depmod_t failure again..... sigh

[Tom London]

Today's yum update of kernel reports (in targeted/enforcing):

  Installing: kernel                       ####################### [10/60]
WARNING: Couldn't open directory
/tmp/initrd.fu5084/lib/modules/2.6.24-0.133.rc6.git8.fc9: Permission
denied
FATAL: Could not open
/tmp/initrd.fu5084/lib/modules/2.6.24-0.133.rc6.git8.fc9/modules.dep.temp
for writing: Permission denied

Here is the raw AVC:

type=AVC msg=audit(1199371409.130:30): avc:  denied  { search } for
pid=7185 comm="depmod" name="tmp" dev=dm-0 ino=2686977
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=system_u:object_r:tmp_t:s0 tclass=dir
type=SYSCALL msg=audit(1199371409.130:30): arch=40000003 syscall=5
success=no exit=-13 a0=8941070 a1=98800 a2=2e646f6d a3=8941110 items=0
ppid=4720 pid=7185 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371409.130:31): avc:  denied  { search } for
pid=7185 comm="depmod" name="tmp" dev=dm-0 ino=2686977
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=system_u:object_r:tmp_t:s0 tclass=dir
type=SYSCALL msg=audit(1199371409.130:31): arch=40000003 syscall=5
success=no exit=-13 a0=bfb012b0 a1=241 a2=1b6 a3=895d480 items=0
ppid=4720 pid=7185 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)

Removing kernel package, and rerunning in permissive mode yields:

type=AVC msg=audit(1199371729.926:38): avc:  denied  { search } for
pid=10294 comm="depmod" name="tmp" dev=dm-0 ino=2686977
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=system_u:object_r:tmp_t:s0 tclass=dir
type=AVC msg=audit(1199371729.926:38): avc:  denied  { search } for
pid=10294 comm="depmod" name="initrd.qF8194" dev=dm-0 ino=2687511
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
type=AVC msg=audit(1199371729.926:38): avc:  denied  { read } for
pid=10294 comm="depmod" name="2.6.24-0.133.rc6.git8.fc9" dev=dm-0
ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
type=SYSCALL msg=audit(1199371729.926:38): arch=40000003 syscall=5
success=yes exit=3 a0=8ac5070 a1=98800 a2=2e646f6d a3=8ac5110 items=0
ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371729.927:39): avc:  denied  { getattr } for
pid=10294 comm="depmod"
path="/tmp/initrd.qF8194/lib/modules/2.6.24-0.133.rc6.git8.fc9"
dev=dm-0 ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
type=SYSCALL msg=audit(1199371729.927:39): arch=40000003 syscall=197
success=yes exit=0 a0=3 a1=bfd6253c a2=950ff4 a3=3 items=0 ppid=7830
pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371729.927:40): avc:  denied  { read } for
pid=10294 comm="depmod" name="scsi_mod.ko" dev=dm-0 ino=2687575
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
type=SYSCALL msg=audit(1199371729.927:40): arch=40000003 syscall=5
success=yes exit=4 a0=8ae2514 a1=0 a2=1b6 a3=8ae8c20 items=0 ppid=7830
pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371729.927:41): avc:  denied  { getattr } for
pid=10294 comm="depmod"
path="/tmp/initrd.qF8194/lib/modules/2.6.24-0.133.rc6.git8.fc9/scsi_mod.ko"
dev=dm-0 ino=2687575 scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
type=SYSCALL msg=audit(1199371729.927:41): arch=40000003 syscall=197
success=yes exit=0 a0=4 a1=bfd6228c a2=950ff4 a3=8ae8c20 items=0
ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371729.931:42): avc:  denied  { write } for
pid=10294 comm="depmod" name="2.6.24-0.133.rc6.git8.fc9" dev=dm-0
ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
type=AVC msg=audit(1199371729.931:42): avc:  denied  { add_name } for
pid=10294 comm="depmod" name="modules.dep.temp"
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
type=AVC msg=audit(1199371729.931:42): avc:  denied  { create } for
pid=10294 comm="depmod" name="modules.dep.temp"
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
type=AVC msg=audit(1199371729.931:42): avc:  denied  { write } for
pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0 ino=2687612
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
type=SYSCALL msg=audit(1199371729.931:42): arch=40000003 syscall=5
success=yes exit=3 a0=bfd62510 a1=241 a2=1b6 a3=8b3b1e0 items=0
ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371729.932:43): avc:  denied  { remove_name }
for  pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0
ino=2687612 scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
type=AVC msg=audit(1199371729.932:43): avc:  denied  { rename } for
pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0 ino=2687612
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
type=SYSCALL msg=audit(1199371729.932:43): arch=40000003 syscall=38
success=yes exit=0 a0=bfd62510 a1=bfd62570 a2=8b3b1e0 a3=bfd62510
items=0 ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)

