selinux April 2008

selinux@lists.fedoraproject.org

30 participants
38 discussions

AVC everytime I launch a tab in firefox from gnome-terminal
by Chuck Anderson 14 Apr '08

14 Apr '08

Every time I launch a tab from a URL in gnome-terminal, I get this AVC: Hmm why is this program set-uid root? >ls -l /usr/lib/nspluginwrapper/plugin-config -rwsr-xr-x 1 root root 60048 2008-03-11 10:02 /usr/lib/nspluginwrapper/plugin-config* Summary: SELinux is preventing plugin-config (nsplugin_config_t) "execstack" to <Unknown> (nsplugin_config_t). Detailed Description: SELinux denied access requested by plugin-config. It is not expected that this access is required by plugin-config and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:unconfined_r:nsplugin_config_t:s0-s0: c0.c1023 Target Context unconfined_u:unconfined_r:nsplugin_config_t:s0-s0: c0.c1023 Target Objects None [ process ] Source plugin-config Source Path /usr/lib/nspluginwrapper/plugin-config Port <Unknown> Host dustpuppy.wpi.edu Source RPM Packages nspluginwrapper-0.9.91.5-26.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-31.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name dustpuppy.wpi.edu Platform Linux dustpuppy.wpi.edu 2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7 11:33:46 EDT 2008 i686 i686 Alert Count 14 First Seen Tue 08 Apr 2008 03:07:02 PM EDT Last Seen Fri 11 Apr 2008 11:02:14 AM EDT Local ID 3be91387-8d68-4700-868a-cc02880ae589 Line Numbers Raw Audit Messages host=dustpuppy.wpi.edu type=AVC msg=audit(1207926134.511:4168): avc: denied { execstack } for pid=30324 comm="plugin-config" scontext=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 tclass=process host=dustpuppy.wpi.edu type=SYSCALL msg=audit(1207926134.511:4168): arch=40000003 syscall=125 success=no exit=-13 a0=bff95000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=30322 pid=30324 auid=10002 uid=10002 gid=10002 euid=0 suid=0 fsuid=0 egid=10002 sgid=10002 fsgid=10002 tty=(none) ses=1 comm="plugin-config" exe="/usr/lib/nspluginwrapper/plugin-config" subj=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 key=(null)

2 2

Rawhide MLS policy.22 and policy.23
by Joe Nall 14 Apr '08

14 Apr '08

I have an MLS policy.22 and policy.23 on current rawhide. The system boots and runs policy.22. sedispol doesn't like policy.23. What controls which policy is in use? Is 22 the correct policy to be running today? joe

2 2

Confining Firefox
by Christoph Höger 11 Apr '08

11 Apr '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I've just read Daniels livejournal entry about confining firefox. One thing that hit me, when I dug a little depper into SELinux last semester, was that firefox can actually read ~/.ssh I don't know _any_ reason why it should. And I assume this is one kind of access, that SELinux should prevent. Away from talking about explicit deny rules, I would suggest, that in fedora 9 you (the active SELinux developers) deny it using something like a "unconfined_for_all_applications_but_firefox_and_fellows_t" to cut off those security relevant directories. Otherwise the next *-plugin exploit could crack even hole enterprise networks by reading admins ssh keys. regards christoph ps: What is the current state of getting a real "High-Level-Language(TM)" for SELinux configuration? -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFH/UnNhMBO4cVSGS8RAgW2AKCnHBJnEc0MMRWEYh4WgInpLmVzugCfSjkQ 3KHcUVRPd2g9sux9ZBWlofE= =TTfw -----END PGP SIGNATURE-----

4 4

Re: gconf alert
by Valent Turkovic 10 Apr '08

10 Apr '08

On Sat, Apr 5, 2008 at 9:21 PM, Daniel J Walsh <dwalsh(a)redhat.com> wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Valent Turkovic wrote: > > On Sat, Mar 29, 2008 at 6:55 PM, Daniel J Walsh <dwalsh(a)redhat.com> wrote: > >> -----BEGIN PGP SIGNED MESSAGE----- > >> Hash: SHA1 > >> > >> Valent Turkovic wrote: > >> > >>> On Thu, Mar 27, 2008 at 6:36 PM, John Dennis <jdennis(a)redhat.com> wrote: > >> >> Valent Turkovic wrote: > >> >> > I'm creating live cds under rawhide and I have selinux in permissive > >> >> > mode, could that be reason I'm seeing these hundreds of alerts? > >> >> > >> >> https://www.redhat.com/archives/fedora-selinux-list/2008-March/msg00130.html > >> >> > >> >> -- > >> >> John Dennis <jdennis(a)redhat.com> > >> >> > >> > > >> > Ok, I'm an idiot :) I got so much going on at once (work, moving to > >> > new apartment, etc...) that I totally forgot I got this replied > >> > already. > >> > > >> > But I want to keep in permissive an not enforcing mode so is just > >> > "load_policy" enough ? > >> > > >> > Cheers, > >> > Valent. > >> > > >> load_policy and you might need to kill any processes that are running as > >> unlabeled_t. Potentially you could have files that are mislabeled. > > > > > > > > I made several load_policy and relabels with reboot ans I still see > > these errors! > > Do you have any idea why? > > > > Cheers, > > Valent > > . > > > > > Do you have two policy files in /etc/selinux/targeted/policy? # ls -al /etc/selinux/targeted/policy total 4056 drwxr-xr-x 2 root root 4096 2008-04-03 23:05 . drwxr-xr-x 5 root root 4096 2008-04-03 23:05 .. -rw-r--r-- 1 root root 4128435 2008-04-03 23:05 policy.21 as you can see I have only on file in policy directory > If you do, remove the lower version and then execute load_policy, > Relabel the file in question and you should not have a problem. If the > file is in /tmp you can remove it or set its label to tmp_t. I'm going now to move all files from /tmp to another folder and then if reboot succeeds I'll delete those files and see if I still see selinux alerts. So you haven't seen this kind of error? Nobody has reported anything similar? Valent. -- http://kernelreloaded.blog385.com/ linux, blog, anime, spirituality, windsurf, wireless registered as user #367004 with the Linux Counter, http://counter.li.org. ICQ: 2125241, Skype: valent.turkovic

