10:22 a.m.
Hello All
I triggered this issue with clamav/clamav-milter 0.95.2 from rpmforge running on a test
box with Centos 5.3
Clamd opens a socket /var/run/clamav/clamd.sock to accept requests to scan things.
ls -Z /var/run/clamav/clamd.sock
srwxrwxrwx clamav clamav root:object_r:clamd_var_run_t /var/run/clamav/clamd.sock
Requests are read using the system call recvmsg, this allows for the passing auxiliary
control data.
Clamav-milter 0.95.2 uses this to pass a handle to the temp file containing the data to be
scanned
With SeLinux set to targeted enforcing, this call reads and returns the normal data fine,
but returns with the
flag MSG_CTRUNC set.
according to the man page this is
"indicates that some control data were discarded due to lack of space in the buffer
for ancillary data."
clamd responded by closing the socket, clamav-milter responded to the closed socket by
looping a 100% CPU. :-(
Running the audit log through audit2allow suggests
grep clam /var/log/audit/audit.log | audit2allow -m local > local.te
[root@fallback0 selinux]# cat local.te
module local 1.0;
require {
type initrc_tmp_t;
type proc_t;
type sysctl_kernel_t;
type clamd_t;
class dir search;
class file { read write getattr };
}
#============= clamd_t ==============
allow clamd_t initrc_tmp_t:file { read write getattr };
allow clamd_t proc_t:file { read getattr };
allow clamd_t sysctl_kernel_t:dir search;
allow clamd_t sysctl_kernel_t:file read;
The allow clamd_t proc_t:file { read getattr }; looks to relate to reading /proc/meminfo
allow clamd_t sysctl_kernel_t:dir search;
allow clamd_t sysctl_kernel_t:file read;
Look to relate to these log entries
type=AVC msg=audit(1254139856.343:48724): avc: denied { search } for pid=14771
comm="clamd" name="kernel" dev=proc ino=-268435416
scontext=root:system_r:clamd_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0
tclass=dir
type=AVC msg=audit(1254139856.343:48724): avc: denied { read } for pid=14771
comm="clamd" name="ngroups_max" dev=proc ino=-268435368
scontext=root:system_r:clamd_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0
tclass=file
type=AVC msg=audit(1254149740.665:48885): avc: denied { search } for pid=1261
comm="clamd" name="kernel" dev=proc ino=-268435416
scontext=root:system_r:clamd_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0
tclass=dir
This if I have figured it out right relate to something that clamd is calling in turn
trying to read /proc/sys/kernel/ngroups_max
So by elimination
allow clamd_t initrc_tmp_t:file { read write getattr };
Must relate to the the use of auxiliary data with the socket, and the following log
entries but I do not see why.
Can anyone explain?
type=AVC msg=audit(1254150147.188:48924): avc: denied { read write } for pid=1288
comm="clamd"
path=2F746D702F636C616D61762D3063666237656532666331656139656636323364373463316236626532623735202864656C6574656429
dev=dm-0 ino=34668546 scontext=root:system_r:clamd_t:s0
tcontext=root:object_r:initrc_tmp_t:s0 tclass=file
type=AVC msg=audit(1254150153.681:48925): avc: denied { read write } for pid=1288
comm="clamd"
path=2F746D702F636C616D61762D3336316332323033323138613239633865363633633937303962663133363664202864656C6574656429
dev=dm-0 ino=34668546 scontext=root:system_r:clamd_t:s0
tcontext=root:object_r:initrc_tmp_t:s0 tclass=file
type=AVC msg=audit(1254150177.903:48926): avc: denied { read write } for pid=1288
comm="clamd"
path=2F746D702F636C616D61762D3366636162623138633237636231383466643064656630643838353063363933202864656C6574656429
dev=dm-0 ino=34668546 scontext=root:system_r:clamd_t:s0
tcontext=root:object_r:initrc_tmp_t:s0 tclass=file
type=AVC msg=audit(1254150188.366:48927): avc: denied { read write } for pid=1288
comm="clamd"
path=2F746D702F636C616D61762D6366393131623632353130333564353832656435396466663136373362626131202864656C6574656429
dev=dm-0 ino=34668546 scontext=root:system_r:clamd_t:s0
tcontext=root:object_r:initrc_tmp_t:s0 tclass=file
type=AVC msg=audit(1254150220.428:48928): avc: denied { read write } for pid=1288
comm="clamd"
path=2F746D702F636C616D61762D3931633534623761393630653531386630363539653033363537303937323135202864656C6574656429
dev=dm-0 ino=34668546 scontext=root:system_r:clamd_t:s0
tcontext=root:object_r:initrc_tmp_t:s0 tclass=file
Yours
J. David Rye
*************************************************************************
This e-mail is confidential and may be legally privileged. It is intended
solely for the use of the individual(s) to whom it is addressed. Any
content in this message is not necessarily a view or statement from Road
Tech Computer Systems Limited but is that of the individual sender. If
you are not the intended recipient, be advised that you have received
this e-mail in error and that any use, dissemination, forwarding,
printing, or copying of this e-mail is strictly prohibited. We use
reasonable endeavours to virus scan all e-mails leaving the company but
no warranty is given that this e-mail and any attachments are virus free.
You should undertake your own virus checking. The right to monitor e-mail
communications through our networks is reserved by us
Road Tech Computer Systems Ltd. Shenley Hall, Rectory Lane, Shenley,
Radlett, Hertfordshire, WD7 9AN. - VAT Registration No GB 449 3582 17
Registered in England No: 02017435, Registered Address: Charter Court,
Midland Road, Hemel Hempstead, Hertfordshire, HP2 5GE.
*************************************************************************