Clamd - again...
Arthur Dent
misc.lists at blueyonder.co.uk
Mon Aug 23 10:20:10 UTC 2010
On Mon, 2010-08-23 at 10:56 +0200, Dominick Grift wrote:
> On 08/23/2010 10:47 AM, Arthur Dent wrote:
> > On Mon, 2010-08-23 at 10:42 +0200, Dominick Grift wrote:
> >> On 08/23/2010 10:40 AM, Arthur Dent wrote:
> >>> On Mon, 2010-08-23 at 10:29 +0200, Dominick Grift wrote:
> >>>> On 08/23/2010 10:09 AM, Arthur Dent wrote:
> >>>>> On Sun, 2010-08-22 at 22:44 +0100, Arthur Dent wrote:
> >>>>>> On Sun, 2010-08-22 at 23:07 +0200, Dominick Grift wrote:
> >>>>>>> On 08/22/2010 08:24 PM, Arthur Dent wrote:
> >>>>>> ----
> >>>>> time->Mon Aug 23 08:57:07 2010
> >>>>> type=SYSCALL msg=audit(1282550227.058:42734): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bf800420 a2=3 a3=1 items=0 ppid=23912 pid=23920 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0 egid=12 sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="clamdscan" exe="/usr/local/bin/clamdscan" subj=system_u:system_r:procmail_t:s0 key=(null)
> >>>>> type=AVC msg=audit(1282550227.058:42734): avc: denied { search } for pid=23920 comm="clamdscan" name="clamd" dev=sda6 ino=269280 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:clamd_var_run_t:s0 tclass=dir
> >>>>
> >>>> This is still an issue:
> >>>>
> >>>> some process running in the procmail_t domain is running
> >>>> /usr/bin/clamdscan (ls -alZ /usr/bin/clamdscan to verify its context),
> >>>> but it is not domain transitioning to the clamscan_t domain.
> >>>
> >>> # which clamdscan
> >>> /usr/local/bin/clamdscan
> >>>
> >>> # ls -laZ /usr/local/bin/clamdscan
> >>> -rwxr-xr-x. root root system_u:object_r:bin_t:s0 /usr/local/bin/clamdscan
> >>>
> >>> Now, in actual fact, procmail does not call clamdscan directly (it can't
> >>> deal with emails), it calls a program called clamassassin which in turn
> >>> calls clamdscan.
> >>>
> >>> # ls -laZ /usr/local/bin/clamassassin
> >>> -r-xr-xr-x. root root system_u:object_r:bin_t:s0 /usr/local/bin/clamassassin
> >>>
> >>
> >> Why are these files located there and not /usr/bin where they are
> >> expected to be? The files are mislabelled.
> >
> > In both cases I compiled from source and accepted the defaults
> > in ./configure.
> >
> > I guess I could try to recompile them in /usr/bin if it is a problem -
> > but I'm no expert...
>
> The problem there is; who knows what other locations owned by these apps
> differ from the expected locations.
>
> Why are you not using redhat supplied packages?
Well I started compiling clam from source about 3 or 4 years ago. I got
frustrated with the fact that (at that time - I don't know if it's
better now) it would take sometimes 3-4 weeks after a new release of
clam before the redhat package became available. In the meantime I would
have to put up with daily warnings in syslog.
Also, I am often unable to upgrade to the latest Fedora package until it
is already at end of life (viz - I have only just upgraded to F13 from
F11) and the clam packages would often not be available at all...
>
> As for clamdscan; for now you could try the following to see if it would
> work if this file is labelled correctly:
>
> chcon -t clamscan_exec_t /usr/local/bin/clamdscan
>
> See if that makes things work for you
Well I am still getting permission denied...