2 2

setsebool ok & smb denied
by Laurent Jacquot 10 Apr '08

10 Apr '08

Hello, on my F8 up2date, SMB is denied read access to user_iceauth_home_t context even if I have: [root@jack ~]# getsebool -a |grep samba samba_domain_controller --> off samba_enable_home_dirs --> on samba_export_all_ro --> off samba_export_all_rw --> off samba_run_unconfined --> on samba_share_nfs --> off use_samba_home_dirs --> on Should I bugzilla it? and also dontaudit, allow or deny? Résumé: SELinux is preventing the samba daemon from reading users' home directories. Description détaillée: SELinux has denied the samba daemon access to users' home directories. Someone is attempting to access your home directories via your samba daemon. If you only setup samba to share non-home directories, this probably signals a intrusion attempt. For more information on SELinux integration with samba, look at the samba_selinux man page. (man samba_selinux) Autoriser l'accès: Si vous souhaitez que samba partage des répertoires personnels vous devez activer le booléen samba_enable_home_dirs : "setsebool -P samba_enable_home_dirs=1" La commande suivante autorisera cet accès : setsebool -P samba_enable_home_dirs=1 Informations complémentaires: Contexte source system_u:system_r:smbd_t:s0 Contexte cible system_u:object_r:user_iceauth_home_t:s0 Objets du contexte /home/alex/.ICEauthority [ file ] Source smbd Source Path /usr/sbin/smbd Port <Inconnu> Host jack.lutty.net Source RPM Packages samba-3.0.28a-0.fc8 Target RPM Packages Politique RPM selinux-policy-3.0.8-95.fc8 Selinux activé True Type de politique targeted MLS activé True Mode strict Enforcing Nom du plugin samba_enable_home_dirs Nom de l'hôte jack.lutty.net Plateforme Linux jack.lutty.net 2.6.24.4-64.fc8 #1 SMP Sat Mar 29 09:54:46 EDT 2008 i686 i686 Compteur d'alertes 28 First Seen ven 04 avr 2008 23:16:29 CEST Last Seen mer 09 avr 2008 16:34:17 CEST Local ID d2ee22f9-866b-4305-94c8-a029aee20c19 Numéros des lignes Messages d'audit bruts host=jack.lutty.net type=AVC msg=audit(1207751657.63:1353): avc: denied { getattr } for pid=32716 comm="smbd" path="/home/alex/.ICEauthority" dev=dm-11 ino=850503 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:user_iceauth_home_t:s0 tclass=file host=jack.lutty.net type=SYSCALL msg=audit(1207751657.63:1353): arch=40000003 syscall=195 success=no exit=-13 a0=bfc33194 a1=bfc32914 a2=4c5ff4 a3=bfc32914 items=0 ppid=3346 pid=32716 auid=4294967295 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=500 sgid=0 fsgid=500 tty=(none) comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null) jk

2 1

loadkey avc denied
by Laurent Jacquot 10 Apr '08

10 Apr '08

Hello, Every time I reboot, I have those 9 AVCs in /var/log/messages: Apr 3 19:18:35 jack kernel: audit(1207243095.907:4): avc: denied { sys_admin } for pid=1707 comm="loadkeys" capability=21 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability Apr 3 19:18:35 jack kernel: audit(1207243095.907:5): avc: denied { sys_admin } for pid=1707 comm="loadkeys" capability=21 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability Apr 3 19:18:35 jack kernel: audit(1207243095.907:6): avc: denied { sys_admin } for pid=1707 comm="loadkeys" capability=21 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability Apr 3 19:18:35 jack kernel: audit(1207243095.907:7): avc: denied { sys_admin } for pid=1707 comm="loadkeys" capability=21 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability Apr 3 19:18:35 jack kernel: audit(1207243095.907:8): avc: denied { sys_admin } for pid=1707 comm="loadkeys" capability=21 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability Apr 3 19:18:35 jack kernel: audit(1207243095.907:9): avc: denied { sys_admin } for pid=1707 comm="loadkeys" capability=21 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability Apr 3 19:18:35 jack kernel: audit(1207243095.907:10): avc: denied { sys_admin } for pid=1707 comm="loadkeys" capability=21 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability Apr 3 19:18:35 jack kernel: audit(1207243095.907:11): avc: denied { sys_admin } for pid=1707 comm="loadkeys" capability=21 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability Apr 3 19:18:35 jack kernel: audit(1207243095.907:12): avc: denied { sys_admin } for pid=1707 comm="loadkeys" capability=21 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:system_r:loadkeys_t:s0 tclass=capability They are generated before audit runs. What are they trying to tell me? Should I relabel something or bug it? TIA Laurent

