):
arch=40000003 syscall=197 success=yes exit=0 a0=5 a1=bfcb2aac a2=6aeff4
a3=5 items=0 ppid=2129 pid=11756 auid=4294967295 uid=0 gid=0 euid=0
suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="hal-dccm" exe="/usr/libexec/hal-dccm"
subj=system_u:system_r:hald_dccm_t:s0 key=(null)
SELinux is preventing hal-dccm (hald_dccm_t) "create" hald_dccm_t.
Additional Information:
Source Context system_u:system_r:hald_dccm_t
Target Context system_u:system_r:hald_dccm_t
Target Objects None [ unix_dgram_socket ]
Source hal-dccm
Source Path /usr/libexec/hal-dccm
Port <Unknown>
Host localhost.localdomain
Source RPM Packages synce-hal-0.1-1.fc10
Target RPM Packages
Policy RPM selinux-policy-3.5.13-48.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon
Feb 23
13:21:22 EST 2009 i686 i686
Alert Count 2
First Seen Fri Mar 20 19:13:17 2009
Last Seen Fri Mar 20 20:17:07 2009
Local ID c1f75682-ab61-46ea-85f2-3e081eedfc01
Line Numbers
Raw Audit Messages
node=localhost.localdomain type=AVC msg=audit(1237576627.903:391): avc:
denied { create } for pid=11756 comm="hal-dccm"
scontext=system_u:system_r:hald_dccm_t:s0
tcontext=system_u:system_r:hald_dccm_t:s0 tclass=unix_dgram_socket
node=localhost.localdomain type=SYSCALL msg=audit(1237576627.903:391):
arch=40000003 syscall=102 success=yes exit=0 a0=1 a1=bfcb2540 a2=6aeff4
a3=6b23cc items=0 ppid=2129 pid=11756 auid=4294967295 uid=0 gid=0 euid=0
suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="hal-dccm" exe="/usr/libexec/hal-dccm"
subj=system_u:system_r:hald_dccm_t:s0 key=(null)
SELinux is preventing hal-dccm (hald_dccm_t) "connect" hald_dccm_t.
Additional Information:
Source Context system_u:system_r:hald_dccm_t
Target Context system_u:system_r:hald_dccm_t
Target Objects None [ unix_dgram_socket ]
Source hal-dccm
Source Path /usr/libexec/hal-dccm
Port <Unknown>
Host localhost.localdomain
Source RPM Packages synce-hal-0.1-1.fc10
Target RPM Packages
Policy RPM selinux-policy-3.5.13-48.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon
Feb 23
13:21:22 EST 2009 i686 i686
Alert Count 2
First Seen Fri Mar 20 19:13:17 2009
Last Seen Fri Mar 20 20:17:07 2009
Local ID b2c25766-1a6d-4453-a81b-9a895be0a06b
Line Numbers
Raw Audit Messages
node=localhost.localdomain type=AVC msg=audit(1237576627.903:392): avc:
denied { connect } for pid=11756 comm="hal-dccm"
scontext=system_u:system_r:hald_dccm_t:s0
tcontext=system_u:system_r:hald_dccm_t:s0 tclass=unix_dgram_socket
node=localhost.localdomain type=AVC msg=audit(1237576627.903:392): avc:
denied { write } for pid=11756 comm="hal-dccm" name="log" dev=tmpfs
ino=7412 scontext=system_u:system_r:hald_dccm_t:s0
tcontext=system_u:object_r:devlog_t:s0 tclass=sock_file
node=localhost.localdomain type=AVC msg=audit(1237576627.903:392): avc:
denied { sendto } for pid=11756 comm="hal-dccm" path="/dev/log"
scontext=system_u:system_r:hald_dccm_t:s0
tcontext=system_u:system_r:syslogd_t:s0 tclass=unix_dgram_socket
node=localhost.localdomain type=SYSCALL msg=audit(1237576627.903:392):
arch=40000003 syscall=102 success=yes exit=0 a0=3 a1=bfcb2540 a2=6aeff4
a3=0 items=0 ppid=2129 pid=11756 auid=4294967295 uid=0 gid=0 euid=0
suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="hal-dccm" exe="/usr/libexec/hal-dccm"
subj=system_u:system_r:hald_dccm_t:s0 key=(null)
SELinux is preventing hal-dccm (hald_dccm_t) "search" ./dbus
(system_dbusd_var_run_t).
