-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Sean E. Millichamp wrote:
On Thu, 2008-08-28 at 18:05 -0400, Sean E. Millichamp wrote:
> When I configure a simple ping test with qdisk I get:
>
> type=AVC msg=audit(1219960233.627:4561): avc: denied { read write } for pid=23174
comm="ping" path="/dev/sda4" dev=tmpfs ino=1051
scontext=root:system_r:ping_t:s0 tcontext=system_u:object_
> r:fixed_disk_device_t:s0 tclass=blk_file
>
> type=AVC msg=audit(1219960233.627:4561): avc: denied { read write } for pid=23174
comm="ping" path="/dev/sdb4" dev=tmpfs ino=985
scontext=root:system_r:ping_t:s0 tcontext=system_u:object_r
> :fixed_disk_device_t:s0 tclass=blk_file
>
> type=SYSCALL msg=audit(1219960233.627:4561): arch=c000003e syscall=59 success=yes
exit=0 a0=1f3575a0 a1=1f357610 a2=1f356150 a3=3 items=0 ppid=23163 pid=23174 auid=0 uid=0
gid=0 euid=0 suid=0
> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=189 comm="ping"
exe="/bin/ping" subj=root:system_r:ping_t:s0 key=(null)
These messages are because qdiskd doesn't properly clean up its file
descriptors before forking and execing ping. I will clean up my
findings and submit a patch/open a bug report against qdisk.
Thanks,
Sean
--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list Great, I was just about
to suggest this. Whenever you see something
bizarre like ping trying to read write raw disks, I think of leaked file
descriptors. or redirection of stdout.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org
iEYEARECAAYFAki+waYACgkQrlYvE4MpobNRVQCbB8ZKR7N378P18cVG6eRHsY3H
lqIAn0SQgiRvz400F0lvYABizPbatDAG
=b8wE
-----END PGP SIGNATURE-----