2 1

Fedora 8: NetworkManager, OpenVPN and SELinux
by Pedro Lamarão 10 Apr '08

10 Apr '08

Hello all. I'm experimenting with a VPN connection set up through the NetworkManager panel applet. I have all certificate and key files stored in my home directory. Trying to start this VPN connection triggers an AVC DENIED. host=localhost.localdomain type=AVC msg=audit(1207523029.36:66): avc: denied { read } for pid=6400 comm="openvpn" name="pedro.crt" dev=dm-2 ino=2408465 scontext=system_u:system_r:openvpn_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file host=localhost.localdomain type=SYSCALL msg=audit(1207523029.36:66): arch=40000003 syscall=5 success=no exit=-13 a0=bfa7ef0b a1=8000 a2=1b6 a3=8d23660 items=0 ppid=6396 pid=6400 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="openvpn" exe="/usr/sbin/openvpn" subj=system_u:system_r:openvpn_t:s0 key=(null) It seems to me that this denial makes complete sense, since OpenVPN should not be reading users' files. On the other hand, this NetworkManager configuration functionality should allow users to use their own files -- that is, it seems users are not required to be root and place files in /etc/openvpn. Also, most users won't be knowledgeable enough to know how to change file label -- and this would be error prone, if there was ever a full relabel in the filesystem. I'll be using all files in /etc/openvpn while this is not sorted out to exercise NetworkManager. -- P.

2 1

flood of selinux avcs, settroubleshoot all over the place(sorry for all the avcs)
by Antonio Olivares 09 Apr '08

