selinux September 2008

selinux@lists.fedoraproject.org

35 participants
42 discussions

SELinux kerneloops and dhclient issues
by Stephen Croll 09 Sep '08

09 Sep '08

Note: Originally posted to fedora-list. The "setroubleshoot browser" is reporting the following issues on Fedora 9: SELinux is preventing kerneloops (kerneloops_t) "signal" to <Unknown> (kerneloops_t). SELinux is preventing dhclient (dhcpc_t) "read write" to socket (unconfined_t). The first issue occurred on boot, but no longer seems to be happening. The second issue occurs when I bring up eth0. Should I file a bug report, or might there be something more sinister going on? For reference, the complete reports are as follows: Summary: SELinux is preventing kerneloops (kerneloops_t) "signal" to <Unknown> (kerneloops_t). Detailed Description: SELinux denied access requested by kerneloops. It is not expected that this access is required by kerneloops and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:kerneloops_t:s0 Target Context system_u:system_r:kerneloops_t:s0 Target Objects None [ process ] Source kerneloops Source Path /usr/sbin/kerneloops Port <Unknown> Host gerbil Source RPM Packages kerneloops-0.11-1.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-84.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name gerbil Platform Linux gerbil 2.6.25.14-108.fc9.x86_64 #1 SMP Mon Aug 4 13:46:35 EDT 2008 x86_64 x86_64 Alert Count 2 First Seen Sun 07 Sep 2008 03:21:55 AM CDT Last Seen Sun 07 Sep 2008 03:21:55 AM CDT Local ID fa4c1bd0-faf1-48ba-ba55-74285538ef90 Line Numbers Raw Audit Messages host=gerbil type=AVC msg=audit(1220775715.59:8): avc: denied { signal } for pid=2363 comm="kerneloops" scontext=system_u:system_r:kerneloops_t:s0 tcontext=system_u:system_r:kerneloops_t:s0 tclass=process host=gerbil type=SYSCALL msg=audit(1220775715.59:8): arch=c000003e syscall=234 success=no exit=-13 a0=93b a1=93b a2=6 a3=8 items=0 ppid=1 pid=2363 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kerneloops" exe="/usr/sbin/kerneloops" subj=system_u:system_r:kerneloops_t:s0 key=(null) -and- Summary: SELinux is preventing dhclient (dhcpc_t) "read write" to socket (unconfined_t). Detailed Description: SELinux denied access requested by dhclient. It is not expected that this access is required by dhclient and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects socket [ unix_stream_socket ] Source dhclient Source Path /sbin/dhclient Port <Unknown> Host gerbil Source RPM Packages dhclient-4.0.0-14.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-84.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name gerbil Platform Linux gerbil 2.6.25.14-108.fc9.x86_64 #1 SMP Mon Aug 4 13:46:35 EDT 2008 x86_64 x86_64 Alert Count 16 First Seen Sun 07 Sep 2008 12:56:48 AM CDT Last Seen Sun 07 Sep 2008 03:23:07 AM CDT Local ID a3b5492a-0ef2-4cc3-bdd0-4c06696bae70 Line Numbers Raw Audit Messages host=gerbil type=AVC msg=audit(1220775787.407:21): avc: denied { read write } for pid=3069 comm="dhclient" path="socket:[68728]" dev=sockfs ino=68728 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket host=gerbil type=SYSCALL msg=audit(1220775787.407:21): arch=c000003e syscall=59 success=yes exit=0 a0=948530 a1=94ad90 a2=8f0d70 a3=3f48f67a70 items=0 ppid=2970 pid=3069 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="dhclient" exe="/sbin/dhclient" subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null) -- Steve Croll

2 4

Naive Qs about selinux modules
by Johnson, Richard 09 Sep '08

09 Sep '08

Q: Can any SELinux directive be put into a policy smodule, or are there restrictions? For example: suppose I wanted to: allow snmpd_t apmd_t:process ptrace; allow snmpd_t auditd_t:process ptrace; allow snmpd_t automount_t:process ptrace; [ ...and so on ] so that snmpd could access mib .1.3.6.1.2.1.6. (advisability notwithstanding) Could these directives be put into a policy module even though the base policy already has an snmpd i/f? Q. Can a module define new booleans? If so are they persistent if the module is unloaded and reloaded? For example; an snmpd policy module with an snmpd_can_ptrace boolean. Are there namespace conventions? Q. What happens if the base policy (or another policy modules) is updated with overlapping statements. Am I correct in believing that the set of allows is the union of the base allows + all module allows? --rich

2 3

rsync, xattrs, ntfs-3g and "selinux.selinux"
by Tom London 08 Sep '08

08 Sep '08

Running rawhide. I use "rsync" to backup my system to a USB hard drive. I also ntfs-3g mount a WinXP partition to '/mnt/windows' on boot, and I use the above rsync to back that up as well. Adding '-xattrs' to the argument list for rsync seems to produce scads of the following (I'm guessing one for each file in the ntfs-3g file system ): rsync: rsync_xal_clear: lremovexattr("mnt/windows/WINDOWS/twain_32/wiatwain.ds","security.selinux") failed: Permission denied (13) rsync: rsync_xal_clear: lremovexattr("mnt/windows/temp","security.selinux") failed: Permission denied (13) rsync: rsync_xal_clear: lremovexattr("mnt/windows/temp/setup.log","security.selinux") failed: Permission denied (13) Destination fs i ext4dev. When mounted, all the files in /mnt/windows have type: fusefs_t. When rsych'ed, the type on the ext4 fs is file_t. Running 'getfatttr -d' on the source files produces, for example: [root@localhost temp]# getfattr -d * getfattr: setup.log: Operation not supported [root@localhost temp]# On the destination fs, result is [root@localhost temp]# getfattr -d * [root@localhost temp]# This something due to the way I mounted the ntfs-3g fs? The way I run rsync? Other? thanks, tom -- Tom London

4 7

changes from fedora 7 to 9
by Robert J. Carr 08 Sep '08

08 Sep '08

Hopefully this is a quick question to those that know SELinux more than I do, which wouldn't be very hard to accomplish. I'm migrating a (working) environment from one server running Fedora 7 to another running Fedora 9. After pulling my hair out for most of the day I've found out the problem is with SELinux because when I turned it off temporarily everything worked fine. Not to get into too much detail, but my problem came from apache not being able to access a file (although the error isn't quite that clear). Between the working environment and the non-working environment I can only see a couple differences in the selinux config files in /etc, but these have never been touched in either instance. The context labels are a bit different too. The working environment has these selinux context labels: user_u:object_r:httpd_sys_content_t But the non-working environment has these context labels: unconfined_u:object_r:httpd_sys_content_t:s0 It seems to get an extra field and the user changes to unconfined. Is this relevant? There is nothing else that I can find different, is there anything else that could be the problem? Any advice would be greatly appreciated.

