tzdata AVC
Hi,
I'm running SELinux in enforcing mode on fully updated CentOS-5 servers.
selinux-policy-2.4.6-279.el5_5.1.noarch
After the latest "possibly glibc" update I've seen the following AVC on
several of my servers.
Summary:
SELinux is preventing tzdata-update (tzdata_t) "getattr" to / (fs_t).
Detailed Description:
SELinux denied access requested by tzdata-update. It is not expected that this
access is required by tzdata-update and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not
recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context root:system_r:tzdata_t:SystemLow-SystemHigh
Target Context system_u:object_r:fs_t
Target Objects / [ filesystem ]
Source tzdata-update
Source Path <Unknown>
Port <Unknown>
Host remote-backup.x.y.z
Source RPM Packages
Target RPM Packages filesystem-2.4.0-3.el5
Policy RPM selinux-policy-2.4.6-279.el5_5.1
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall
Host Name remote-backup.x.y.z
Platform Linux remote-backup.x.y.z 2.6.18-194.17.1.el5
#1 SMP Wed Sep 29 12:50:31 EDT 2010 x86_64
x86_64
Alert Count 3
First Seen Fri Oct 22 06:31:14 2010
Last Seen Wed Oct 27 06:39:14 2010
Local ID ec15ac2d-b644-40fb-809a-2b3809b001e5
Line Numbers
Raw Audit Messages
host=remote-backup.csis.ul.ie type=AVC msg=audit(1288157954.817:16502): avc:
denied { getattr } for pid=2135 comm="tzdata-update" name="/"
dev=sda5 ino=2
scontext=root:system_r:tzdata_t:s0-s0:c0.c1023
tcontext=system_u:object_r:fs_t:s0 tclass=filesystem
Regards,
Tony