or
#============= depmod_t ==============
allow depmod_t rpm_script_tmp_t:dir { write search read remove_name
getattr add_name };
allow depmod_t rpm_script_tmp_t:file { read write getattr create rename };
allow depmod_t tmp_t:dir search;


tom
-- 
Tom London

[Eric Paris]

Dan knows and he has it fixed on his local system, he will push it
rawhide soonish

-Eric

On Thu, 2008-01-03 at 06:51 -0800, Tom London wrote:
>  Today's yum update of kernel reports (in targeted/enforcing):
>  
>    Installing: kernel                       ####################### [10/60]
>  WARNING: Couldn't open directory
>  /tmp/initrd.fu5084/lib/modules/2.6.24-0.133.rc6.git8.fc9: Permission
>  denied
>  FATAL: Could not open
>  /tmp/initrd.fu5084/lib/modules/2.6.24-0.133.rc6.git8.fc9/modules.dep.temp
>  for writing: Permission denied
>  
>  Here is the raw AVC:
>  
>  type=AVC msg=audit(1199371409.130:30): avc:  denied  { search } for
>  pid=7185 comm="depmod" name="tmp" dev=dm-0 ino=2686977
>  scontext=unconfined_u:system_r:depmod_t:s0
>  tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>  type=SYSCALL msg=audit(1199371409.130:30): arch=40000003 syscall=5
>  success=no exit=-13 a0=8941070 a1=98800 a2=2e646f6d a3=8941110 items=0
>  ppid=4720 pid=7185 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
>  sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
>  subj=unconfined_u:system_r:depmod_t:s0 key=(null)
>  type=AVC msg=audit(1199371409.130:31): avc:  denied  { search } for
>  pid=7185 comm="depmod" name="tmp" dev=dm-0 ino=2686977
>  scontext=unconfined_u:system_r:depmod_t:s0
>  tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>  type=SYSCALL msg=audit(1199371409.130:31): arch=40000003 syscall=5
>  success=no exit=-13 a0=bfb012b0 a1=241 a2=1b6 a3=895d480 items=0
>  ppid=4720 pid=7185 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
>  sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
>  subj=unconfined_u:system_r:depmod_t:s0 key=(null)
>  
>  Removing kernel package, and rerunning in permissive mode yields:
>  
>  type=AVC msg=audit(1199371729.926:38): avc:  denied  { search } for
>  pid=10294 comm="depmod" name="tmp" dev=dm-0 ino=2686977
>  scontext=unconfined_u:system_r:depmod_t:s0
>  tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>  type=AVC msg=audit(1199371729.926:38): avc:  denied  { search } for
>  pid=10294 comm="depmod" name="initrd.qF8194" dev=dm-0 ino=2687511
>  scontext=unconfined_u:system_r:depmod_t:s0
>  tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
>  type=AVC msg=audit(1199371729.926:38): avc:  denied  { read } for
>  pid=10294 comm="depmod" name="2.6.24-0.133.rc6.git8.fc9" dev=dm-0
>  ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
>  tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
>  type=SYSCALL msg=audit(1199371729.926:38): arch=40000003 syscall=5
>  success=yes exit=3 a0=8ac5070 a1=98800 a2=2e646f6d a3=8ac5110 items=0
>  ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
>  sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
>  subj=unconfined_u:system_r:depmod_t:s0 key=(null)
>  type=AVC msg=audit(1199371729.927:39): avc:  denied  { getattr } for
>  pid=10294 comm="depmod"
>  path="/tmp/initrd.qF8194/lib/modules/2.6.24-0.133.rc6.git8.fc9"
>  dev=dm-0 ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
>  tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
>  type=SYSCALL msg=audit(1199371729.927:39): arch=40000003 syscall=197
>  success=yes exit=0 a0=3 a1=bfd6253c a2=950ff4 a3=3 items=0 ppid=7830
>  pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