3 8

problems with sound, cont'd - selinux is in the way
by Antonio Olivares 04 Sep '08

04 Sep '08

Dear fellow testers and selinux experts, In the other thread, I sent error messages like Audio file file format detected. ========================================================================== Opening audio decoder: [mp3lib] MPEG layer-2, layer-3 AUDIO: 44100 Hz, 2 ch, s16le, 128.0 kbit/9.07% (ratio: 16000->176400) Selected audio codec: [mp3] afm: mp3lib (mp3lib MPEG layer-2, layer-3) ========================================================================== [AO_ALSA] alsa-lib: confmisc.c:768:(parse_card) cannot find card '0' [AO_ALSA] alsa-lib: conf.c:3513:(_snd_config_evaluate) function snd_func_card_driver returned error: No such file or directory [AO_ALSA] alsa-lib: confmisc.c:392:(snd_func_concat) error evaluating strings [AO_ALSA] alsa-lib: conf.c:3513:(_snd_config_evaluate) function snd_func_concat returned error: No such file or directory [AO_ALSA] alsa-lib: confmisc.c:1251:(snd_func_refer) error evaluating name [AO_ALSA] alsa-lib: conf.c:3513:(_snd_config_evaluate) function snd_func_refer returned error: No such file or directory [AO_ALSA] alsa-lib: conf.c:3985:(snd_config_expand) Evaluate error: No such file or directory [AO_ALSA] alsa-lib: pcm.c:2184:(snd_pcm_open_noupdate) Unknown PCM default [AO_ALSA] Playback open error: No such file or directory Could not open/initialize audio device -> no sound. Audio: no sound Video: no video without avcs, selinux is denying pulse: SELinux: initialized (dev fuse, type fuse), uses genfs_contexts type=1400 audit(1220529397.477:16): avc: denied { execstack } for pid=2945 comm="operapluginwrap" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process type=1400 audit(1220529397.482:17): avc: denied { execstack } for pid=2945 comm="operapluginwrap" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process type=1400 audit(1220529634.634:18): avc: denied { execstack } for pid=3088 comm="operapluginwrap" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process type=1400 audit(1220529634.643:19): avc: denied { execstack } for pid=3088 comm="operapluginwrap" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process type=1400 audit(1220529745.350:20): avc: denied { sys_tty_config } for pid=3224 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529745.389:21): avc: denied { sys_tty_config } for pid=3226 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529745.571:22): avc: denied { sys_tty_config } for pid=3228 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529745.611:23): avc: denied { sys_tty_config } for pid=3230 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529756.030:24): avc: denied { sys_tty_config } for pid=3233 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529756.095:25): avc: denied { sys_tty_config } for pid=3235 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529756.244:26): avc: denied { sys_tty_config } for pid=3237 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529756.283:27): avc: denied { sys_tty_config } for pid=3239 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529756.402:28): avc: denied { sys_tty_config } for pid=3241 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529756.442:29): avc: denied { sys_tty_config } for pid=3243 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529756.643:30): avc: denied { sys_tty_config } for pid=3245 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529756.683:31): avc: denied { sys_tty_config } for pid=3247 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529759.722:32): avc: denied { sys_tty_config } for pid=3249 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529759.763:33): avc: denied { sys_tty_config } for pid=3251 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability __ratelimit: 24 callbacks suppressed type=1400 audit(1220529767.214:42): avc: denied { sys_tty_config } for pid=3271 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529767.317:43): avc: denied { sys_tty_config } for pid=3273 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529767.714:44): avc: denied { sys_tty_config } for pid=3275 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529767.757:45): avc: denied { sys_tty_config } for pid=3277 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529768.485:46): avc: denied { sys_tty_config } for pid=3281 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529768.525:47): avc: denied { sys_tty_config } for pid=3283 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529770.778:48): avc: denied { sys_tty_config } for pid=3285 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529770.859:49): avc: denied { sys_tty_config } for pid=3287 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529772.510:50): avc: denied { sys_tty_config } for pid=3297 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529772.550:51): avc: denied { sys_tty_config } for pid=3299 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529775.226:52): avc: denied { sys_tty_config } for pid=3301 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529775.279:53): avc: denied { sys_tty_config } for pid=3303 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529775.453:54): avc: denied { sys_tty_config } for pid=3305 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529775.492:55): avc: denied { sys_tty_config } for pid=3307 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529777.577:56): avc: denied { sys_tty_config } for pid=3309 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529777.634:57): avc: denied { sys_tty_config } for pid=3311 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529777.769:58): avc: denied { sys_tty_config } for pid=3313 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529777.810:59): avc: denied { sys_tty_config } for pid=3315 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529780.434:60): avc: denied { sys_tty_config } for pid=3317 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529780.632:61): avc: denied { sys_tty_config } for pid=3319 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529781.084:62): avc: denied { sys_tty_config } for pid=3329 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529781.126:63): avc: denied { sys_tty_config } for pid=3331 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529784.000:64): avc: denied { sys_tty_config } for pid=3333 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529784.110:65): avc: denied { sys_tty_config } for pid=3335 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529784.430:66): avc: denied { sys_tty_config } for pid=3337 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529784.477:67): avc: denied { sys_tty_config } for pid=3339 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529784.823:68): avc: denied { sys_tty_config } for pid=3341 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529784.865:69): avc: denied { sys_tty_config } for pid=3343 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529788.255:70): avc: denied { sys_tty_config } for pid=3345 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529788.529:71): avc: denied { sys_tty_config } for pid=3347 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529788.655:72): avc: denied { sys_tty_config } for pid=3349 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529788.700:73): avc: denied { sys_tty_config } for pid=3351 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability __ratelimit: 6 callbacks suppressed type=1400 audit(1220529811.625:76): avc: denied { sys_tty_config } for pid=3357 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529811.686:77): avc: denied { sys_tty_config } for pid=3359 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529811.827:78): avc: denied { sys_tty_config } for pid=3361 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529811.869:79): avc: denied { sys_tty_config } for pid=3363 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529812.004:80): avc: denied { sys_tty_config } for pid=3365 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529812.072:81): avc: denied { sys_tty_config } for pid=3367 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529812.310:82): avc: denied { sys_tty_config } for pid=3369 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529812.352:83): avc: denied { sys_tty_config } for pid=3371 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529814.439:84): avc: denied { sys_tty_config } for pid=3373 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529814.487:85): avc: denied { sys_tty_config } for pid=3375 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability __ratelimit: 12 callbacks suppressed type=1400 audit(1220529818.528:90): avc: denied { sys_tty_config } for pid=3393 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529818.568:91): avc: denied { sys_tty_config } for pid=3395 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529820.169:92): avc: denied { sys_tty_config } for pid=3405 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529820.212:93): avc: denied { sys_tty_config } for pid=3407 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529820.505:94): avc: denied { sys_tty_config } for pid=3409 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529820.547:95): avc: denied { sys_tty_config } for pid=3411 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529822.767:96): avc: denied { sys_tty_config } for pid=3413 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529822.842:97): avc: denied { sys_tty_config } for pid=3415 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529822.960:98): avc: denied { sys_tty_config } for pid=3417 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529823.033:99): avc: denied { sys_tty_config } for pid=3419 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability __ratelimit: 12 callbacks suppressed type=1400 audit(1220529825.678:104): avc: denied { sys_tty_config } for pid=3429 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529825.724:105): avc: denied { sys_tty_config } for pid=3431 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529825.856:106): avc: denied { sys_tty_config } for pid=3433 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529825.897:107): avc: denied { sys_tty_config } for pid=3435 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529826.000:108): avc: denied { sys_tty_config } for pid=3437 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529826.041:109): avc: denied { sys_tty_config } for pid=3439 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529826.231:110): avc: denied { sys_tty_config } for pid=3441 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529826.271:111): avc: denied { sys_tty_config } for pid=3443 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529826.437:112): avc: denied { sys_tty_config } for pid=3445 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529826.478:113): avc: denied { sys_tty_config } for pid=3447 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529835.583:114): avc: denied { sys_tty_config } for pid=3451 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529835.634:115): avc: denied { sys_tty_config } for pid=3453 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529835.820:116): avc: denied { sys_tty_config } for pid=3455 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529835.861:117): avc: denied { sys_tty_config } for pid=3457 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529838.320:118): avc: denied { sys_tty_config } for pid=3459 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529838.360:119): avc: denied { sys_tty_config } for pid=3461 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529838.516:120): avc: denied { sys_tty_config } for pid=3463 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529838.561:121): avc: denied { sys_tty_config } for pid=3465 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529839.201:122): avc: denied { sys_tty_config } for pid=3467 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529839.242:123): avc: denied { sys_tty_config } for pid=3469 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529841.192:124): avc: denied { sys_tty_config } for pid=3471 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529841.321:125): avc: denied { sys_tty_config } for pid=3473 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529841.520:126): avc: denied { sys_tty_config } for pid=3476 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529841.637:127): avc: denied { sys_tty_config } for pid=3478 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529841.822:128): avc: denied { sys_tty_config } for pid=3480 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529841.862:129): avc: denied { sys_tty_config } for pid=3482 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529842.166:130): avc: denied { sys_tty_config } for pid=3484 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529842.210:131): avc: denied { sys_tty_config } for pid=3486 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529844.442:132): avc: denied { sys_tty_config } for pid=3488 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529844.506:133): avc: denied { sys_tty_config } for pid=3490 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability __ratelimit: 24 callbacks suppressed type=1400 audit(1220529848.095:142): avc: denied { sys_tty_config } for pid=3508 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529848.185:143): avc: denied { sys_tty_config } for pid=3510 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529848.859:144): avc: denied { sys_tty_config } for pid=3520 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529848.898:145): avc: denied { sys_tty_config } for pid=3522 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529849.137:146): avc: denied { sys_tty_config } for pid=3524 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529849.177:147): avc: denied { sys_tty_config } for pid=3526 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529852.584:148): avc: denied { sys_tty_config } for pid=3528 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529852.634:149): avc: denied { sys_tty_config } for pid=3530 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529852.754:150): avc: denied { sys_tty_config } for pid=3532 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529852.821:151): avc: denied { sys_tty_config } for pid=3534 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability __ratelimit: 6 callbacks suppressed type=1400 audit(1220529853.255:154): avc: denied { sys_tty_config } for pid=3540 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529853.299:155): avc: denied { sys_tty_config } for pid=3542 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529881.330:156): avc: denied { sys_tty_config } for pid=3545 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529881.399:157): avc: denied { sys_tty_config } for pid=3547 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529881.503:158): avc: denied { sys_tty_config } for pid=3549 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529881.544:159): avc: denied { sys_tty_config } for pid=3551 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529883.136:160): avc: denied { sys_tty_config } for pid=3561 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529883.175:161): avc: denied { sys_tty_config } for pid=3563 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529883.488:162): avc: denied { sys_tty_config } for pid=3565 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529883.527:163): avc: denied { sys_tty_config } for pid=3567 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529886.317:164): avc: denied { sys_tty_config } for pid=3569 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529886.358:165): avc: denied { sys_tty_config } for pid=3571 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529886.488:166): avc: denied { sys_tty_config } for pid=3573 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529886.526:167): avc: denied { sys_tty_config } for pid=3575 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529886.608:168): avc: denied { sys_tty_config } for pid=3577 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529886.648:169): avc: denied { sys_tty_config } for pid=3579 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529886.941:170): avc: denied { sys_tty_config } for pid=3581 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529886.980:171): avc: denied { sys_tty_config } for pid=3583 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529889.535:172): avc: denied { sys_tty_config } for pid=3585 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529889.595:173): avc: denied { sys_tty_config } for pid=3587 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529889.722:174): avc: denied { sys_tty_config } for pid=3589 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529889.769:175): avc: denied { sys_tty_config } for pid=3591 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability __ratelimit: 18 callbacks suppressed type=1400 audit(1220529892.600:182): avc: denied { sys_tty_config } for pid=3605 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529892.639:183): avc: denied { sys_tty_config } for pid=3607 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529892.801:184): avc: denied { sys_tty_config } for pid=3609 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529892.841:185): avc: denied { sys_tty_config } for pid=3611 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529893.125:186): avc: denied { sys_tty_config } for pid=3613 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529893.165:187): avc: denied { sys_tty_config } for pid=3615 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529895.584:188): avc: denied { sys_tty_config } for pid=3618 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529895.658:189): avc: denied { sys_tty_config } for pid=3620 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529895.814:190): avc: denied { sys_tty_config } for pid=3622 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529895.853:191): avc: denied { sys_tty_config } for pid=3624 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability __ratelimit: 6 callbacks suppressed type=1400 audit(1220529898.643:194): avc: denied { sys_tty_config } for pid=3630 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529898.686:195): avc: denied { sys_tty_config } for pid=3632 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529898.852:196): avc: denied { sys_tty_config } for pid=3634 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529898.892:197): avc: denied { sys_tty_config } for pid=3636 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529899.200:198): avc: denied { sys_tty_config } for pid=3638 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529899.242:199): avc: denied { sys_tty_config } for pid=3640 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529901.667:200): avc: denied { sys_tty_config } for pid=3642 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529901.756:201): avc: denied { sys_tty_config } for pid=3644 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529901.876:202): avc: denied { sys_tty_config } for pid=3646 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529901.926:203): avc: denied { sys_tty_config } for pid=3648 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability __ratelimit: 18 callbacks suppressed type=1400 audit(1220529904.636:210): avc: denied { sys_tty_config } for pid=3663 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529904.690:211): avc: denied { sys_tty_config } for pid=3665 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529904.850:212): avc: denied { sys_tty_config } for pid=3667 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529904.891:213): avc: denied { sys_tty_config } for pid=3669 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529907.399:214): avc: denied { sys_tty_config } for pid=3671 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529907.498:215): avc: denied { sys_tty_config } for pid=3673 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529907.794:216): avc: denied { sys_tty_config } for pid=3675 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529907.834:217): avc: denied { sys_tty_config } for pid=3677 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529908.700:218): avc: denied { sys_tty_config } for pid=3679 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529908.740:219): avc: denied { sys_tty_config } for pid=3681 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529913.685:220): avc: denied { sys_tty_config } for pid=3684 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529913.742:221): avc: denied { sys_tty_config } for pid=3686 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529913.879:222): avc: denied { sys_tty_config } for pid=3688 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529913.949:223): avc: denied { sys_tty_config } for pid=3690 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529914.276:224): avc: denied { sys_tty_config } for pid=3692 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529914.320:225): avc: denied { sys_tty_config } for pid=3694 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529914.738:226): avc: denied { sys_tty_config } for pid=3696 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529914.896:227): avc: denied { sys_tty_config } for pid=3698 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529935.547:228): avc: denied { sys_tty_config } for pid=3702 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529935.589:229): avc: denied { sys_tty_config } for pid=3704 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529936.070:230): avc: denied { sys_tty_config } for pid=3706 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529936.112:231): avc: denied { sys_tty_config } for pid=3708 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529939.916:232): avc: denied { sys_tty_config } for pid=3710 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529939.978:233): avc: denied { sys_tty_config } for pid=3712 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529940.548:234): avc: denied { sys_tty_config } for pid=3714 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220529940.610:235): avc: denied { sys_tty_config } for pid=3716 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220530068.807:236): avc: denied { sys_tty_config } for pid=3736 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability type=1400 audit(1220530068.856:237): avc: denied { sys_tty_config } for pid=3739 comm="pulseaudio" capability=26 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=capability (TIA) Thanks in Advance, Antonio

