avc: denied { ioctl }?

[Hongwei Li]

Hi,

I have a fc3 linux system with targed selinux enforced, kernel
2.6.11-1.14_FC3, target policy 1.17.30-2.96.

After I updated the policy to this version (1.17.30-2.96), from time to time
the system log shows a lot of error messages like this:

Jun  6 17:51:04 morpheus kernel: audit(1118098264.336:0): avc:  denied  {
ioctl } for  pid=17395 exe=/usr/bin/perl path=/proc/loadavg dev=proc
ino=-268435456 scontext=user_u:system_r:httpd_sys_script_t
tcontext=system_u:object_r:proc_t tclass=file


Can somebody help me to figure out what is going on?  What should I check and
change to fix the problem?

Thanks!

Hongwei Li

[Stephen Smalley]

On Tue, 2005-06-07 at 08:17 -0500, Hongwei Li wrote:
>  After I updated the policy to this version (1.17.30-2.96), from time
> to time
>  the system log shows a lot of error messages like this:
>  
>  Jun  6 17:51:04 morpheus kernel: audit(1118098264.336:0): avc:  denied  {
>  ioctl } for  pid=17395 exe=/usr/bin/perl path=/proc/loadavg dev=proc
>  ino=-268435456 scontext=user_u:system_r:httpd_sys_script_t
>  tcontext=system_u:object_r:proc_t tclass=file 
Likely should just be dontaudit'd, e.g.
yum install selinux-policy-targeted-sources
cd /etc/selinux/targeted/src/policy
echo "dontaudit httpd_sys_script_t proc_t:file ioctl;" >>
domains/misc/local.te
make load

-- 
Stephen Smalley
National Security Agency

[Hongwei Li]

>  On Tue, 2005-06-07 at 08:17 -0500, Hongwei Li wrote:
> > After I updated the policy to this version (1.17.30-2.96), from time to time
> > the system log shows a lot of error messages like this:
> >
> > Jun  6 17:51:04 morpheus kernel: audit(1118098264.336:0): avc:  denied  {
> > ioctl } for  pid=17395 exe=/usr/bin/perl path=/proc/loadavg dev=proc
> > ino=-268435456 scontext=user_u:system_r:httpd_sys_script_t
> > tcontext=system_u:object_r:proc_t tclass=file
>
>  Likely should just be dontaudit'd, e.g.
>  yum install selinux-policy-targeted-sources
>  cd /etc/selinux/targeted/src/policy
>  echo "dontaudit httpd_sys_script_t proc_t:file ioctl;" >>
>  domains/misc/local.te
>  make load
>
>  --
>  Stephen Smalley
>  National Security Agency 
Thanks for the help.  The strnage thing is that after June 6, 18:00, this
message avc:  denied  { ioctl }... suddenly does not show up any more (up to
now, June 8, 9am).  If it shows up again, I will do the above.  Now, I am just
curious what happened.  I did not change the policy in these two days, did not
change any system setting either.  What does the error message mean?  What is
loadavg?

Thanks!

Hongwei Li

[Stephen Smalley]

On Wed, 2005-06-08 at 08:53 -0500, Hongwei Li wrote:
>  Thanks for the help.  The strnage thing is that after June 6, 18:00,
> this
>  message avc:  denied  { ioctl }... suddenly does not show up any more (up to
>  now, June 8, 9am).  If it shows up again, I will do the above.  Now, I am just
>  curious what happened.  I did not change the policy in these two days, did not
>  change any system setting either.  What does the error message mean?  What is
>  loadavg? 
perl script attempted to probe /proc/loadavg, likely was redirecting
stdin from it and did the usual check to see if it was a
tty.  /proc/loadavg contains load average information provided by the
kernel.