>  fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
>  subj=unconfined_u:system_r:depmod_t:s0 key=(null)
>  type=AVC msg=audit(1199371729.927:40): avc:  denied  { read } for
>  pid=10294 comm="depmod" name="scsi_mod.ko" dev=dm-0 ino=2687575
>  scontext=unconfined_u:system_r:depmod_t:s0
>  tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
>  type=SYSCALL msg=audit(1199371729.927:40): arch=40000003 syscall=5
>  success=yes exit=4 a0=8ae2514 a1=0 a2=1b6 a3=8ae8c20 items=0 ppid=7830
>  pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
>  fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
>  subj=unconfined_u:system_r:depmod_t:s0 key=(null)
>  type=AVC msg=audit(1199371729.927:41): avc:  denied  { getattr } for
>  pid=10294 comm="depmod"
>  path="/tmp/initrd.qF8194/lib/modules/2.6.24-0.133.rc6.git8.fc9/scsi_mod.ko"
>  dev=dm-0 ino=2687575 scontext=unconfined_u:system_r:depmod_t:s0
>  tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
>  type=SYSCALL msg=audit(1199371729.927:41): arch=40000003 syscall=197
>  success=yes exit=0 a0=4 a1=bfd6228c a2=950ff4 a3=8ae8c20 items=0
>  ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
>  sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
>  subj=unconfined_u:system_r:depmod_t:s0 key=(null)
>  type=AVC msg=audit(1199371729.931:42): avc:  denied  { write } for
>  pid=10294 comm="depmod" name="2.6.24-0.133.rc6.git8.fc9" dev=dm-0
>  ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
>  tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
>  type=AVC msg=audit(1199371729.931:42): avc:  denied  { add_name } for
>  pid=10294 comm="depmod" name="modules.dep.temp"
>  scontext=unconfined_u:system_r:depmod_t:s0
>  tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
>  type=AVC msg=audit(1199371729.931:42): avc:  denied  { create } for
>  pid=10294 comm="depmod" name="modules.dep.temp"
>  scontext=unconfined_u:system_r:depmod_t:s0
>  tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
>  type=AVC msg=audit(1199371729.931:42): avc:  denied  { write } for
>  pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0 ino=2687612
>  scontext=unconfined_u:system_r:depmod_t:s0
>  tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
>  type=SYSCALL msg=audit(1199371729.931:42): arch=40000003 syscall=5
>  success=yes exit=3 a0=bfd62510 a1=241 a2=1b6 a3=8b3b1e0 items=0
>  ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
>  sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
>  subj=unconfined_u:system_r:depmod_t:s0 key=(null)
>  type=AVC msg=audit(1199371729.932:43): avc:  denied  { remove_name }
>  for  pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0
>  ino=2687612 scontext=unconfined_u:system_r:depmod_t:s0
>  tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
>  type=AVC msg=audit(1199371729.932:43): avc:  denied  { rename } for
>  pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0 ino=2687612
>  scontext=unconfined_u:system_r:depmod_t:s0
>  tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
>  type=SYSCALL msg=audit(1199371729.932:43): arch=40000003 syscall=38
>  success=yes exit=0 a0=bfd62510 a1=bfd62570 a2=8b3b1e0 a3=bfd62510
>  items=0 ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0
>  egid=0 sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
>  subj=unconfined_u:system_r:depmod_t:s0 key=(null)
>  
>  or
>  #============= depmod_t ==============
>  allow depmod_t rpm_script_tmp_t:dir { write search read remove_name
>  getattr add_name };
>  allow depmod_t rpm_script_tmp_t:file { read write getattr create rename };
>  allow depmod_t tmp_t:dir search;
>  
>  
>  tom