2 2

changing categories with "semanage translation -m"
by Murray McAllister 04 Sep '08

04 Sep '08

Hi, I added the following two translations using "semanage translation -a -T [name] level": s0:c1 NotSecret s0:c1.c2 Secret If I want to change the categories, say to have Secret as s0:c3, or only so:c2, can I use semanage? I tried "semanage translation -m -T Secret s0:c2": /usr/sbin/semanage: s0:c2 not defined in translations If I use "-a" instead of "-m", it adds another translation. Is the recommended way of changing categories adding a new one, and then 'semanage login -m -r s0:xy user', for any users using the old range? Cheers. I am using: * Fedora release 9 (Sulphur) * kernel-2.6.25.14-108.fc9.i686 * kernel-headers-2.6.25.14-108.fc9.i386 * policycoreutils-2.0.52-5.fc9.i386 * mcstrans-0.2.11-1.fc9.i386 * selinux-policy-targeted-3.3.1-84.fc9.noarch * selinux-policy-3.3.1-84.fc9.noarch * selinux-policy-devel-3.3.1-84.fc9.noarch * libselinux-python-2.0.67-4.fc9.i386 * libselinux-2.0.67-4.fc9.i386 $ sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 22 Policy from config file: targeted

2 1

error when adding a translation with "semanage translation -a"
by Murray McAllister 04 Sep '08

04 Sep '08

Hi, This is probably user error. I want to add a translation: 1. sudo cat /etc/selinux/targeted/setrans.conf s0= s0-s0:c0.c1023=SystemLow-SystemHigh s0:c0.c1023=SystemHigh 2. $ sudo semanage translation -l Level Translation s0 s0-s0:c0.c1023 SystemLow-SystemHigh s0:c0.c1023 SystemHigh 3. Attempt to add a new translation: $ sudo semanage translation -a -T NotSecret s0:c1 /etc/init.d/functions: line 19: /sbin/consoletype: Permission denied basename: write error: Permission denied basename: write error: Permission denied env: /etc/init.d/mcstrans: Permission denied 4. Translation appears to have been added: sudo semanage translation -l Level Translation s0 s0-s0:c0.c1023 SystemLow-SystemHigh s0:c0.c1023 SystemHigh s0:c1 NotSecret sudo cat /etc/selinux/targeted/setrans.conf s0= s0-s0:c0.c1023=SystemLow-SystemHigh s0:c0.c1023=SystemHigh s0:c1=NotSecret The following is logged to /var/log/messages: Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing service (semanage_t) "execute" to ./consoletype (consoletype_exec_t). For complete SELinux messages. run sealert -l 3a9da9b1-9310-492b-a4fd-3706d8d78259 Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing service (semanage_t) "execute" to ./consoletype (consoletype_exec_t). For complete SELinux messages. run sealert -l 3a9da9b1-9310-492b-a4fd-3706d8d78259 Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing service (semanage_t) "read" to pipe (semanage_t). For complete SELinux messages. run sealert -l 154967ff-45a0-4b8f-bf04-25546f129dd3 Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing service (semanage_t) "read" to pipe (semanage_t). For complete SELinux messages. run sealert -l 154967ff-45a0-4b8f-bf04-25546f129dd3 Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing basename (semanage_t) "getattr" to pipe (semanage_t). For complete SELinux messages. run sealert -l 641f7545-c40c-4d79-84c7-97e2b32d8c0a Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing basename (semanage_t) "write" to pipe (semanage_t). For complete SELinux messages. run sealert -l 2ab7598a-b0f7-4dec-a10d-cb4cfac057ee Aug 31 20:57:01 localhost setroubleshoot: SELinux is preventing basename (semanage_t) "getattr" to pipe (semanage_t). For complete SELinux messages. run sealert -l 641f7545-c40c-4d79-84c7-97e2b32d8c0a Aug 31 20:57:01 localhost setroubleshoot: SELinux is preventing basename (semanage_t) "write" to pipe (semanage_t). For complete SELinux messages. run sealert -l 2ab7598a-b0f7-4dec-a10d-cb4cfac057ee Aug 31 20:57:01 localhost setroubleshoot: SELinux is preventing service (semanage_t) "read" to pipe (semanage_t). For complete SELinux messages. run sealert -l 154967ff-45a0-4b8f-bf04-25546f129dd3 Aug 31 20:57:01 localhost setroubleshoot: SELinux is preventing env (semanage_t) "transition" to /etc/rc.d/init.d/mcstrans (semanage_t). For complete SELinux messages. run sealert -l ac0f934e-29dc-4702-a2f4-3a752150cb8f The following is logged to /var/log/audit/audit.log: type=AVC msg=audit(1220180220.598:367): avc: denied { execute } for pid=2118 comm="service" name="consoletype" dev=sda5 ino=73034 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tcontext=system_u:object_r:consoletype_exec_t:s0 tclass=file type=SYSCALL msg=audit(1220180220.598:367): arch=40000003 syscall=11 success=no exit=-13 a0=8d4c760 a1=8d4c7a8 a2=8d4c3b8 a3=0 items=0 ppid=2117 pid=2118 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="service" exe="/bin/bash" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1220180220.599:368): avc: denied { execute } for pid=2118 comm="service" name="consoletype" dev=sda5 ino=73034 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tcontext=system_u:object_r:consoletype_exec_t:s0 tclass=file type=SYSCALL msg=audit(1220180220.599:368): arch=40000003 syscall=33 success=no exit=-13 a0=8d4c760 a1=1 a2=11 a3=8d4c760 items=0 ppid=2117 pid=2118 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="service" exe="/bin/bash" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1220180220.637:369): avc: denied { read } for pid=2116 comm="service" path="pipe:[12134]" dev=pipefs ino=12134 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tclass=fifo_file type=SYSCALL msg=audit(1220180220.637:369): arch=40000003 syscall=3 success=no exit=-13 a0=3 a1=bfb075c8 a2=80 a3=80 items=0 ppid=2115 pid=2116 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="service" exe="/bin/bash" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1220180220.679:370): avc: denied { read } for pid=2116 comm="service" path="pipe:[12135]" dev=pipefs ino=12135 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tclass=fifo_file type=SYSCALL msg=audit(1220180220.679:370): arch=40000003 syscall=3 success=no exit=-13 a0=3 a1=bfb079c8 a2=80 a3=80 items=0 ppid=2115 pid=2116 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="service" exe="/bin/bash" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1220180220.694:371): avc: denied { getattr } for pid=2119 comm="basename" path="pipe:[12135]" dev=pipefs ino=12135 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tclass=fifo_file type=SYSCALL msg=audit(1220180220.694:371): arch=40000003 syscall=197 success=no exit=-13 a0=1 a1=bfd3e414 a2=960ff4 a3=9614c0 items=0 ppid=2116 pid=2119 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="basename" exe="/bin/basename" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1220180220.708:372): avc: denied { write } for pid=2119 comm="basename" path="pipe:[12135]" dev=pipefs ino=12135 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tclass=fifo_file type=SYSCALL msg=audit(1220180220.708:372): arch=40000003 syscall=4 success=no exit=-13 a0=1 a1=b7f3d000 a2=8 a3=8 items=0 ppid=2116 pid=2119 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="basename" exe="/bin/basename" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1220180220.727:373): avc: denied { getattr } for pid=2120 comm="basename" path="pipe:[12136]" dev=pipefs ino=12136 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tclass=fifo_file type=SYSCALL msg=audit(1220180220.727:373): arch=40000003 syscall=197 success=no exit=-13 a0=1 a1=bffb9684 a2=960ff4 a3=9614c0 items=0 ppid=2116 pid=2120 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="basename" exe="/bin/basename" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1220180220.728:374): avc: denied { write } for pid=2120 comm="basename" path="pipe:[12136]" dev=pipefs ino=12136 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tclass=fifo_file type=SYSCALL msg=audit(1220180220.728:374): arch=40000003 syscall=4 success=no exit=-13 a0=1 a1=b80b8000 a2=8 a3=8 items=0 ppid=2116 pid=2120 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="basename" exe="/bin/basename" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1220180220.749:375): avc: denied { read } for pid=2116 comm="service" path="pipe:[12136]" dev=pipefs ino=12136 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tclass=fifo_file type=SYSCALL msg=audit(1220180220.749:375): arch=40000003 syscall=3 success=no exit=-13 a0=3 a1=bfb079c8 a2=80 a3=80 items=0 ppid=2115 pid=2116 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="service" exe="/bin/bash" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1220180220.760:376): avc: denied { transition } for pid=2121 comm="env" path="/etc/rc.d/init.d/mcstrans" dev=sda5 ino=222868 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:semanage_t:s0 tclass=process type=SYSCALL msg=audit(1220180220.760:376): arch=40000003 syscall=11 success=no exit=-13 a0=bfd449ce a1=bfd435b8 a2=9922858 a3=5 items=0 ppid=2116 pid=2121 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="env" exe="/bin/env" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null) The system: * Fedora release 9 (Sulphur) * kernel-2.6.25.14-108.fc9.i686 * kernel-headers-2.6.25.14-108.fc9.i386 * policycoreutils-2.0.52-5.fc9.i386 * mcstrans-0.2.11-1.fc9.i386 * selinux-policy-targeted-3.3.1-84.fc9.noarch * selinux-policy-3.3.1-84.fc9.noarch * selinux-policy-devel-3.3.1-84.fc9.noarch * libselinux-python-2.0.67-4.fc9.i386 * libselinux-2.0.67-4.fc9.i386 $ sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 22 Policy from config file: targeted ps -eZ | grep mcs system_u:system_r:setrans_t:SystemLow-SystemHigh 1262 ? 00:00:00 mcstransd Regards, Murray.

