Avc messages about awstats.pl and some mailmain commands

[Ali Nebi]

Hi,

in one of the servers where is installed fedora 6, i get some avc
messages, that i don't know why they appear and how is the right wat to
fix them - don't audit, or to allow them.

The messages from the logs are related with awstats. It is installed on
the server and using for statistics for some web sites. Also some
messages are related to mailmain. What can i do to fix this kind of
messages?

The messages are these:

Oct 21 13:16:08 casamerica kernel: audit(1192965368.811:2780): avc:
denied  { read write } for  pid=32746 comm="listinfo" name=""
dev=sockfs
ino=14911345 scontext=user_u:system_r:mailman_cgi_t:s0
tcontext=user_u:system_r:httpd_t:s0 tclass=unix_stream_socket

Oct 21 17:30:59 casamerica kernel: audit(1192980659.987:2781): avc:
denied  { read write } for  pid=2111 comm="listinfo" name=""
dev=sockfs
ino=15003495 scontext=user_u:system_r:mailman_cgi_t:s0
tcontext=user_u:system_r:httpd_t:s0 tclass=unix_stream_socket

Oct 21 18:48:55 casamerica kernel: audit(1192985335.997:2782): avc:
denied  { read write } for  pid=2742 comm="admin" name="" dev=sockfs
ino=15037931 scontext=user_u:system_r:mailman_cgi_t:s0
tcontext=user_u:system_r:httpd_t:s0 tclass=unix_stream_socket

Oct 21 20:29:59 casamerica kernel: audit(1192991399.010:2783): avc:
denied  { read write } for  pid=3539 comm="listinfo" name=""
dev=sockfs
ino=15143224 scontext=user_u:system_r:mailman_cgi_t:s0
tcontext=user_u:system_r:httpd_t:s0 tclass=unix_stream_socket

Oct 21 20:33:13 casamerica kernel: audit(1192991593.143:2784): avc:
denied  { read write } for  pid=3598 comm="confirm" name=""
dev=sockfs
ino=15159312 scontext=user_u:system_r:mailman_cgi_t:s0
tcontext=user_u:system_r:httpd_t:s0 tclass=unix_stream_socket

Oct 21 20:56:58 casamerica kernel: audit(1192993018.053:2785): avc:
denied  { create } for  pid=3721 comm="awstats.pl"
scontext=user_u:system_r:httpd_sys_script_t:s0
tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=udp_socket

Oct 21 20:56:58 casamerica kernel: audit(1192993018.053:2786): avc:
denied  { connect } for  pid=3721 comm="awstats.pl"
scontext=user_u:system_r:httpd_sys_script_t:s0 tcontext=
user_u:system_r:httpd_sys_script_t:s0 tclass=udp_socket

Oct 21 20:56:58 casamerica kernel: audit(1192993018.054:2787): avc:
denied  { write } for  pid=3721 comm="awstats.pl" laddr=87.106.8.16
lport=52760 faddr=87.106.8.251 fport=53
scontext=user_u:system_r:httpd_sys_script_t:s0
tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=udp_socket

Oct 21 20:56:58 casamerica kernel: audit(1192993018.054:2788): avc:
denied  { udp_send } for  pid=3721 comm="awstats.pl" saddr=87.106.8.16
src=52760 daddr=87.106.8.251 dest=53 
netif=eth0 scontext=user_u:system_r:httpd_sys_script_t:s0
tcontext=system_u:object_r:netif_t:s0 tclass=netif

Oct 21 20:56:58 casamerica kernel: audit(1192993018.054:2789): avc:
denied  { udp_send } for  pid=3721 comm="awstats.pl" saddr=87.106.8.16
src=52760 daddr=87.106.8.251 dest=53 
netif=eth0 scontext=user_u:system_r:httpd_sys_script_t:s0
tcontext=system_u:object_r:node_t:s0 tclass=node

Oct 21 20:56:58 casamerica kernel: audit(1192993018.054:2790): avc:
denied  { send_msg } for  pid=3721 comm="awstats.pl" saddr=87.106.8.16
src=52760 daddr=87.106.8.251 dest=53 
netif=eth0 scontext=user_u:system_r:httpd_sys_script_t:s0
tcontext=system_u:object_r:dns_port_t:s0 tclass=udp_socket

Oct 28 17:29:00 hermod kernel: audit(1193588940.609:7): avc:  denied
{ search } for  pid=996 comm="python" name="log" dev=dm-0
ino=57212956
scontext=system_u:system_r:postfix_local_t:s0
tcontext=system_u:object_r:var_log_t:s0 tclass=dir

Oct 28 17:45:38 hermod kernel: audit(1193589938.861:8): avc:  denied
{ search } for  pid=1774 comm="python" name="log" dev=dm-0
ino=57212956
scontext=system_u:system_r:postfix_local_t:s0
tcontext=system_u:object_r:var_log_t:s0 tclass=dir

the last messages for python try to access /var/log, but i get these
messages.