Additional Information:
Source Context system_u:system_r:hald_dccm_t
Target Context system_u:object_r:system_dbusd_var_run_t
Target Objects ./dbus [ dir ]
Source hal-dccm
Source Path /usr/libexec/hal-dccm
Port <Unknown>
Host localhost.localdomain
Source RPM Packages synce-hal-0.1-1.fc10
Target RPM Packages
Policy RPM selinux-policy-3.5.13-48.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon
Feb 23
13:21:22 EST 2009 i686 i686
Alert Count 2
First Seen Fri Mar 20 19:13:17 2009
Last Seen Fri Mar 20 20:17:07 2009
Local ID 418b2252-1561-4209-ba8d-8ed9f4917c7b
Line Numbers
Raw Audit Messages
node=localhost.localdomain type=AVC msg=audit(1237576627.907:393): avc:
denied { search } for pid=11756 comm="hal-dccm" name="dbus" dev=dm-0
ino=5265901 scontext=system_u:system_r:hald_dccm_t:s0
tcontext=system_u:object_r:system_dbusd_var_run_t:s0 tclass=dir
node=localhost.localdomain type=AVC msg=audit(1237576627.907:393): avc:
denied { write } for pid=11756 comm="hal-dccm"
name="system_bus_socket" dev=dm-0 ino=5265775
scontext=system_u:system_r:hald_dccm_t:s0
tcontext=system_u:object_r:system_dbusd_var_run_t:s0 tclass=sock_file
node=localhost.localdomain type=AVC msg=audit(1237576627.907:393): avc:
denied { connectto } for pid=11756 comm="hal-dccm"
path="/var/run/dbus/system_bus_socket"
scontext=system_u:system_r:hald_dccm_t:s0
tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tclass=unix_stream_socket
node=localhost.localdomain type=SYSCALL msg=audit(1237576627.907:393):
arch=40000003 syscall=102 success=yes exit=0 a0=3 a1=bfcb28a0 a2=87bff4
a3=1f items=0 ppid=2129 pid=11756 auid=4294967295 uid=0 gid=0 euid=0
suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="hal-dccm" exe="/usr/libexec/hal-dccm"
subj=system_u:system_r:hald_dccm_t:s0 key=(null)
SELinux is preventing pppd (hald_t) "read" ./pap-secrets
(pppd_secret_t).
Additional Information:
Source Context system_u:system_r:hald_t
Target Context system_u:object_r:pppd_secret_t
Target Objects ./pap-secrets [ file ]
Source pppd
Source Path /usr/sbin/pppd
Port <Unknown>
Host localhost.localdomain
Source RPM Packages ppp-2.4.4-8.fc10
Target RPM Packages
Policy RPM selinux-policy-3.5.13-48.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon
Feb 23
13:21:22 EST 2009 i686 i686
Alert Count 1
First Seen Fri Mar 20 20:17:08 2009
Last Seen Fri Mar 20 20:17:08 2009
Local ID 8790ca12-4cd3-468f-917b-b29956652895
Line Numbers
Raw Audit Messages
node=localhost.localdomain type=AVC msg=audit(1237576628.453:394): avc:
denied { read } for pid=11771 comm="pppd" name="pap-secrets" dev=dm-0
ino=360200 scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:pppd_secret_t:s0 tclass=file
node=localhost.localdomain type=SYSCALL msg=audit(1237576628.453:394):
arch=40000003 syscall=5 success=yes exit=11 a0=a135e5 a1=0 a2=1b6 a3=0
items=0 ppid=1 pid=11771 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyUSB0 ses=4294967295 comm="pppd"
exe="/usr/sbin/pppd" subj=system_u:system_r:hald_t:s0 key=(null)
SELinux is preventing pppd (hald_t) "getattr" /etc/ppp/pap-secrets
(pppd_secret_t).