Latest messages:
----
time->Mon Aug 23 11:09:06 2010
type=SYSCALL msg=audit(1282558146.211:43246): arch=40000003 syscall=11
success=yes exit=0 a0=15559d0 a1=bf9c9f7c a2=303840 a3=41904 items=0
ppid=24933 pid=24934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="procmail"
exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1282558146.211:43246): avc: denied { noatsecure }
for pid=24934 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:system_r:procmail_t:s0 tclass=process
type=AVC msg=audit(1282558146.211:43246): avc: denied { siginh } for
pid=24934 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:system_r:procmail_t:s0 tclass=process
type=AVC msg=audit(1282558146.211:43246): avc: denied { rlimitinh }
for pid=24934 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:system_r:procmail_t:s0 tclass=process
----
time->Mon Aug 23 11:12:05 2010
type=SYSCALL msg=audit(1282558325.997:43259): arch=40000003 syscall=11
success=yes exit=0 a0=15559d0 a1=bf9c9f7c a2=303840 a3=41904 items=0
ppid=24953 pid=24954 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="procmail"
exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1282558325.997:43259): avc: denied { noatsecure }
for pid=24954 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:system_r:procmail_t:s0 tclass=process
type=AVC msg=audit(1282558325.997:43259): avc: denied { siginh } for
pid=24954 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:system_r:procmail_t:s0 tclass=process
type=AVC msg=audit(1282558325.997:43259): avc: denied { rlimitinh }
for pid=24954 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:system_r:procmail_t:s0 tclass=process
----
time->Mon Aug 23 11:12:06 2010
type=SYSCALL msg=audit(1282558326.163:43260): arch=40000003 syscall=11
success=yes exit=0 a0=9d75660 a1=9d75538 a2=9d715b8 a3=9d75538 items=0
ppid=24956 pid=24960 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0
egid=12 sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="clamdscan"
exe="/usr/local/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0
key=(null)
type=AVC msg=audit(1282558326.163:43260): avc: denied { noatsecure }
for pid=24960 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282558326.163:43260): avc: denied { siginh } for
pid=24960 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282558326.163:43260): avc: denied { rlimitinh }
for pid=24960 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282558326.163:43260): avc: denied { read } for
pid=24960 comm="clamdscan" path="/var/spool/mqueue/dfo7NAC5wD024952"
dev=sda6 ino=14772 scontext=system_u:system_r:clamscan_t:s0
tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=file
----
time->Mon Aug 23 11:12:06 2010
type=SYSCALL msg=audit(1282558326.179:43261): arch=40000003 syscall=102
success=no exit=-13 a0=3 a1=bfcfd440 a2=3 a3=0 items=0 ppid=24956
pid=24960 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0 egid=12
sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="clamdscan"
exe="/usr/local/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0
key=(null)
type=AVC msg=audit(1282558326.179:43261): avc: denied { connectto }
for pid=24960 comm="clamdscan" path="/var/run/clamd/clamd.sock"
scontext=system_u:system_r:clamscan_t:s0
tcontext=unconfined_u:system_r:initrc_t:s0 tclass=unix_stream_socket
----
time->Mon Aug 23 11:12:06 2010
type=SYSCALL msg=audit(1282558326.209:43262): arch=40000003 syscall=11
success=yes exit=0 a0=9d75ab0 a1=9d75380 a2=9d715b8 a3=9d75380 items=0
ppid=24956 pid=24964 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0
egid=12 sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="clamdscan"
exe="/usr/local/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0
key=(null)
type=AVC msg=audit(1282558326.209:43262): avc: denied { noatsecure }
for pid=24964 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282558326.209:43262): avc: denied { siginh } for
pid=24964 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282558326.209:43262): avc: denied { rlimitinh }
for pid=24964 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282558326.209:43262): avc: denied { read } for
pid=24964 comm="clamdscan" path="/var/spool/mqueue/dfo7NAC5wD024952"
dev=sda6 ino=14772 scontext=system_u:system_r:clamscan_t:s0
tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=file
type=AVC msg=audit(1282558326.209:43262): avc: denied { write } for
pid=24964 comm="clamdscan" path="/tmp/clamassassinlog.9knHcazJ44"
dev=sda6 ino=86007 scontext=system_u:system_r:clamscan_t:s0
tcontext=system_u:object_r:procmail_tmp_t:s0 tclass=file
type=AVC msg=audit(1282558326.209:43262): avc: denied { read } for
pid=24964 comm="clamdscan" path="/tmp/clamassassinmsg.fyU9qe9Rn4"
dev=sda6 ino=67816 scontext=system_u:system_r:clamscan_t:s0
tcontext=system_u:object_r:procmail_tmp_t:s0 tclass=file
----
time->Mon Aug 23 11:12:06 2010
type=SYSCALL msg=audit(1282558326.213:43263): arch=40000003 syscall=102