-- 
Stephen Smalley
National Security Agency

[Hongwei Li]

>  On Tue, 2005-06-07 at 08:17 -0500, Hongwei Li wrote:
> > After I updated the policy to this version (1.17.30-2.96), from time to time
> > the system log shows a lot of error messages like this:
> >
> > Jun  6 17:51:04 morpheus kernel: audit(1118098264.336:0): avc:  denied  {
> > ioctl } for  pid=17395 exe=/usr/bin/perl path=/proc/loadavg dev=proc
> > ino=-268435456 scontext=user_u:system_r:httpd_sys_script_t
> > tcontext=system_u:object_r:proc_t tclass=file
>
>  Likely should just be dontaudit'd, e.g.
>  yum install selinux-policy-targeted-sources
>  cd /etc/selinux/targeted/src/policy
>  echo "dontaudit httpd_sys_script_t proc_t:file ioctl;" >>
>  domains/misc/local.te
>  make load
>
>  --
>  Stephen Smalley
>  National Security Agency
>  
Another question.  I installed selinux-policy-targeted-sources.  However, I
could not find local.te under domains/misc.  What I see under domain are:

misc  program  unconfined.te

under misc I see only a folder unused under which are:

auth-net.te  fcron.te  kernel.te  screensaver.te  startx.te 
userspace_objmgr.te  xclient.te

but no local.te.  I don't see it under domain/program/ either.  Then, what
file should I run the above command to?

Thanks!

HOngwei

local.te (was Re: avc: denied { ioctl }?

On Wed, 08 Jun 2005 09:28:20 CDT, Hongwei Li said:

>  but no local.te.  I don't see it under domain/program/ either. 
> Then, what
>  file should I run the above command to? 
You don't have a domain/program/local.te yet because you haven't done any local
changes to ruleset yet.  Go ahead and create it if you decide to 'dontaudit' that
one avc.

Question to the list:  Should the Fedora RPM ship a one-line local.te that
says '# Put your local stuff here', and flag it as a config file so RPM will
DTRT with it?

local.te (was Re: avc: denied { ioctl }?

[Craig]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Valdis.Kletnieks(a)vt.edu wrote:
| On Wed, 08 Jun 2005 09:28:20 CDT, Hongwei Li said:
|
|
|>but no local.te.  I don't see it under domain/program/ either.  Then, what
|>file should I run the above command to?
|
|
| You don't have a domain/program/local.te yet because you haven't done any local
| changes to ruleset yet.  Go ahead and create it if you decide to 'dontaudit'
that
| one avc.
|
| Question to the list:  Should the Fedora RPM ship a one-line local.te that
| says '# Put your local stuff here', and flag it as a config file so RPM will
| DTRT with it?
Although it would seem unnecessary, I think it is an excellent idea. There are a
lot of people, even some IT/IS Admins, using(trying) fedora that are totally
unfamiliar with Unix-like systems let alone SE Linux and it would be extremely
reassuring and preferable to them to edit an existing file than to create one
from scratch.

Craig

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.6 (GNU/Linux)
>
> iD8DBQFCp1za6XcoldzZ4rgRAj8aAKDXE5ylv+E5IZRQ/BoBGBfnMaYxGgCggNv5
> 2sl01XEDZpTSy6BOAut0ZxQ=
> =HaVi
> -----END PGP SIGNATURE-----

local.te (was Re: avc: denied { ioctl }?

[Hongwei Li]

>  On Wed, 08 Jun 2005 09:28:20 CDT, Hongwei Li said:
>
> > but no local.te.  I don't see it under domain/program/ either.  Then, what
> > file should I run the above command to?
>
>  You don't have a domain/program/local.te yet because you haven't done any
>  local
>  changes to ruleset yet.  Go ahead and create it if you decide to 'dontaudit'
>  that
>  one avc. 
I created a file local.te under /etc/selinux/targeted/src/policy/domains/program/

and run:

# echo "dontaudit httpd_sys_script_t proc_t:file ioctl;" >> local.te

Now, this file has one line

dontaudit httpd_sys_script_t proc_t:file ioctl;