Additional Information:
Source Context system_u:system_r:hald_t
Target Context system_u:object_r:pppd_secret_t
Target Objects /etc/ppp/pap-secrets [ file ]
Source pppd
Source Path /usr/sbin/pppd
Port <Unknown>
Host localhost.localdomain
Source RPM Packages ppp-2.4.4-8.fc10
Target RPM Packages ppp-2.4.4-8.fc10
Policy RPM selinux-policy-3.5.13-48.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon
Feb 23
13:21:22 EST 2009 i686 i686
Alert Count 1
First Seen Fri Mar 20 20:17:08 2009
Last Seen Fri Mar 20 20:17:08 2009
Local ID a4d794e1-18d5-41fd-a755-2f68eb4aefc4
Line Numbers
Raw Audit Messages
node=localhost.localdomain type=AVC msg=audit(1237576628.453:395): avc:
denied { getattr } for pid=11771 comm="pppd"
path="/etc/ppp/pap-secrets" dev=dm-0 ino=360200
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:pppd_secret_t:s0 tclass=file
node=localhost.localdomain type=SYSCALL msg=audit(1237576628.453:395):
arch=40000003 syscall=197 success=yes exit=0 a0=b a1=bfa6f1c4 a2=40eff4
a3=a135e5 items=0 ppid=1 pid=11771 auid=4294967295 uid=0 gid=0 euid=0
suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyUSB0 ses=4294967295
comm="pppd" exe="/usr/sbin/pppd" subj=system_u:system_r:hald_t:s0
key=(null)
SELinux is preventing pppd (hald_t) "getattr" /etc/ppp/ip-up
(pppd_initrc_exec_t).
Additional Information:
Source Context system_u:system_r:hald_t
Target Context system_u:object_r:pppd_initrc_exec_t
Target Objects /etc/ppp/ip-up [ file ]
Source pppd
Source Path /usr/sbin/pppd
Port <Unknown>
Host localhost.localdomain
Source RPM Packages ppp-2.4.4-8.fc10
Target RPM Packages initscripts-8.86-1
Policy RPM selinux-policy-3.5.13-48.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon
Feb 23
13:21:22 EST 2009 i686 i686
Alert Count 2
First Seen Fri Mar 20 19:13:18 2009
Last Seen Fri Mar 20 20:17:08 2009
Local ID 231cc7e5-6eb3-4cb8-8f3c-f901c9e464b8
Line Numbers
Raw Audit Messages
node=localhost.localdomain type=AVC msg=audit(1237576628.498:396): avc:
denied { getattr } for pid=11771 comm="pppd" path="/etc/ppp/ip-up"
dev=dm-0 ino=361994 scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:pppd_initrc_exec_t:s0 tclass=file
node=localhost.localdomain type=SYSCALL msg=audit(1237576628.498:396):
arch=40000003 syscall=195 success=yes exit=0 a0=a12036 a1=bfa6f584
a2=40eff4 a3=bfa6f6d8 items=0 ppid=1 pid=11771 auid=4294967295 uid=0
gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyUSB0
ses=4294967295 comm="pppd" exe="/usr/sbin/pppd"
subj=system_u:system_r:hald_t:s0 key=(null)
SELinux is preventing ip-up (hald_t) "execute" ./ip-up
(pppd_initrc_exec_t).
Additional Information:
Source Context system_u:system_r:hald_t
Target Context system_u:object_r:pppd_initrc_exec_t
Target Objects ./ip-up [ file ]
Source ip-up
Source Path /bin/bash
Port <Unknown>
Host localhost.localdomain
Source RPM Packages bash-3.2-30.fc10
Target RPM Packages
Policy RPM selinux-policy-3.5.13-48.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon
Feb 23
13:21:22 EST 2009 i686 i686
Alert Count 2
First Seen Fri Mar 20 19:13:18 2009
Last Seen Fri Mar 20 20:17:08 2009
Local ID 9c0bf4d7-e98d-46b5-8e98-b727169803af
Line Numbers
Raw Audit Messages
node=localhost.localdomain type=AVC msg=audit(1237576628.498:397): avc:
denied { execute } for pid=11784 comm="pppd" name="ip-up" dev=dm-0
ino=361994 scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:pppd_initrc_exec_t:s0 tclass=file
node=localhost.localdomain type=AVC msg=audit(1237576628.498:397): avc:
denied { read } for pid=11784 comm="pppd" name="ip-up" dev=dm-0
ino=361994 scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:pppd_initrc_exec_t:s0 tclass=file
node=localhost.localdomain type=AVC msg=audit(1237576628.498:397): avc:
denied { execute_no_trans } for pid=11784 comm="pppd"
path="/etc/ppp/ip-up" dev=dm-0 ino=361994
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:pppd_initrc_exec_t:s0 tclass=file
node=localhost.localdomain type=SYSCALL msg=audit(1237576628.498:397):
arch=40000003 syscall=11 success=yes exit=0 a0=a12036 a1=bfa6f6b8
a2=e0e018 a3=0 items=0 ppid=11771 pid=11784 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="ip-up" exe="/bin/bash" subj=system_u:system_r:hald_t:s0 key=(null)
SELinux is preventing ip-up (hald_t) "ioctl" /etc/ppp/ip-up
(pppd_initrc_exec_t).