2 1

MLS enforcing and kerberos
by Robert Story 04 Sep '08

04 Sep '08

I'm trying to switch a working kerberos server from targeted/enforcing to mls/enforcing. The krb5kdc daemon start fine, but kadmin does not. There is a single avc in the audit log: type=AVC msg=audit(1219421464.372:719): avc: denied { getattr } for pid=2436 comm="kadmind" path="/var/tmp/kadmin_0" dev=dm-5 ino=82064 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s15:c0.c1023 tclass=file I ran this through audit2allow and loaded the module, with no luck. I ran 'semodule -DB' to see what else was being hit and not audited, and get quite a few more: type=AVC msg=audit(1219421462.655:714): avc: denied { siginh } for pid=2436 comm="kadmind" scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tclass=process type=AVC msg=audit(1219421462.655:714): avc: denied { rlimitinh } for pid=2436 comm="kadmind" scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tclass=process type=AVC msg=audit(1219421462.655:714): avc: denied { noatsecure } for pid=2436 comm="kadmind" scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tclass=process type=SYSCALL msg=audit(1219421462.655:714): arch=14 syscall=11 success=yes exit=0 a0=100f1600 a1=100f13b0 a2=100f03d8 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null) type=AVC msg=audit(1219421462.668:715): avc: denied { read } for pid=2436 comm="kadmind" name="config" dev=dm-5 ino=57734 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:selinux_config_t:s0 tclass=file type=SYSCALL msg=audit(1219421462.668:715): arch=14 syscall=5 success=no exit=-13 a0=1fcdc380 a1=10000 a2=1b6 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null) type=AVC msg=audit(1219421462.670:716): avc: denied { write } for pid=2436 comm="kadmind" name="kdc.conf" dev=dm-5 ino=82034 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:krb5kdc_conf_t:s0 tclass=file type=SYSCALL msg=audit(1219421462.670:716): arch=14 syscall=33 success=no exit=-13 a0=20020c30 a1=2 a2=1b6 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null) type=AVC msg=audit(1219421462.671:717): avc: denied { write } for pid=2436 comm="kadmind" name="krb5.conf" dev=dm-5 ino=378227 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:krb5_conf_t:s0 tclass=file type=SYSCALL msg=audit(1219421462.671:717): arch=14 syscall=33 success=no exit=-13 a0=20020d20 a1=2 a2=1b6 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null) type=AVC msg=audit(1219421464.369:718): avc: denied { name_bind } for pid=2436 comm="kadmind" src=916 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:hi_reserved_port_t:s0 tclass=tcp_socket type=SYSCALL msg=audit(1219421464.369:718): arch=14 syscall=102 success=no exit=-13 a0=2 a1=bfb6c484 a2=10 a3=bfb6c5dc items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null) type=AVC msg=audit(1219421464.372:719): avc: denied { getattr } for pid=2436 comm="kadmind" path="/var/tmp/kadmin_0" dev=dm-5 ino=82064 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s15:c0.c1023 tclass=file type=SYSCALL msg=audit(1219421464.372:719): arch=14 syscall=195 success=no exit=-13 a0=203136c0 a1=bfb6c120 a2=bfb6c120 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null) type=AVC msg=audit(1219421464.405:720): avc: denied { getattr } for pid=2436 comm="kadmind" path="/var/tmp/kadmin_0" dev=dm-5 ino=82064 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s15:c0.c1023 tclass=file type=SYSCALL msg=audit(1219421464.405:720): arch=14 syscall=195 success=no exit=-13 a0=20409ad8 a1=bfb6c120 a2=bfb6c120 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null) running this through audit2allow and loading the module doesn't help either... What can I try next? -- Robert Story SPARTA

3 4

many avcs at startup, readahead and several others
by Antonio Olivares 03 Sep '08