What is the best decision to solve these audits? I'm trying to
understand selinux principles and try to moving the server to enforce
mode.

Thanks in advanced!

[Stefan Schulze Frielinghaus]

On Tue, 2007-10-30 at 13:32 +0200, Ali Nebi wrote:
[...]
>  Oct 21 20:56:58 casamerica kernel: audit(1192993018.053:2785): avc:
>  denied  { create } for  pid=3721 comm="awstats.pl"
>  scontext=user_u:system_r:httpd_sys_script_t:s0
>  tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=udp_socket 
[...]
>  What is the best decision to solve these audits? I'm trying to
>  understand selinux principles and try to moving the server to enforce
>  mode. 
You need a policy for Awstats. The latest refpolicy release
(http://oss.tresys.com/files/refpolicy/refpolicy-20070928.tar.bz2)
includes awstats. I guess Fedora 6 doesn't include the latest policy for
awstats.

cheers,
Stefan

[Ali Nebi]

On Tue, 2007-10-30 at 12:24 +0000, Stefan Schulze Frielinghaus wrote:
>  On Tue, 2007-10-30 at 13:32 +0200, Ali Nebi wrote:
>  [...]
>  > Oct 21 20:56:58 casamerica kernel: audit(1192993018.053:2785): avc:
>  > denied  { create } for  pid=3721 comm="awstats.pl"
>  > scontext=user_u:system_r:httpd_sys_script_t:s0
>  > tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=udp_socket
>  [...]
>  > What is the best decision to solve these audits? I'm trying to
>  > understand selinux principles and try to moving the server to enforce
>  > mode.
>  
>  You need a policy for Awstats. The latest refpolicy release
>  (http://oss.tresys.com/files/refpolicy/refpolicy-20070928.tar.bz2)
>  includes awstats. I guess Fedora 6 doesn't include the latest policy for
>  awstats.
>  
>  cheers,
>  Stefan
>   
Perfect, thanks. I will install it. Yes, i checked for awstats, but i think it doesn't
include the latest policy until now.
Thanks again

[Stefan Schulze Frielinghaus]

On Tue, 2007-10-30 at 14:31 +0200, Ali Nebi wrote:
>  On Tue, 2007-10-30 at 12:24 +0000, Stefan Schulze Frielinghaus
> wrote:
>  > On Tue, 2007-10-30 at 13:32 +0200, Ali Nebi wrote:
>  > [...]
>  > > Oct 21 20:56:58 casamerica kernel: audit(1192993018.053:2785): avc:
>  > > denied  { create } for  pid=3721 comm="awstats.pl"
>  > > scontext=user_u:system_r:httpd_sys_script_t:s0
>  > > tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=udp_socket
>  > [...]
>  > > What is the best decision to solve these audits? I'm trying to
>  > > understand selinux principles and try to moving the server to enforce
>  > > mode.
>  > 
>  > You need a policy for Awstats. The latest refpolicy release
>  > (http://oss.tresys.com/files/refpolicy/refpolicy-20070928.tar.bz2)
>  > includes awstats. I guess Fedora 6 doesn't include the latest policy for
>  > awstats.
>  > 
>  > cheers,
>  > Stefan
>  > 
>  
>  Perfect, thanks. I will install it. Yes, i checked for awstats, but i think it
> doesn't include the latest policy until now.
>  Thanks again 
Just wanted to mention: You don't need to install the whole refpolicy.
This would mean you substitute the selinux policy of fedora core 6
(which I wouldn't suggest). Just get the awstats.te, awstats.fc,
awstats.if files copy them to e.g. /root/selinux and install the
selinux-policy-devel rpm package. Build the awstats module and install
only this one.

cheers,
Stefan