09 Apr '08

Dear all, Here are all the selinux errors that I have encountered. I apologize for putting in all at the same time, but I am just overwhelmed at the amount. I guess setroubleshoot daemon got happy and started sending all the avcs encountered. Thank you for advice given in advance. Regards, Antonio Summary: SELinux is preventing gvfsd-trash (staff_t) "dac_override" to <Unknown> (staff_t). Detailed Description: SELinux denied access requested by gvfsd-trash. It is not expected that this access is required by gvfsd-trash and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context root:staff_r:staff_t:SystemLow-SystemHigh Target Context root:staff_r:staff_t:SystemLow-SystemHigh Target Objects None [ capability ] Source pulseaudio Source Path /usr/bin/pulseaudio Port <Unknown> Host localhost.localdomain Source RPM Packages gvfs-0.2.3-1.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-29.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7 11:33:46 EDT 2008 i686 i686 Alert Count 39 First Seen Wed 09 Apr 2008 07:03:20 PM CDT Last Seen Wed 09 Apr 2008 07:03:45 PM CDT Local ID d2fbeab2-c5e1-4968-a58a-3897ade13c01 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207785825.117:127): avc: denied { dac_override } for pid=5405 comm="gvfsd-trash" capability=1 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability host=localhost.localdomain type=AVC msg=audit(1207785825.117:127): avc: denied { dac_read_search } for pid=5405 comm="gvfsd-trash" capability=2 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability host=localhost.localdomain type=SYSCALL msg=audit(1207785825.117:127): arch=40000003 syscall=196 success=no exit=-13 a0=86652e8 a1=b741b1e0 a2=d14ff4 a3=0 items=0 ppid=5404 pid=5405 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="gvfsd-trash" exe="/usr/libexec/gvfsd-trash" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing escd (staff_t) "read write" to ./636F6F6C6B6579706B313173452D47617465203020302D30 (auth_cache_t). Detailed Description: SELinux denied access requested by escd. It is not expected that this access is required by escd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./636F6F6C6B6579706B313173452D47617465203020302D30, restorecon -v './636F6F6C6B6579706B313173452D47617465203020302D30' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context root:staff_r:staff_t:SystemLow-SystemHigh Target Context system_u:object_r:auth_cache_t Target Objects ./636F6F6C6B6579706B313173452D47617465203020302D30 [ file ] Source escd Source Path /usr/lib/esc-1.0.1/escd Port <Unknown> Host localhost.localdomain Source RPM Packages esc-1.0.1-9.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-29.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7 11:33:46 EDT 2008 i686 i686 Alert Count 1 First Seen Wed 09 Apr 2008 07:03:22 PM CDT Last Seen Wed 09 Apr 2008 07:03:22 PM CDT Local ID 6cd2e4ee-4e7e-4112-adcc-b3705916d481 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207785802.447:91): avc: denied { read write } for pid=5282 comm="escd" name=636F6F6C6B6579706B313173452D47617465203020302D30 dev=dm-0 ino=2485540 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:auth_cache_t:s0 tclass=file host=localhost.localdomain type=SYSCALL msg=audit(1207785802.447:91): arch=40000003 syscall=5 success=no exit=-13 a0=8a45540 a1=20002 a2=180 a3=0 items=0 ppid=1 pid=5282 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="escd" exe="/usr/lib/esc-1.0.1/escd" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing pulseaudio (staff_t) "ipc_lock" to <Unknown> (staff_t). Detailed Description: SELinux denied access requested by pulseaudio. It is not expected that this access is required by pulseaudio and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context root:staff_r:staff_t:SystemLow-SystemHigh Target Context root:staff_r:staff_t:SystemLow-SystemHigh Target Objects None [ capability ] Source gnome-keyring-d Source Path /usr/bin/gnome-keyring-daemon Port <Unknown> Host localhost.localdomain Source RPM Packages pulseaudio-0.9.10-1.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-29.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7 11:33:46 EDT 2008 i686 i686 Alert Count 15 First Seen Wed 09 Apr 2008 07:03:06 PM CDT Last Seen Wed 09 Apr 2008 07:03:21 PM CDT Local ID 638ce06f-cd52-41b7-8f87-c3296b7b9c4e Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207785801.262:89): avc: denied { ipc_lock } for pid=5217 comm="pulseaudio" capability=14 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability host=localhost.localdomain type=SYSCALL msg=audit(1207785801.262:89): arch=40000003 syscall=150 success=yes exit=0 a0=b6804000 a1=3c84 a2=195cb4 a3=3c84 items=0 ppid=5214 pid=5217 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing gvfs-fuse-daemo (staff_t) "sys_admin" to <Unknown> (staff_t). Detailed Description: SELinux denied access requested by gvfs-fuse-daemo. It is not expected that this access is required by gvfs-fuse-daemo and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context root:staff_r:staff_t:SystemLow-SystemHigh Target Context root:staff_r:staff_t:SystemLow-SystemHigh Target Objects None [ capability ] Source gvfs-fuse-daemo Source Path /usr/libexec/gvfs-fuse-daemon Port <Unknown> Host localhost.localdomain Source RPM Packages gvfs-fuse-0.2.3-1.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-29.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7 11:33:46 EDT 2008 i686 i686 Alert Count 1 First Seen Wed 09 Apr 2008 07:03:21 PM CDT Last Seen Wed 09 Apr 2008 07:03:21 PM CDT Local ID f714cec5-eca8-4de6-a60b-d07f6e690250 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207785801.751:90): avc: denied { sys_admin } for pid=5256 comm="gvfs-fuse-daemo" capability=21 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability host=localhost.localdomain type=SYSCALL msg=audit(1207785801.751:90): arch=40000003 syscall=21 success=no exit=-1 a0=90654d0 a1=9064940 a2=9065510 a3=6 items=0 ppid=1 pid=5256 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="gvfs-fuse-daemo" exe="/usr/libexec/gvfs-fuse-daemon" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing firefox (staff_t) "setuid" to <Unknown> (staff_t). Detailed Description: SELinux denied access requested by firefox. It is not expected that this access is required by firefox and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context root:staff_r:staff_t:SystemLow-SystemHigh Target Context root:staff_r:staff_t:SystemLow-SystemHigh Target Objects None [ capability ] Source firefox Source Path /usr/lib/firefox-3.0b5/firefox Port <Unknown> Host localhost.localdomain Source RPM Packages firefox-3.0-0.53.beta5.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-29.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7 11:33:46 EDT 2008 i686 i686 Alert Count 14 First Seen Wed 09 Apr 2008 07:04:12 PM CDT Last Seen Wed 09 Apr 2008 07:04:12 PM CDT Local ID 728a632a-191d-449d-b1a1-aa9cff7a16f1 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207785852.141:144): avc: denied { setuid } for pid=5422 comm="firefox" capability=7 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability host=localhost.localdomain type=SYSCALL msg=audit(1207785852.141:144): arch=40000003 syscall=208 success=yes exit=0 a0=ffffffff a1=0 a2=ffffffff a3=bfee4c1c items=0 ppid=5408 pid=5422 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="firefox" exe="/usr/lib/firefox-3.0b5/firefox" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing firefox (staff_t) "write" to ./firefox-3.0b5 (lib_t). Detailed Description: SELinux denied access requested by firefox. It is not expected that this access is required by firefox and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./firefox-3.0b5, restorecon -v './firefox-3.0b5' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context root:staff_r:staff_t:SystemLow-SystemHigh Target Context system_u:object_r:lib_t Target Objects ./firefox-3.0b5 [ dir ] Source firefox Source Path /usr/lib/firefox-3.0b5/firefox Port <Unknown> Host localhost.localdomain Source RPM Packages firefox-3.0-0.53.beta5.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-29.