Re: Two AVCs
On 09/23/2009 12:00 PM, John Griffiths wrote:
Daniel J Walsh wrote:
> On 09/23/2009 07:47 AM, John Griffiths wrote:
>
>> I am using selinux-policy-targeted-3.5.13-71.fc10.noarch on Fedora 10. I am
>> getting these AVCs. They do not seem to inhibit functionality but still
>> troublesome to get the selinux alerts all the time. Are these bugs in the policy
>> or something that will not be addressed and I need to generate local policy?
>>
>> 1) SELinux is preventing postdrop (postfix_postdrop_t) "getattr"
httpd_t.
>>
>> Raw Audit Messages :
>>
>> node=elijah.suretrak21.net type=AVC msg=audit(1253716264.867:65886): avc:
>> denied { getattr } for pid=30094 comm="postdrop"
path="pipe:[2618550]"
>> dev=pipefs ino=2618550 scontext=system_u:system_r:postfix_postdrop_t:s0
>> tcontext=system_u:system_r:httpd_t:s0 tclass=fifo_file
>>
>> node=elijah.suretrak21.net type=SYSCALL msg=audit(1253716264.867:65886):
>> arch=40000003 syscall=197 success=no exit=-13 a0=2 a1=bfc167c8 a2=94eff4
>> a3=2 items=0 ppid=30093 pid=30094 auid=4294967295 uid=48 gid=48 euid=48
>> suid=48 fsuid=48 egid=90 sgid=90 fsgid=90 tty=(none) ses=4294967295
>> comm="postdrop" exe="/usr/sbin/postdrop"
>> subj=system_u:system_r:postfix_postdrop_t:s0 key=(null)
>>
> This seems a little strange, is postfix being executed from apache? I would guess
that postfix does not communicate with apache via fifo_file, so might be a leak.
>
This happens in conjunction with email being sent by Bugzilla which is of course
being served by apache.
Is mail being sent successfully? I believe this is also a
leaked file descriptor.
>> 2) SELinux is preventing sendmail (system_mail_t)
"read" to
>> /usr/share/GeoIP/GeoIP.dat (usr_t).
>>
>> Raw Audit Messages :
>>
>> node=elijah.suretrak21.net type=AVC msg=audit(1253643380.763:60806): avc:
>> denied { read } for pid=1311 comm="sendmail"
>> path="/usr/share/GeoIP/GeoIP.dat" dev=dm-0 ino=663651
>> scontext=system_u:system_r:system_mail_t:s0
>> tcontext=system_u:object_r:usr_t:s0 tclass=file
>>
>> node=elijah.suretrak21.net type=SYSCALL msg=audit(1253643380.763:60806):
>> arch=40000003 syscall=11 success=yes exit=0 a0=9ad05d0 a1=9acfd18
a2=9acfb08
>> a3=0 items=0 ppid=14784 pid=1311 auid=4294967295 uid=48 gid=48 euid=48
>> suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295
>> comm="sendmail" exe="/usr/sbin/sendmail.postfix"
>> subj=system_u:system_r:system_mail_t:s0 key=(null)
>>
>>
> This one looks like a leak unless something is actually trying to mail
/usr/share/GeoIP/GeoIP.dat
>
>
Apache has geoip_module configured, but that is the only place I have GeoIP
configured.
Well that GeoIP module is probably sending email or at least opening
that file before httpd_t sends mail for another module, revealing the leak. You can add
an allow rule using audit2allow, if this is probably not important data. Open a bugzilla
with geoip_module to not leak the file. If you are not using the geoip_module, remove it
from your apache config.
>> Regards,
>> John Griffiths
>>
>>
>> ------------------------------------------------------------------------
>>
>> --
>> fedora-selinux-list mailing list
>> fedora-selinux-list(a)redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>>
>
> You can add custom policy to allow these by executing audit2allow -M mypol
>