Additional Information:
Source Context system_u:system_r:hald_t
Target Context system_u:object_r:pppd_initrc_exec_t
Target Objects /etc/ppp/ip-up [ file ]
Source ip-up
Source Path /bin/bash
Port <Unknown>
Host localhost.localdomain
Source RPM Packages bash-3.2-30.fc10
Target RPM Packages initscripts-8.86-1
Policy RPM selinux-policy-3.5.13-48.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon
Feb 23
13:21:22 EST 2009 i686 i686
Alert Count 2
First Seen Fri Mar 20 19:13:18 2009
Last Seen Fri Mar 20 20:17:08 2009
Local ID 0ec7c0de-0086-4c13-b618-bf4858af6f41
Line Numbers
Raw Audit Messages
node=localhost.localdomain type=AVC msg=audit(1237576628.500:398): avc:
denied { ioctl } for pid=11784 comm="ip-up" path="/etc/ppp/ip-up"
dev=dm-0 ino=361994 scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:pppd_initrc_exec_t:s0 tclass=file
node=localhost.localdomain type=SYSCALL msg=audit(1237576628.500:398):
arch=40000003 syscall=54 success=no exit=-25 a0=3 a1=5401 a2=bf832bd8
a3=bf832c18 items=0 ppid=11771 pid=11784 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="ip-up" exe="/bin/bash" subj=system_u:system_r:hald_t:s0 key=(null)
SELinux is preventing hal-dccm (hald_dccm_t) "write" hald_dccm_t.
Additional Information:
Source Context system_u:system_r:hald_dccm_t
Target Context system_u:system_r:hald_dccm_t
Target Objects None [ unix_dgram_socket ]
Source hal-dccm
Source Path /usr/libexec/hal-dccm
Port <Unknown>
Host localhost.localdomain
Source RPM Packages synce-hal-0.1-1.fc10
Target RPM Packages
Policy RPM selinux-policy-3.5.13-48.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall
Host Name localhost.localdomain
Platform Linux localhost.localdomain
2.6.27.19-170.2.35.fc10.i686 #1 SMP Mon
Feb 23
13:21:22 EST 2009 i686 i686
Alert Count 3
First Seen Fri Mar 20 19:13:18 2009
Last Seen Fri Mar 20 20:17:08 2009
Local ID bc1a16c5-af3f-42c0-9563-62a8cdf9eb69
Line Numbers
Raw Audit Messages
node=localhost.localdomain type=AVC msg=audit(1237576628.514:405): avc:
denied { write } for pid=11756 comm="hal-dccm"
scontext=system_u:system_r:hald_dccm_t:s0
tcontext=system_u:system_r:hald_dccm_t:s0 tclass=unix_dgram_socket
node=localhost.localdomain type=SYSCALL msg=audit(1237576628.514:405):
arch=40000003 syscall=102 success=yes exit=86 a0=9 a1=bfcb23f4 a2=6aeff4
a3=14 items=0 ppid=2129 pid=11756 auid=4294967295 uid=0 gid=0 euid=0
suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="hal-dccm" exe="/usr/libexec/hal-dccm"
subj=system_u:system_r:hald_dccm_t:s0 key=(null)
Albert
15 years, 1 month
- 1
- 0
Newbie Q
by Aaron Gray
I am trying to audit2allow on F10 to allow a cgi-bin perl script to run on
Apache. Runs fine in permissive mode not in enforcing.
I bought the O'Reilly SE Linux book and learned the basics but it does not
really seem to help me on Fedora.
there was no /var/log/kernel so I tried /var/log/secure with the following
command sequence
setenforce 0
# access the cgi from the web
setenforce 1
audit2allow -l -i /var/log/secure
What is strange also is the system is not flagging things up as a
notification icon anymore in enforcing mode.
If someone could guide me or push me in the right direction I would be most
thankful.
Aaron
15 years, 1 month
- 3
- 7