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7 11:33:46 EDT 2008 i686 i686 Alert Count 1 First Seen Wed 09 Apr 2008 07:03:48 PM CDT Last Seen Wed 09 Apr 2008 07:03:52 PM CDT Local ID ba8ecec3-9fce-4945-92ed-d9640d5a0ea7 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207785832.379:129): avc: denied { write } for pid=5422 comm="firefox" name="firefox-3.0b5" dev=dm-0 ino=4287001 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=dir host=localhost.localdomain type=SYSCALL msg=audit(1207785832.379:129): arch=40000003 syscall=5 success=no exit=-13 a0=85ec4f0 a1=82c1 a2=1a4 a3=82c1 items=0 ppid=5408 pid=5422 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="firefox" exe="/usr/lib/firefox-3.0b5/firefox" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing pulseaudio (staff_t) "sys_resource" to <Unknown> (staff_t). Detailed Description: SELinux denied access requested by pulseaudio. It is not expected that this access is required by pulseaudio and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context root:staff_r:staff_t:SystemLow-SystemHigh Target Context root:staff_r:staff_t:SystemLow-SystemHigh Target Objects None [ capability ] Source pulseaudio Source Path /usr/bin/pulseaudio Port <Unknown> Host localhost.localdomain Source RPM Packages pulseaudio-0.9.10-1.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-29.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7 11:33:46 EDT 2008 i686 i686 Alert Count 2 First Seen Wed 09 Apr 2008 07:03:20 PM CDT Last Seen Wed 09 Apr 2008 07:03:20 PM CDT Local ID 40e0b7ff-cb5f-42de-8f1d-8302ea0c173f Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207785800.594:72): avc: denied { sys_resource } for pid=5217 comm="pulseaudio" capability=24 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability host=localhost.localdomain type=SYSCALL msg=audit(1207785800.594:72): arch=40000003 syscall=75 success=no exit=-1 a0=e a1=bfa8cd1c a2=d14ff4 a3=e items=0 ppid=5214 pid=5217 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing bash (staff_t) "write" to ./ccache (var_t). Detailed Description: SELinux denied access requested by bash. It is not expected that this access is required by bash and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./ccache, restorecon -v './ccache' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context root:staff_r:staff_t:SystemLow-SystemHigh Target Context system_u:object_r:var_t Target Objects ./ccache [ dir ] Source bash Source Path /bin/bash Port <Unknown> Host localhost.localdomain Source RPM Packages bash-3.2-22.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-29.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7 11:33:46 EDT 2008 i686 i686 Alert Count 1 First Seen Wed 09 Apr 2008 07:03:18 PM CDT Last Seen Wed 09 Apr 2008 07:03:18 PM CDT Local ID 8b8507ac-7e45-4ce0-b52f-b25b6c69c03f Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207785798.523:69): avc: denied { write } for pid=5092 comm="bash" name="ccache" dev=dm-0 ino=2485510 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_t:s0 tclass=dir host=localhost.localdomain type=SYSCALL msg=audit(1207785798.523:69): arch=40000003 syscall=33 success=no exit=-13 a0=9eaad78 a1=2 a2=d14ff4 a3=0 items=0 ppid=4990 pid=5092 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="bash" exe="/bin/bash" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing gnome-session (staff_t) "write" to ./fontconfig (fonts_t). Detailed Description: SELinux denied access requested by gnome-session. It is not expected that this access is required by gnome-session and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./fontconfig, restorecon -v './fontconfig' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context root:staff_r:staff_t:SystemLow-SystemHigh Target Context system_u:object_r:fonts_t Target Objects ./fontconfig [ dir ] Source gnome-session Source Path /usr/bin/gnome-session Port <Unknown> Host localhost.localdomain Source RPM Packages gnome-session-2.22.1-1.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-29.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7 11:33:46 EDT 2008 i686 i686 Alert Count 1 First Seen Wed 09 Apr 2008 07:03:18 PM CDT Last Seen Wed 09 Apr 2008 07:03:18 PM CDT Local ID fddf24c2-0902-4a50-8909-4bd30c0839b6 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207785798.732:70): avc: denied { write } for pid=5092 comm="gnome-session" name="fontconfig" dev=dm-0 ino=2387443 scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fonts_t:s0 tclass=dir host=localhost.localdomain type=SYSCALL msg=audit(1207785798.732:70): arch=40000003 syscall=33 success=no exit=-13 a0=8536358 a1=2 a2=a85694 a3=852daa8 items=0 ppid=4990 pid=5092 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="gnome-session" exe="/usr/bin/gnome-session" subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing escd (user_t) "write" to ./coolkey (auth_cache_t). Detailed Description: SELinux denied access requested by escd. It is not expected that this access is required by escd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./coolkey, restorecon -v './coolkey' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context user_u:user_r:user_t Target Context system_u:object_r:auth_cache_t Target Objects ./coolkey [ dir ] Source escd Source Path /usr/lib/esc-1.0.1/escd Port <Unknown> Host localhost.localdomain Source RPM Packages esc-1.0.1-9.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-29.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7 11:33:46 EDT 2008 i686 i686 Alert Count 4 First Seen Wed 09 Apr 2008 06:34:01 PM CDT Last Seen Wed 09 Apr 2008 07:02:51 PM CDT Local ID 08e479ee-11d3-4d0c-892c-e8ce4f8beb7b Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207785771.193:60): avc: denied { write } for pid=4321 comm="escd" name="coolkey" dev=dm-0 ino=2485506 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:auth_cache_t:s0 tclass=dir host=localhost.localdomain type=SYSCALL msg=audit(1207785771.193:60): arch=40000003 syscall=5 success=no exit=-13 a0=88b4ba0 a1=4c2 a2=180 a3=88b3508 items=0 ppid=1 pid=4321 auid=502 uid=502 gid=502 euid=502 suid=502 fsuid=502 egid=502 sgid=502 fsgid=502 tty=(none) ses=3 comm="escd" exe="/usr/lib/esc-1.0.1/escd" subj=user_u:user_r:user_t:s0 key=(null) Summary: SELinux is preventing userhelper (user_t) "read write" to ./eject (userhelper_conf_t). Detailed Description: SELinux denied access requested by userhelper. It is not expected that this access is required by userhelper and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./eject, restorecon -v './eject' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context user_u:user_r:user_t Target Context system_u:object_r:userhelper_conf_t Target Objects ./eject [ file ] Source userhelper Source Path /usr/sbin/userhelper Port <Unknown> Host localhost.localdomain Source RPM Packages usermode-1.96-1 Target RPM Packages Policy RPM selinux-policy-3.3.1-29.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7 11:33:46 EDT 2008 i686 i686 Alert Count 3 First Seen Wed 09 Apr 2008 06:34:03 PM CDT Last Seen Wed 09 Apr 2008 06:54:10 PM CDT Local ID 971298b0-6bc0-4ee0-a08e-efb07076dd3d Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207785250.626:49): avc: denied { read write } for pid=4559 comm="userhelper" name="eject" dev=dm-0 ino=4055485 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:userhelper_conf_t:s0 tclass=file host=localhost.localdomain type=SYSCALL msg=audit(1207785250.626:49): arch=40000003 syscall=5 success=no exit=-13 a0=82e3508 a1=2 a2=b809cee0 a3=82e3530 items=0 ppid=4558 pid=4559 auid=502 uid=502 gid=502 euid=0 suid=0 fsuid=0 egid=502 sgid=502 fsgid=502 tty=(none) ses=3 comm="userhelper" exe="/usr/sbin/userhelper" subj=user_u:user_r:user_t:s0 key=(null) Summary: SELinux is preventing userhelper (user_t) "read" to ./eject (userhelper_conf_t). Detailed Description: SELinux denied access requested by userhelper. It is not expected that this access is required by userhelper and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./eject, restorecon -v './eject' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context user_u:user_r:user_t Target Context system_u:object_r:userhelper_conf_t Target Objects ./eject [ file ] Source userhelper Source Path /usr/sbin/userhelper Port <Unknown> Host localhost.localdomain Source RPM Packages usermode-1.96-1 Target RPM Packages Policy RPM selinux-policy-3.3.1-29.