Re: AVC denials when using RH Cluster Suite's qdiskd and ping heuristic

[Sean E. Millichamp]

On Thu, 2008-08-28 at 18:05 -0400, Sean E. Millichamp wrote:

>  When I configure a simple ping test with qdisk I get:
>  
>  type=AVC msg=audit(1219960233.627:4561): avc:  denied  { read write } for  pid=23174
> comm="ping" path="/dev/sda4" dev=tmpfs ino=1051
> scontext=root:system_r:ping_t:s0 tcontext=system_u:object_
>  r:fixed_disk_device_t:s0 tclass=blk_file
>  
>  type=AVC msg=audit(1219960233.627:4561): avc:  denied  { read write } for  pid=23174
> comm="ping" path="/dev/sdb4" dev=tmpfs ino=985
> scontext=root:system_r:ping_t:s0 tcontext=system_u:object_r
>  :fixed_disk_device_t:s0 tclass=blk_file
>  
>  type=SYSCALL msg=audit(1219960233.627:4561): arch=c000003e syscall=59 success=yes exit=0
> a0=1f3575a0 a1=1f357610 a2=1f356150 a3=3 items=0 ppid=23163 pid=23174 auid=0 uid=0 gid=0
> euid=0 suid=0
>   fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=189 comm="ping"
> exe="/bin/ping" subj=root:system_r:ping_t:s0 key=(null) 
These messages are because qdiskd doesn't properly clean up its file
descriptors before forking and execing ping.  I will clean up my
findings and submit a patch/open a bug report against qdisk.

Thanks,
Sean