03 Sep '08

Dear fellow selinux troubleshooters and testers, Using rawhide, I have seen several avcs at startup namely readahead and others, while I found out that the sound problem is due to selinux getting in the way of pulse. Here's a few avcs. Advise and/or workarounds appreciated, setroubleshoot has not kicked in, these are from dmesg | grep 'avcs' [root@localhost ~]# dmesg | grep 'avc' type=1400 audit(1220390408.063:4): avc: denied { read write } for pid=611 comm="readahead" path="/dev/console" dev=tmpfs ino=408 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=chr_file type=1400 audit(1220390408.064:5): avc: denied { read write } for pid=611 comm="readahead" path="/dev/console" dev=tmpfs ino=408 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=chr_file type=1400 audit(1220390408.064:6): avc: denied { read write } for pid=611 comm="readahead" path="/dev/console" dev=tmpfs ino=408 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=chr_file type=1400 audit(1220390408.788:7): avc: denied { fowner } for pid=611 comm="readahead" capability=3 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:readahead_t:s0 tclass=capability type=1400 audit(1220390408.837:8): avc: denied { fowner } for pid=611 comm="readahead" capability=3 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:readahead_t:s0 tclass=capability type=1400 audit(1220390408.838:9): avc: denied { fowner } for pid=611 comm="readahead" capability=3 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:readahead_t:s0 tclass=capability type=1400 audit(1220390409.131:10): avc: denied { fowner } for pid=611 comm="readahead" capability=3 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:readahead_t:s0 tclass=capability type=1400 audit(1220390433.392:11): avc: denied { write } for pid=1457 comm="ip6tables-resto" path="/0" dev=devpts ino=2 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=chr_file type=1400 audit(1220390434.665:12): avc: denied { write } for pid=1679 comm="ip" path="/0" dev=devpts ino=2 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=chr_file type=1400 audit(1220390483.087:13): avc: denied { search } for pid=1941 comm="pcscd" name="dbus" dev=dm-0 ino=3276848 scontext=system_u:system_r:pcscd_t:s0 tcontext=system_u:object_r:system_dbusd_var_run_t:s0 tclass=dir type=1400 audit(1220390498.350:14): avc: denied { execute } for pid=2393 comm="gdm" name="rpm" dev=dm-0 ino=24117303 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_exec_t:s0 tclass=file type=1400 audit(1220390498.351:15): avc: denied { getattr } for pid=2393 comm="gdm" path="/bin/rpm" dev=dm-0 ino=24117303 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_exec_t:s0 tclass=file type=1400 audit(1220390498.351:16): avc: denied { getattr } for pid=2393 comm="gdm" path="/bin/rpm" dev=dm-0 ino=24117303 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_exec_t:s0 tclass=file type=1400 audit(1220391361.963:17): avc: denied { setattr } for pid=3251 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220391361.965:18): avc: denied { setattr } for pid=3251 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220391361.965:19): avc: denied { setattr } for pid=3251 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220391361.966:20): avc: denied { setattr } for pid=3251 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220391361.966:21): avc: denied { write } for pid=3251 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220391480.205:22): avc: denied { setattr } for pid=3267 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220391480.206:23): avc: denied { setattr } for pid=3267 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220391480.206:24): avc: denied { setattr } for pid=3267 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220391480.206:25): avc: denied { setattr } for pid=3267 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220391480.206:26): avc: denied { write } for pid=3267 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396664.211:27): avc: denied { setattr } for pid=3639 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396664.211:28): avc: denied { setattr } for pid=3639 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396664.212:29): avc: denied { setattr } for pid=3639 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396664.212:30): avc: denied { setattr } for pid=3639 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396664.212:31): avc: denied { write } for pid=3639 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396675.758:32): avc: denied { setattr } for pid=3655 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396675.759:33): avc: denied { setattr } for pid=3655 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396675.759:34): avc: denied { setattr } for pid=3655 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396675.760:35): avc: denied { setattr } for pid=3655 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396675.760:36): avc: denied { write } for pid=3655 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396688.315:37): avc: denied { setattr } for pid=3667 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396688.316:38): avc: denied { setattr } for pid=3667 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396688.317:39): avc: denied { setattr } for pid=3667 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396688.317:40): avc: denied { setattr } for pid=3667 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396688.318:41): avc: denied { write } for pid=3667 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396800.645:42): avc: denied { setattr } for pid=3788 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396800.645:43): avc: denied { setattr } for pid=3788 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396800.646:44): avc: denied { setattr } for pid=3788 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396800.646:45): avc: denied { setattr } for pid=3788 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396800.647:46): avc: denied { write } for pid=3788 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396814.195:47): avc: denied { setattr } for pid=3800 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396814.196:48): avc: denied { setattr } for pid=3800 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396814.196:49): avc: denied { setattr } for pid=3800 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396814.197:50): avc: denied { setattr } for pid=3800 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=1400 audit(1220396814.197:51): avc: denied { write } for pid=3800 comm="npviewer.bin" name=".pulse" dev=dm-0 ino=7176200 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir Thanks, Antonio

3 10

AVC Denial "services"
by Frank Murphy 03 Sep '08

03 Sep '08

su - root chcon -t bin_t './system-config-services-mechanism.py' chcon: cannot access `./system-config-services-mechanism.py': No such file or directory Summary: SELinux is preventing the dbus-daemon-lau (system_dbusd_t) from executing ./system-config-services-mechanism.py. Detailed Description: SELinux has denied the dbus-daemon-lau from executing ./system-config-services-mechanism.py. If dbus-daemon-lau is supposed to be able to execute ./system-config-services-mechanism.py, this could be a labeling problem. Most confined domains are allowed to execute files labeled bin_t. So you could change the labeling on this file to bin_t and retry the application. If this dbus-daemon-lau is not supposed to execute ./system-config-services-mechanism.py, this could signal a intrusion attempt. Allowing Access: If you want to allow dbus-daemon-lau to execute ./system-config-services-mechanism.py: chcon -t bin_t './system-config-services-mechanism.py' If this fix works, please update the file context on disk, with the following command: semanage fcontext -a -t bin_t './system-config-services-mechanism.py' Please specify the full path to the executable, Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this selinux-policy to make sure this becomes the default labeling. Additional Information: Source Context system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 Target Context system_u:object_r:usr_t:s0 Target Objects ./system-config-services-mechanism.py [ file ] Source dbus-daemon-lau Source Path /lib/dbus-1/dbus-daemon-launch-helper Port <Unknown> Host rawhide-02 Source RPM Packages dbus-1.2.3-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.1-4.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name execute Host Name rawhide-02 Platform Linux rawhide-02 2.6.27-0.238.rc2.fc10.i686 #1 SMP Thu Aug 7 08:00:04 EDT 2008 i686 i686 Alert Count 1 First Seen Sat 30 Aug 2008 08:22:57 IST Last Seen Sat 30 Aug 2008 08:22:57 IST Local ID ffddfd97-63b1-4809-aee4-c10e29d86722 Line Numbers Raw Audit Messages host=rawhide-02 type=AVC msg=audit(1220080977.294:17): avc: denied { execute } for pid=3564 comm="dbus-daemon-lau" name="system-config-services-mechanism.py" dev=dm-0 ino=2605067 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=file host=rawhide-02 type=SYSCALL msg=audit(1220080977.294:17): arch=40000003 syscall=11 success=no exit=-13 a0=9774018 a1=9773d60 a2=9773008 a3=b8d9bc items=0 ppid=3563 pid=3564 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dbus-daemon-lau" exe="/lib/dbus-1/dbus-daemon-launch-helper" subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)