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7 11:33:46 EDT 2008 i686 i686 Alert Count 3 First Seen Wed 09 Apr 2008 06:34:03 PM CDT Last Seen Wed 09 Apr 2008 06:54:10 PM CDT Local ID fe10c9ad-5af2-4402-b68e-8d6951329af6 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207785250.628:50): avc: denied { read } for pid=4559 comm="userhelper" name="eject" dev=dm-0 ino=4055485 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:userhelper_conf_t:s0 tclass=file host=localhost.localdomain type=SYSCALL msg=audit(1207785250.628:50): arch=40000003 syscall=5 success=no exit=-13 a0=82e3508 a1=0 a2=b809cee0 a3=82e3530 items=0 ppid=4558 pid=4559 auid=502 uid=502 gid=502 euid=0 suid=0 fsuid=0 egid=502 sgid=502 fsgid=502 tty=(none) ses=3 comm="userhelper" exe="/usr/sbin/userhelper" subj=user_u:user_r:user_t:s0 key=(null) Summary: SELinux is preventing escd (user_t) "read write" to ./636F6F6C6B6579706B313173452D47617465203020302D353031 (auth_cache_t). Detailed Description: SELinux denied access requested by escd. It is not expected that this access is required by escd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./636F6F6C6B6579706B313173452D47617465203020302D353031, restorecon -v './636F6F6C6B6579706B313173452D47617465203020302D353031' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context user_u:user_r:user_t Target Context system_u:object_r:auth_cache_t Target Objects ./636F6F6C6B6579706B313173452D47617465203020302D35 3031 [ file ] Source escd Source Path /usr/lib/esc-1.0.1/escd Port <Unknown> Host localhost.localdomain Source RPM Packages esc-1.0.1-9.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-29.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7 11:33:46 EDT 2008 i686 i686 Alert Count 2 First Seen Wed 09 Apr 2008 06:49:21 PM CDT Last Seen Wed 09 Apr 2008 06:51:48 PM CDT Local ID 655d0a34-ec8a-4327-ae0c-a21175fccec7 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207785108.494:39): avc: denied { read write } for pid=3737 comm="escd" name=636F6F6C6B6579706B313173452D47617465203020302D353031 dev=dm-0 ino=2485541 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:auth_cache_t:s0 tclass=file host=localhost.localdomain type=SYSCALL msg=audit(1207785108.494:39): arch=40000003 syscall=5 success=no exit=-13 a0=880aba0 a1=20002 a2=180 a3=0 items=0 ppid=1 pid=3737 auid=501 uid=501 gid=501 euid=501 suid=501 fsuid=501 egid=501 sgid=501 fsgid=501 tty=(none) ses=2 comm="escd" exe="/usr/lib/esc-1.0.1/escd" subj=user_u:user_r:user_t:s0 key=(null) Summary: SELinux is preventing wine-preloader (user_t) "mmap_zero" to <Unknown> (user_t). Detailed Description: SELinux denied access requested by wine-preloader. It is not expected that this access is required by wine-preloader and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context user_u:user_r:user_t Target Context user_u:user_r:user_t Target Objects None [ memprotect ] Source wine-preloader Source Path /usr/bin/wine-preloader Port <Unknown> Host localhost.localdomain Source RPM Packages wine-core-0.9.58-1.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-29.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7 11:33:46 EDT 2008 i686 i686 Alert Count 1 First Seen Wed 09 Apr 2008 06:50:02 PM CDT Last Seen Wed 09 Apr 2008 06:50:02 PM CDT Local ID 6f6e94e5-fbf2-43ea-b941-dba1d1da982b Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207785002.401:35): avc: denied { mmap_zero } for pid=3847 comm="wine-preloader" scontext=user_u:user_r:user_t:s0 tcontext=user_u:user_r:user_t:s0 tclass=memprotect host=localhost.localdomain type=SYSCALL msg=audit(1207785002.401:35): arch=40000003 syscall=90 success=no exit=-13 a0=bfed76dc a1=bfed76dc a2=60000000 a3=bfed76dc items=0 ppid=1 pid=3847 auid=501 uid=501 gid=501 euid=501 suid=501 fsuid=501 egid=501 sgid=501 fsgid=501 tty=(none) ses=2 comm="wine-preloader" exe="/usr/bin/wine-preloader" subj=user_u:user_r:user_t:s0 key=(null) Summary: SELinux prevented X from using the terminal tty0. Detailed Description: SELinux prevented X from using the terminal tty0. In most cases daemons do not need to interact with the terminal, usually these avc messages can be ignored. All of the confined daemons should have dontaudit rules around using the terminal. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this selinux-policy. If you would like to allow all daemons to interact with the terminal, you can turn on the allow_daemons_use_tty boolean. Allowing Access: Changing the "allow_daemons_use_tty" boolean to true will allow this access: "setsebool -P allow_daemons_use_tty=1." Fix Command: setsebool -P allow_daemons_use_tty=1 Additional Information: Source Context user_u:user_r:user_t Target Context system_u:object_r:tty_device_t Target Objects tty0 [ chr_file ] Source X Source Path /usr/bin/Xorg Port <Unknown> Host localhost.localdomain Source RPM Packages xorg-x11-server-Xorg-1.4.99.901-17.20080401.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-28.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name allow_daemons_use_tty Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.201.rc8.git4.fc9.i686 #1 SMP Sun Apr 6 21:55:27 EDT 2008 i686 i686 Alert Count 8 First Seen Fri 04 Apr 2008 06:52:01 PM CDT Last Seen Mon 07 Apr 2008 08:13:50 PM CDT Local ID 4c3eddb6-6a5d-420f-a3de-1649183f872c Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207617230.297:90): avc: denied { setattr } for pid=5319 comm="X" name="tty0" dev=tmpfs ino=255 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:tty_device_t:s0 tclass=chr_file host=localhost.localdomain type=SYSCALL msg=audit(1207617230.297:90): arch=40000003 syscall=212 success=no exit=-13 a0=81bc13b a1=0 a2=0 a3=bfbd70b4 items=0 ppid=5318 pid=5319 auid=502 uid=502 gid=502 euid=0 suid=0 fsuid=0 egid=502 sgid=502 fsgid=502 tty=tty1 ses=8 comm="X" exe="/usr/bin/Xorg" subj=user_u:user_r:user_t:s0 key=(null) Summary: SELinux is preventing gdb (xdm_t) "write" to ./rpm (rpm_var_lib_t). Detailed Description: SELinux denied access requested by gdb. It is not expected that this access is required by gdb and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./rpm, restorecon -v './rpm' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:xdm_t:SystemLow-SystemHigh Target Context system_u:object_r:rpm_var_lib_t Target Objects ./rpm [ dir ] Source gdb Source Path /usr/bin/gdb Port <Unknown> Host localhost.localdomain Source RPM Packages gdb-6.8-1.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-26.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.195.rc8.git1.fc9.i686 #1 SMP Thu Apr 3 09:42:34 EDT 2008 i686 i686 Alert Count 196 First Seen Fri 04 Apr 2008 06:48:42 PM CDT Last Seen Fri 04 Apr 2008 07:56:14 PM CDT Local ID bf5f7ea8-f1a0-46bb-ade6-45dc659e7c1f Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207356974.98:206): avc: denied { write } for pid=2534 comm="gdb" name="rpm" dev=dm-0 ino=2387395 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir host=localhost.localdomain type=SYSCALL msg=audit(1207356974.98:206): arch=40000003 syscall=33 success=no exit=-13 a0=a3ddfb8 a1=2 a2=3547a4 a3=a3dde80 items=0 ppid=2533 pid=2534 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing gdb (xdm_t) "getattr" to /var/lib/rpm/Packages (rpm_var_lib_t). Detailed Description: SELinux denied access requested by gdb. It is not expected that this access is required by gdb and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /var/lib/rpm/Packages, restorecon -v '/var/lib/rpm/Packages' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:xdm_t:SystemLow-SystemHigh Target Context system_u:object_r:rpm_var_lib_t Target Objects /var/lib/rpm/Packages [ file ] Source gdb Source Path /usr/bin/gdb Port <Unknown> Host localhost.localdomain Source RPM Packages gdb-6.8-1.fc9 Target RPM Packages rpm-4.4.2.3-1.fc9 Policy RPM selinux-policy-3.3.1-26.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25-0.195.rc8.git1.fc9.i686 #1 SMP Thu Apr 3 09:42:34 EDT 2008 i686 i686 Alert Count 196 First Seen Fri 04 Apr 2008 06:48:42 PM CDT Last Seen Fri 04 Apr 2008 07:56:14 PM CDT Local ID adc70120-316b-494e-a25a-1a9f014c0282 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1207356974.99:207): avc: denied { getattr } for pid=2534 comm="gdb" path="/var/lib/rpm/Packages" dev=dm-0 ino=2387402 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file host=localhost.localdomain type=SYSCALL msg=audit(1207356974.99:207): arch=40000003 syscall=195 success=no exit=-13 a0=a3ddf98 a1=bf9e3e9c a2=d14ff4 a3=64 items=0 ppid=2533 pid=2534 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

