-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 09/16/2013 11:30 PM, David Highley wrote:
The avcs listed below seem to have been around for a long time. Is
pyzor
really trying to run rpm to install something?
type=SYSCALL msg=audit(1376212087.230:525): arch=c000003e syscall=4
success=no e xit=-13 a0=24121b0 a1=7fff9e82e820 a2=7fff9e82e820
a3=7f889c8a35d0 items=0 ppid=9709 pid=9710 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none)
comm="pyzor" exe="/usr/bin/python2.7"
subj=system_u:system_r:spamc_t:s0
key=(null) type=AVC msg=audit(1376212087.230:525): avc: denied { getattr
} for pid=9710 comm="pyzor" path="/usr/bin/rpm" dev="dm-1"
ino=691636
scontext=system_u:system_r:spamc_t:s0
tcontext=system_u:object_r:rpm_exec_t:s0 tclass=file type=SYSCALL
msg=audit(1376217670.157:605): arch=c000003e syscall=4 success=no exit=-13
a0=1b511b0 a1=7fffab9ca4a0 a2=7fffab9ca4a0 a3=7fafd093b5d0 items=0
ppid=10665 pid=12274 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="pyzor"
exe="/usr/bin/python2.7" subj=system_u:system_r:spamc_t:s0 key=(null)
type=AVC msg=audit(1376217670.157:605): avc: denied { getattr } for
pid=12274 comm="pyzor" path="/usr/bin/rpm" dev="dm-1"
ino=691636
scontext=system_u:system_r:spamc_t:s0
tcontext=system_u:object_r:rpm_exec_t:s0 tclass=file type=SYSCALL
msg=audit(1376218163.947:614): arch=c000003e syscall=4 success=no exit=-13
a0=1d191b0 a1=7fff04d2fd70 a2=7fff04d2fd70 a3=35101c15d0 items=0 ppid=24224
pid=24226 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 ses=4294967295 tty=(none) comm="pyzor"
exe="/usr/bin/python2.7"
subj=system_u:system_r:spamc_t:s0 key=(null) type=AVC
msg=audit(1376218163.947:614): avc: denied { getattr } for pid=24226
comm="pyzor" path="/usr/bin/rpm" dev="dm-1" ino=9914
scontext=system_u:system_r:spamc_t:s0
tcontext=system_u:object_r:rpm_exec_t:s0 tclass=file -- selinux mailing
list selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
Is spamc going to execute the rpm program? If so for what?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird -
http://www.enigmail.net/
iEYEARECAAYFAlI4Uc0ACgkQrlYvE4MpobPMVgCfTB5lmDETfEdCHfj5MINWl5sM
A/IAnihe/MhM9X+8W5lqSWYLHPaapYCU
=E5Yu
-----END PGP SIGNATURE-----