2 1

AVC denials when using RH Cluster Suite's qdiskd and ping heuristic
by Sean E. Millichamp 03 Sep '08

03 Sep '08

I have been experimenting with using a quorum disk with the RH cluster suite product (qdiskd in the cman RPM). One of the requirements of using qdiskd is that you must specify at least one command that can be run to test the health of the node. A typical command to use for this heuristic is ping, although any command that returns a 0/non-0 exit status is acceptable. When I configure a simple ping test with qdisk I get: type=AVC msg=audit(1219960233.627:4561): avc: denied { read write } for pid=23174 comm="ping" path="/dev/sda4" dev=tmpfs ino=1051 scontext=root:system_r:ping_t:s0 tcontext=system_u:object_ r:fixed_disk_device_t:s0 tclass=blk_file type=AVC msg=audit(1219960233.627:4561): avc: denied { read write } for pid=23174 comm="ping" path="/dev/sdb4" dev=tmpfs ino=985 scontext=root:system_r:ping_t:s0 tcontext=system_u:object_r :fixed_disk_device_t:s0 tclass=blk_file type=SYSCALL msg=audit(1219960233.627:4561): arch=c000003e syscall=59 success=yes exit=0 a0=1f3575a0 a1=1f357610 a2=1f356150 a3=3 items=0 ppid=23163 pid=23174 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=189 comm="ping" exe="/bin/ping" subj=root:system_r:ping_t:s0 key=(null) The test is: "/bin/ping -c1 -t1 x.x.x.x" where x.x.x.x is a known-reachable IP. This works without AVC denials from the command line. Interestingly, the ping command seems to complete and return an exit code properly to qdisk as the log message shows that it is up. I have used audit2allow which told me I could do: allow ping_t fixed_disk_device_t:blk_file { read write }; and silence the message, but somehow giving ping access to fixed_disk_device_t to quiet a log message seems like it defeats the spirit of limited access :) I have no idea why ping (I am assuming that I am reading it correctly and it is ping) would be trying to access /dev/sda4 or /dev/sdb4. Those partitions are the extended partition container on my software RAID-1 boot drives. I've poked briefly at the qdiskd code and it seems to do a normal fork/exec to invoke the ping. Has anyone seen anything like this or have any ideas on where I should look next? I've spent a while on it so far and I don't have a lot more time to spend on it, but I'd like to solve it if possible and (if needed) get a fix out somewhere. I have been doing my testing with the RHEL versions of these tools as I don't have a cluster of Fedora machines handy, but I couldn't find a RHEL SELinux list and this looked like the best bet. selinux-policy-targeted-2.4.6-137.1.el5 cman-2.0.84-2.el5 I'm still pretty new to trying to sift through SELinux policy/messages so please be patient with me. :) Thanks! Sean

2 3

Bootable copy of an FC9 system.
by Nickolas Gray 03 Sep '08

03 Sep '08

I am attempting to create a bootable copy of a running SELinux box on FC9. I think I am close but I am coming up with a kernel panic (text at end) Here are the steps and a brief reason. If anyone has any suggestions where I might have made a mistake or left something out a comment would be appreciated. The only requirement so far is that it has to be a disk to disk copy with no CD/DVD rescue involved. The original looks like mbr on boot sector /dev/sda1 ext3 /boot /dev/sda2 LVM VolGroup00/LogVol00 is root VolGroup00/LogVol01 is swap This is what I am doing. • This seemed like an efficient way to dup the filesystems of the source to the target. sfdisk -d /dev/sda | sfdisk /dev/sdb •Duplicate the MBR dd if=/dev/sda1 of=/dev/sdb1 bs=512k •Copy the entire /boot from a to b dd if=/dev/sda of=/dev/sdb bs=664 count=1 •Add the /dev/sdb2 to LVM pvcreate /dev/sdb2 create the VolGroup for / vgcreate -s 32m VolGroup01 /dev/sdb2 Create the logical volume for / and swap lvcreate -l 1562 -n LogVol00 VolGroup01 lvcreate -l 62 -n LogVol01 VolGroup01 Create the swap area mkswap /dev/VolGroup01/LogVol01 Format the / filesystem mkfs -t ext3 /dev/VolGroup01/LogVol00 Create the snapshot lvcreate -L 20g -s -n snap /dev/VolGroup00/LogVol00 Mount the snapshot mount /dev/VolGroup00/snap /snapshot Mount the target mount /dev/VolGroup01/LogVol00 /target Rsync over the snapshot rsync -vXxpr /snapshot/* /target Unmount the snapshot umount /snapshot lvremove -f VolGroup00/snap At this point I fixed the initrd, the fstab and grub.conf on the target to point to VolGroup01 instead of VolGroup00. I would think this should be it. What I get is. root (hd0,0) Filesystem type is ..... kerne /vmlinuz ...... Linux bzimage..... initrd / initrd .... Linux initrd Decompresing Linux ... Done Booting the kernel Red Hat nash version 6,0,52 starting Reading all physical volumes this make take awhile .... Found volume group VolGroup01 now active ERROR: exec of init (/sbin/init) failed failed!!!! No such file or directory ERROR: failed in exec of /bin/echo: No such file or directory a couple messages about not finding /bin/sleep Kernel Panic I am not really sure where this is getting to. I thought it was getting to the initrd but now I am not sure. Thanks Nick

2 1

policy rpm %post script encounters avc violations
by Johnson, Richard 03 Sep '08

03 Sep '08

When installing a policy rpm, one cannot log the install activity w/o generating avc errors. For example: rpm -i lsb-ft-asn-selinux > /var/log/rpm-update.log produces the following violation: type=SYSCALL msg=audit(1219774608.030:789): arch=c000003e syscall=59 success=yes exit=0 a0=be952e0 a1=be93390 a2=be958f0 a3=8 items=0 ppid=2848 pid=2875 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS1 ses=2 comm="restorecon" exe="/sbin/restorecon" subj=root:system_r:restorecon_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1219774608.030:789): avc: denied { write } for pid=2875 comm="restorecon" path="/var/log/rpm-update.log" dev=md2 ino=2694055 scontext=root:system_r:restorecon_t:s0-s0:c0.c1023 tcontext=root:object_r:var_log_t:s0 tclass=file The problems seems to stem from recording the %post script's attempts to relabel files affected by the policy, specifically: /sbin/restorecon -F -R -v /opt/ft/sbin/sra_alarm; /sbin/restorecon -F -R -v /etc/opt/ft/asn; /sbin/restorecon -F -R -v /var/opt/ft/asn; /sbin/restorecon -F -R -v /var/opt/ft/log; Is there any way to preserve the logging w/o disabling selinux for the duration of the install? FWIW, the rpm commands are executed from a bash script.