can't print to cups-pdf
by Chuck Anderson 08 Apr '08

08 Apr '08

Trying to print to Cups-PDF from firefox generates this AVC: Summary: SELinux is preventing cups-pdf (cups_pdf_t) "write" to ./cups (cupsd_log_t). Detailed Description: SELinux denied access requested by cups-pdf. It is not expected that this access is required by cups-pdf and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./cups, restorecon -v './cups' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 Target Context system_u:object_r:cupsd_log_t:s0 Target Objects ./cups [ dir ] Source cups-pdf Source Path /usr/lib/cups/backend/cups-pdf Port <Unknown> Host foo Source RPM Packages cups-pdf-2.4.7-1.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-29.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name foo Platform Linux foo 2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7 11:33:46 EDT 2008 i686 i686 Alert Count 1 First Seen Tue 08 Apr 2008 12:24:18 PM EDT Last Seen Tue 08 Apr 2008 12:24:18 PM EDT Local ID 4eded59e-c154-4e5b-b62c-d9dbf0a482cd Line Numbers Raw Audit Messages host=foo type=AVC msg=audit(1207671858.666:72): avc: denied { write } for pid=6315 comm="cups-pdf" name="cups" dev=dm-1 ino=565527 scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cupsd_log_t:s0 tclass=dir host=foo type=SYSCALL msg=audit(1207671858.666:72): arch=40000003 syscall=5 success=no exit=-13 a0=bfb9f674 a1=441 a2=1b6 a3=440 items=0 ppid=2232 pid=6315 auid=4294967295 uid=0 gid=7 euid=0 suid=0 fsuid=0 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm="cups-pdf" exe="/usr/lib/cups/backend/cups-pdf" subj=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 key=(null)