Then, when I run "make load", I got:

# make load
mkdir -p tmp
( cd domains/program/ ; for n in *.te ; do echo "define(\`$n')"; done )
>
tmp/program_used_flags.te.tmp
( cd domains/misc/ ; for n in *.te ; do echo "define(\`$n')"; done )
>>
tmp/program_used_flags.te.tmp
mv tmp/program_used_flags.te.tmp tmp/program_used_flags.te
make: *** No rule to make target `file_contexts/program/local.fc', needed by
`file_contexts/file_contexts'.  Stop.

What should I put in file_contexts/program/local.fc?

Thanks!

Hongwei

local.te (was Re: avc: denied { ioctl }?

[Stephen Smalley]

On Thu, 2005-06-09 at 08:25 -0500, Hongwei Li wrote:
>  Then, when I run "make load", I got:
>  
>  # make load
>  mkdir -p tmp
>  ( cd domains/program/ ; for n in *.te ; do echo "define(\`$n')"; done )
> >
>  tmp/program_used_flags.te.tmp
>  ( cd domains/misc/ ; for n in *.te ; do echo "define(\`$n')"; done )
> >>
>  tmp/program_used_flags.te.tmp
>  mv tmp/program_used_flags.te.tmp tmp/program_used_flags.te
>  make: *** No rule to make target `file_contexts/program/local.fc', needed by
>  `file_contexts/file_contexts'.  Stop.
>  
>  What should I put in file_contexts/program/local.fc? 
That is why my message said to put local.te under domains/misc, not
domains/program.  For every .te file under domains/program, the Makefile
expects there to be a .fc file under file_contexts/program.  So, your
options are:
- move local.te under domains/misc as I said originally, or
- touch file_contexts/program/local.fc to create an empty file there to
satisfy the Makefile.

-- 
Stephen Smalley
National Security Agency

local.te (was Re: avc: denied { ioctl }?

[Hongwei Li]

>  On Thu, 2005-06-09 at 08:25 -0500, Hongwei Li wrote:
> > Then, when I run "make load", I got:
> >
> > # make load
> > mkdir -p tmp
> > ( cd domains/program/ ; for n in *.te ; do echo "define(\`$n')"; done )
> >
> > tmp/program_used_flags.te.tmp
> > ( cd domains/misc/ ; for n in *.te ; do echo "define(\`$n')"; done )
> >>
> > tmp/program_used_flags.te.tmp
> > mv tmp/program_used_flags.te.tmp tmp/program_used_flags.te
> > make: *** No rule to make target `file_contexts/program/local.fc', needed by
> > `file_contexts/file_contexts'.  Stop.
> >
> > What should I put in file_contexts/program/local.fc?
>
>  That is why my message said to put local.te under domains/misc, not
>  domains/program.  For every .te file under domains/program, the Makefile
>  expects there to be a .fc file under file_contexts/program.  So, your
>  options are:
>  - move local.te under domains/misc as I said originally, or
>  - touch file_contexts/program/local.fc to create an empty file there to
>  satisfy the Makefile.
>
>  --
>  Stephen Smalley
>  National Security Agency 
I moved local.te to misc, and it works.  Thanks!

Hongwei

[Russell Coker]

On Thursday 09 June 2005 00:28, "Hongwei Li" <hongwei(a)wustl.edu&gt; wrote:
>  Another question.  I installed selinux-policy-targeted-sources. 
> However, I
>  could not find local.te under domains/misc.  What I see under domain are: 
The point of the name "local.te" is that it will NEVER be used by any package 
or distribution of policy source.  So if you have not created such a file 
then it should not exist.

Another name reserved for the same purpose is "custom.te" (which I have used 
in examples of how to write policy).

When writing your own policy additions you should avoid using any name that 
might be used by the system.  If you have a name conflict then you risk 
losing your changes on an upgrade.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page