inode confusion?
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
After recent policy upgrade (selinux-policy-targeted-3.10.0-145.fc17.noarch)
I noticed some cron jobs are failing and generate selinux avc:
time->Fri Aug 24 04:02:05 2012
type=SYSCALL msg=audit(1345780925.499:656): arch=c000003e syscall=2 success=no exit=-13
a0=404a07 a1=0 a2=0 a3=0 items=0 ppid=21070 pid=21091 auid=0 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=85 comm="tmpwatch"
exe="/usr/sbin/tmpwatch" subj=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023
key=(null)
type=AVC msg=audit(1345780925.499:656): avc: denied { read } for pid=21091
comm="tmpwatch" name="root" dev="dm-1" ino=8194
scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023
tcontext=system_u:object_r:admin_home_t:s0 tclass=dir
tmpwatch definitely shouldn't be going to /root home, and I am pretty sure it
doesn't.
What's interesting though is this fact:
[root@fedora ~]# ls -ldi /root
8194 dr-xr-x---. 5 root root 4096 Aug 18 15:18 /root
[root@fedora ~]# ls -ldi /var/tmp
8194 drwxrwxrwt. 3 root root 4096 Aug 24 23:41 /var/tmp
both directories have the same inode number, which selinux is complaining about. Since
they are on different files system, it's normal:
[root@fedora ~]# df -h
Filesystem Size Used Avail Use% Mounted on
rootfs 4.0G 1.1G 2.7G 30% /
devtmpfs 223M 0 223M 0% /dev
tmpfs 244M 0 244M 0% /dev/shm
tmpfs 244M 380K 244M 1% /run
/dev/mapper/vgx-root 4.0G 1.1G 2.7G 30% /
tmpfs 244M 0 244M 0% /sys/fs/cgroup
tmpfs 244M 0 244M 0% /media
/dev/mapper/vgx-home 1008M 34M 923M 4% /home
/dev/mapper/vgx-tmp 504M 17M 462M 4% /tmp
/dev/mapper/vgx-var 1008M 303M 655M 32% /var
/dev/xvda1 504M 94M 386M 20% /boot
But it makes me wonder, if SELinux is confused somehow?
Regards,
Vadym
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.18 (Darwin)
Comment: GPGTools - http://gpgtools.org
iEYEARECAAYFAlA4F7kACgkQmYV3iqStpjvYYACfcSV/KBMl6lzYM7Y/iASwuQhg
gnEAn3aILGJEjV/Zckc0QY8UqCRpob5V
=fGNj
-----END PGP SIGNATURE-----