1 0

php with oci8
by Pad Hosmane 05 Apr '08

05 Apr '08

Hi, I am compiling php 5.2.5 with OCI8 on centOS 5. I have installed the following from oracle oracle-instantclient-basic-10.2.0.3-1 oracle-instantclient-sqlplus-10.2.0.3-1 oracle-instantclient-devel-10.2.0.3-1 These were the compile used while configure php './configure' '--prefix=/usr/local/php-5.2.5' '--cache-file=../config.cache' '--with-libdir=lib' '--with-config-file-path=/usr/local/php-5.2.5/etc' '--with-config-file-scan-dir=/usr/local/php-5.2.5/etc/php.d' '--disable-debug' '--with-pic' '--disable-rpath' '--with-pear' '--with-bz2' '--with-curl' '--with-exec-dir=/usr/bin' '--with-freetype-dir=/usr' '--with-png-dir=/usr' '--enable-gd-native-ttf' '--with-gettext' '--with-gmp' '--with-iconv' '--with-jpeg-dir=/usr' '--with-openssl' '--with-pspell' '--with-pcre-regex' '--with-zlib' '--with-layout=GNU' '--enable-exif' '--enable-ftp' '--enable-magic-quotes' '--enable-sockets' '--enable-sysvsem' '--enable-sysvshm' '--enable-sysvmsg' '--enable-wddx' '--with-kerberos' '--enable-ucd-snmp-hack' '--with-snmp=shared,/usr' '--with-unixODBC=shared,/usr' '--enable-shmop' '--enable-calendar' '--with-mime-magic=/etc/httpd/conf/magic' '--without-sqlite' '--with-libxml-dir=/usr' '--enable-dom=shared' '--with-pgsql=shared' '--disable-dba' '--disable-xmlreader' '--disable-xmlwriter' '--without-gdbm' '--with-gd=shared' '--with-imap=shared' '--with-imap-ssl' '--with-mysql=shared,/usr' '--with-mysqli=shared,/usr/bin/mysql_config' '--enable-mbstring=shared' '--enable-mbregex' '--with-libmbfl' '--with-pdo-mysql=shared,/usr/bin/mysql_config' '--enable-pdo=shared' '--with-pdo-odbc=shared,unixODBC,/usr' '--with-xmlrpc=shared' '--with-ncurses=shared' '--with-ldap=shared' '--with-pdo-pgsql=shared,/usr' '--without-pdo-sqlite' '--with-db4=/usr' '--enable-force-cgi-redirect' '--enable-pcntl' '--with-xsl=shared,/usr' '--enable-xmlreader=shared' '--enable-xmlwriter=shared' '--enable-fastcgi' '--enable-cgi' '--with-apxs2=/usr/sbin/apxs' '--with-oci8=shared,instantclient,/usr/lib/oracle/10.2.0.3/client/lib' '--enable-sigchild' Compile and install was successful. Apache was not working and these are the sealert messages, i am putting here only summary, raw audit message and suggestions, which i followed in the same order below to make Apache work 1. Summary SELinux is preventing /usr/local/php-5.2.5/bin/php from loading /usr/lib/oracle/10.2.0.3/client/lib/libnnz10.so which requires text relocation. Raw Audit Messages avc: denied { execmod } for comm="php" dev=dm-0 egid=0 euid=0 exe="/usr/local/php-5.2.5/bin/php" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 path="/usr/lib/oracle/10.2.0.3/client/lib/libnnz10.so" pid=27356 scontext=root:system_r:unconfined_t:s0-s0:c0.c1023 sgid=0 subj=root:system_r:unconfined_t:s0-s0:c0.c1023 suid=0 tclass=file tcontext=system_u:object_r:lib_t:s0 tty=pts1 uid=0 chcon -t textrel_shlib_t /usr/lib/oracle/10.2.0.3/client/lib/*.so 2. SELinux is preventing /usr/sbin/httpd (httpd_t) "execstack" access to <Unknown> (httpd_t). Raw Audit Messages avc: denied { execstack } for comm="httpd" egid=0 euid=0 exe="/usr/sbin/httpd" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 pid=27907 scontext=root:system_r:httpd_t:s0 sgid=0 subj=root:system_r:httpd_t:s0 suid=0 tclass=process tcontext=root:system_r:httpd_t:s0 tty=(none) uid=0 setsebool -P httpd_disable_trans=1 3. Summary SELinux is preventing /usr/sbin/httpd from changing the access protection of memory on the heap. Raw Audit Messages avc: denied { execheap } for comm="httpd" egid=0 euid=0 exe="/usr/sbin/httpd" exit=0 fsgid=0 fsuid=0 gid=0 items=0 pid=3913 scontext=root:system_r:initrc_t:s0 sgid=0 subj=root:system_r:initrc_t:s0 suid=0 tclass=process tcontext=root:system_r:initrc_t:s0 tty=(none) uid=0 setsebool -P allow_execheap=1 Has anybody compiled PHP 5 with Oracle client on Redhat or Centos 5 with out any selinux issues? Is this the known issue or my procedures are wrong. I have tried compiling couple of weeks back with Red Hat ent5 php source rpms and got the same selinux errors. Any possible help to put back allow_execheap=0 httpd_disable_trans=0. Thanks. -- View this message in context: http://www.nabble.com/php-with-oci8-tp16447650p16447650.html Sent from the Fedora SELinux List mailing list archive at Nabble.com.

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux April 2008