3 3

selinux and readahead
by Antonio Olivares 03 Sep '08

03 Sep '08

Dear all, I have encountered the following setroubleshoot warning: Summary: SELinux is preventing readahead (readahead_t) "read" to inotify (inotifyfs_t). Detailed Description: SELinux denied access requested by readahead. It is not expected that this access is required by readahead and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for inotify, restorecon -v 'inotify' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:readahead_t:SystemLow-SystemHigh Target Context system_u:object_r:inotifyfs_t Target Objects inotify [ dir ] Source readahead Source Path /usr/sbin/readahead Port <Unknown> Host localhost.localdomain Source RPM Packages readahead-1.4.4-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.1-4.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27-0.244.rc2.git1.fc10.i686 #1 SMP Fri Aug 8 13:26:20 EDT 2008 i686 i686 Alert Count 2 First Seen Thu 21 Aug 2008 04:04:26 AM CDT Last Seen Thu 21 Aug 2008 04:04:28 AM CDT Local ID c67dc8d2-0096-4510-9075-cbea7074ffa2 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1219309468.106:155): avc: denied { read } for pid=7574 comm="readahead" path="inotify" dev=inotifyfs ino=1 scontext=system_u:system_r:readahead_t:s0-s0:c0.c1023 tcontext=system_u:object_r:inotifyfs_t:s0 tclass=dir host=localhost.localdomain type=SYSCALL msg=audit(1219309468.106:155): arch=40000003 syscall=11 success=yes exit=0 a0=9f292d0 a1=9f29368 a2=9f295c0 a3=0 items=0 ppid=7564 pid=7574 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=24 comm="readahead" exe="/usr/sbin/readahead" subj=system_u:system_r:readahead_t:s0-s0:c0.c1023 key=(null) I do not know if readahead should be denied or not? What do you recommend that I do? Regards, Antonio

2 1

Samba Policy - Type Enforcement File
by prakash hallalli 03 Sep '08

03 Sep '08

Hi All I have installed selinux on fedora 8, I was using targeted policy which is the default policy in fedora. I have searched the policy module file ( File Context (FC) Type Enforcement (TE) and an Interface file (IF) ) Because i have configured samba server, so i need to change some permissions in samba.te file, but i couldn't find these file. Please help me where can i get these file and which package i have to install. Thanks praksh,h,k

3 2

AVCs generated by oom actions....
by Tom London 03 Sep '08

03 Sep '08

I'm having some out-of-memory issues with latest kernels: https://bugzilla.redhat.com/show_bug.cgi?id=460848 I've noticed that when this happens, I get audit and AVC spew. Appears that I get 'sys_rawio', 'sys_admin', and 'sys_resource' AVCs for processes that are about to commit suicide. I have no idea what is causing these, and whether these are bugs (or features ;)). Any ideas/wisdom welcome! tom [root@tlondon ~]# audit2allow -i oom-audit.txt #============= NetworkManager_t ============== allow NetworkManager_t self:capability { sys_rawio sys_admin sys_resource }; #============= audisp_t ============== allow audisp_t self:capability { sys_rawio sys_admin sys_resource }; #============= auditd_t ============== allow auditd_t self:capability { sys_rawio sys_admin }; #============= bluetooth_t ============== allow bluetooth_t self:capability { sys_rawio sys_admin sys_resource }; #============= consolekit_t ============== allow consolekit_t self:capability { sys_rawio sys_admin sys_resource }; #============= dhcpc_t ============== allow dhcpc_t self:capability { sys_rawio sys_admin }; #============= getty_t ============== allow getty_t self:capability sys_rawio; #============= kerneloops_t ============== allow kerneloops_t self:capability { sys_rawio sys_admin sys_resource }; #============= restorecond_t ============== allow restorecond_t self:capability { sys_rawio sys_admin sys_resource }; #============= rpcd_t ============== allow rpcd_t self:capability { sys_rawio sys_admin sys_resource }; #============= sendmail_t ============== allow sendmail_t self:capability { sys_rawio sys_admin sys_resource }; #============= setroubleshootd_t ============== allow setroubleshootd_t self:capability { sys_rawio sys_admin sys_resource }; #============= sshd_t ============== allow sshd_t self:capability { sys_rawio sys_admin }; #============= syslogd_t ============== allow syslogd_t self:capability sys_rawio; #============= unconfined_mono_t ============== allow unconfined_mono_t self:process execstack; #============= xdm_t ============== allow xdm_t self:capability sys_admin; [root@tlondon ~]# -- Tom London

3 3

Linux/Unix system admin looking for job
by foreverterran 01 Sep '08

01 Sep '08

Hello, ABOUT ME: EXPERIENCE SUMMARY: Operating Systems: . FreeBSD . RHEL . Suse, SLES 9/10 . CentOS . Fedora . Ubuntu . Debian . Microsoft Windows 98/xp/2000/2003/NT Software and Networking: . Apache HTTP/HTTPS servers (versions 1.3.x/2.x ) . Mail (Sendmail, Postfix, Amavisd-new, ClamAV, Spamassassin, Courier IMAP) . MySQL, PostgreSQL, Sybase (backup, maintenance, tuning, replication) . Monitoring (MRTG, Zabbix, Munin) . Samba, NFS . NTP, ntpdate . Firewall (iptables, ipfw, ipfilter, shorewall) . LDAP (OpenLDAP) . Backup (Rsnapshot, Amanda) . Virtualisation (Qemu, Vmware, Xen) . High Availability (Hearbeat, load balancing) . TCP/IP, UDP, ICMP, DHCP, SNMP, NAT, VPN . Perl, bash scripting Working experience: . Administrated and configured more then 50 linux/unix servers. . Managing of the mail service using Sendmail and Postfix (virtual domains, MySQL, Antispam, Antivirus, SMTP authentication SASL). More then 5000 mailusers. . Managing, using Postfix and LDAP (Antispam, Antivirus, OpenLDAP, SMTP authentication SASL). More the 10 000 mailusers. . Tuning, maintained huge MySQL databases. . Apache (1.3.x / 2.x) tuning. Strong security experience . Implemented Rsnapshot, Amanda backup system. . Central monitoring system (Zabbix). . Software/hardware testing. . High Availability servers setup using Hearbeat. . Load balancing. WORK HISTORY: February 2002 - July 2003 System administration of UNIX Internet servers. Setup and support mail server with Sendmail and Postfix MTA (virtual domains, MySQL, Antispam, Antivirus, SMTP+Auth) more then 5000 mailusers, Apache, DNS(Bind), FTP, Samba. LAN/WAN security, VPN. Firewall tuning (shorewall, iptables). Juny 2003 - February 2005 Setup and support mail servers with Postfix MTA and LDAP (Spamassassin, ClamAV, OpenLDAP, SMTP auth). More the 10 000 mailusers. Huge MySQL database tuning, support. High raffic Apache web servers tuning. Network Security Auditing. Monitoring system (Munin). February 2005 - June 2006 Network management (packet analize, logs). Maintenance of security policies throughout the network. Design and implementation of a daily backup plan (rsnapshot). Sybase and PostgreSQL deployment/maintainence. Shell scripting (SED,AWK). June 2006 - August 2008 Responsible for network wide securit. Installed and maintained several load balancers. Wifi station and AP security. IBM Blade center virtualisation (Qemu, Vmware, Xen). Several DNS, LDAP, SMTP, SMTP-backup, POP3, Apache, High Availability (Hearbeat) servers setup, maintenance. Central monitoring system (Zabbix). CERTIFICATE: 1. Novell Certified Linux Professional 10 2. Linux technical specialist EDUCATION: 1.Informatics Bachelor's degree. Telecommute! mail: foreverterran(a)gmail.com

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux September 2008