success=no exit=-13 a0=3 a1=bf9e8a30 a2=3 a3=1 items=0 ppid=24956
pid=24964 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0 egid=12
sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="clamdscan"
exe="/usr/local/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0
key=(null)
type=AVC msg=audit(1282558326.213:43263): avc: denied { connectto }
for pid=24964 comm="clamdscan" path="/var/run/clamd/clamd.sock"
scontext=system_u:system_r:clamscan_t:s0
tcontext=unconfined_u:system_r:initrc_t:s0 tclass=unix_stream_socket
----
time->Mon Aug 23 11:12:06 2010
type=SYSCALL msg=audit(1282558326.267:43264): arch=40000003 syscall=11
success=yes exit=0 a0=9e31dd0 a1=9e334c8 a2=9e33620 a3=9e334c8 items=0
ppid=24967 pid=24968 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0
egid=12 sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="spamc"
exe="/usr/bin/spamc" subj=system_u:system_r:spamc_t:s0 key=(null)
type=AVC msg=audit(1282558326.267:43264): avc: denied { noatsecure }
for pid=24968 comm="spamc" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:spamc_t:s0 tclass=process
type=AVC msg=audit(1282558326.267:43264): avc: denied { siginh } for
pid=24968 comm="spamc" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:spamc_t:s0 tclass=process
type=AVC msg=audit(1282558326.267:43264): avc: denied { rlimitinh }
for pid=24968 comm="spamc" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:spamc_t:s0 tclass=process
----
time->Mon Aug 23 11:12:06 2010
type=SYSCALL msg=audit(1282558326.309:43265): arch=40000003 syscall=5
success=no exit=-13 a0=606a29 a1=80000 a2=1b6 a3=6069c5 items=0
ppid=20953 pid=20954 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) ses=772 comm="spamd" exe="/usr/bin/perl"
subj=unconfined_u:system_r:spamd_t:s0 key=(null)
type=AVC msg=audit(1282558326.309:43265): avc: denied { read } for
pid=20954 comm="spamd" name="shadow" dev=sda6 ino=85497
scontext=unconfined_u:system_r:spamd_t:s0
tcontext=system_u:object_r:shadow_t:s0 tclass=file
----
time->Mon Aug 23 11:12:09 2010
type=SYSCALL msg=audit(1282558329.941:43268): arch=40000003 syscall=300
success=no exit=-13 a0=9 a1=243c883 a2=bf8d6de0 a3=0 items=0 ppid=1
pid=1228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=(none) ses=4294967295 comm="rpc.mountd"
exe="/usr/sbin/rpc.mountd" subj=system_u:system_r:nfsd_t:s0 key=(null)
type=AVC msg=audit(1282558329.941:43268): avc: denied { getattr } for
pid=1228 comm="rpc.mountd" path="/proc/kcore" dev=proc ino=4026531989
scontext=system_u:system_r:nfsd_t:s0
tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file
----
time->Mon Aug 23 11:12:09 2010
type=SYSCALL msg=audit(1282558329.947:43269): arch=40000003 syscall=5
success=no exit=-13 a0=243b978 a1=8000 a2=0 a3=243b938 items=0 ppid=1
pid=1228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=(none) ses=4294967295 comm="rpc.mountd"
exe="/usr/sbin/rpc.mountd" subj=system_u:system_r:nfsd_t:s0 key=(null)
type=AVC msg=audit(1282558329.947:43269): avc: denied { read } for
pid=1228 comm="rpc.mountd" name="sda8" dev=devtmpfs ino=5613
scontext=system_u:system_r:nfsd_t:s0
tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
----
> >>
> >>>>
> >>>> Policy defines that if a process running in the procmail_t domain runs a
> >>>> file labelled clamscan_exec_t, that procmail_t will domain transition to
> >>>> clamscan_t domain.
> >>>>
> >>>> This did not happen on your config.
> >>>>
> >>>> Either your clamdscan executable file is mislabelled or you are missing
> >>>> a domain transition rule.
> >>>>
> >>>> Where is your "clamdscan" executable file located, and what is it labelled?
> >>>
> >>> see above.
> >>>
> >>>> What does the following return:
> >>>>
> >>>> sesearch -SC --allow -s procmail_t -t clamscan_t -c process
> >>>> sesearch -SC --allow -s procmail_t -t clamscan_exec_t -f file
> >>>
> >>> # sesearch -SC --allow -s procmail_t -t clamscan_t -c process
> >>> Found 1 semantic av rules:
> >>> allow procmail_t clamscan_t : process transition ;
> >>>
> >>> # sesearch -SC --allow -s procmail_t -t clamscan_exec_t -f file
> >>> sesearch: invalid option -- 'f'
> >>> Usage: sesearch [OPTIONS] RULE_TYPE [RULE_TYPE ...] [EXPESSION]
> >>> [POLICY ...]
> >>>
> >>> Try sesearch --help for more help.
> >>>
> >>>
> >>>
> >>>
> >>>
> >>>
> >>>
> >>> --
> >>> selinux mailing list
> >>> selinux at lists.fedoraproject.org
> >>> https://admin.fedoraproject.org/mailman/listinfo/selinux
> >>
> >>
> >> --
> >> selinux mailing list
> >> selinux at lists.fedoraproject.org
> >> https://admin.fedoraproject.org/mailman/listinfo/selinux
> >>
> >>
> >> --
> >> selinux mailing list
> >> selinux at lists.fedoraproject.org
> >> https://admin.fedoraproject.org/mailman/listinfo/selinux
>
>
> --
> selinux mailing list
> selinux at lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
Url : http://lists.fedoraproject.org/pipermail/selinux/attachments/20100823/0479d7f1/attachment-0001.bin
More information about the selinux
mailing list