inode confusion?

[Vadym Chepkov]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

After recent policy upgrade (selinux-policy-targeted-3.10.0-145.fc17.noarch)
I noticed some cron jobs are failing and generate selinux avc:

time->Fri Aug 24 04:02:05 2012
type=SYSCALL msg=audit(1345780925.499:656): arch=c000003e syscall=2 success=no exit=-13
a0=404a07 a1=0 a2=0 a3=0 items=0 ppid=21070 pid=21091 auid=0 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=85 comm="tmpwatch"
exe="/usr/sbin/tmpwatch" subj=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023
key=(null)
type=AVC msg=audit(1345780925.499:656): avc:  denied  { read } for  pid=21091
comm="tmpwatch" name="root" dev="dm-1" ino=8194
scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023
tcontext=system_u:object_r:admin_home_t:s0 tclass=dir


tmpwatch definitely shouldn't be going to /root home, and I am pretty sure it
doesn't.

What's interesting though is this fact:

[root@fedora ~]# ls -ldi /root
8194 dr-xr-x---. 5 root root 4096 Aug 18 15:18 /root

[root@fedora ~]# ls -ldi /var/tmp
8194 drwxrwxrwt. 3 root root 4096 Aug 24 23:41 /var/tmp

both directories have the same inode number, which selinux is complaining about. Since
they are on different files system, it's normal:

[root@fedora ~]# df -h
Filesystem            Size  Used Avail Use% Mounted on
rootfs                4.0G  1.1G  2.7G  30% /
devtmpfs              223M     0  223M   0% /dev
tmpfs                 244M     0  244M   0% /dev/shm
tmpfs                 244M  380K  244M   1% /run
/dev/mapper/vgx-root  4.0G  1.1G  2.7G  30% /
tmpfs                 244M     0  244M   0% /sys/fs/cgroup
tmpfs                 244M     0  244M   0% /media
/dev/mapper/vgx-home 1008M   34M  923M   4% /home
/dev/mapper/vgx-tmp   504M   17M  462M   4% /tmp
/dev/mapper/vgx-var  1008M  303M  655M  32% /var
/dev/xvda1            504M   94M  386M  20% /boot

But it makes me wonder, if SELinux is confused somehow?

Regards,
Vadym




> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.18 (Darwin)
> Comment: GPGTools - http://gpgtools.org
>
> iEYEARECAAYFAlA4F7kACgkQmYV3iqStpjvYYACfcSV/KBMl6lzYM7Y/iASwuQhg
> gnEAn3aILGJEjV/Zckc0QY8UqCRpob5V
> =fGNj
> -----END PGP SIGNATURE-----

[Dominick Grift]

On Fri, 2012-08-24 at 20:09 -0400, Vadym Chepkov wrote:
>  
>  time->Fri Aug 24 04:02:05 2012
>  type=SYSCALL msg=audit(1345780925.499:656): arch=c000003e syscall=2 success=no exit=-13
> a0=404a07 a1=0 a2=0 a3=0 items=0 ppid=21070 pid=21091 auid=0 uid=0 gid=0 euid=0 suid=0
> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=85 comm="tmpwatch"
> exe="/usr/sbin/tmpwatch" subj=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023
> key=(null)
>  type=AVC msg=audit(1345780925.499:656): avc:  denied  { read } for  pid=21091
> comm="tmpwatch" name="root" dev="dm-1" ino=8194
> scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023
> tcontext=system_u:object_r:admin_home_t:s0 tclass=dir
>   
>  But it makes me wonder, if SELinux is confused somehow? 
No it is clear that tmpwatch wants to list /root for whatever reason.

comm="tmpwatch"
name="root"
dev="dm-1"

>  Regards,
>  Vadym
>  
>  
>  
>  
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux

[Vadym Chepkov]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Aug 26, 2012, at 6:15 AM, Dominick Grift wrote:

>  On Fri, 2012-08-24 at 20:09 -0400, Vadym Chepkov wrote:
> > 
> > time->Fri Aug 24 04:02:05 2012
> > type=SYSCALL msg=audit(1345780925.499:656): arch=c000003e syscall=2 success=no
> exit=-13 a0=404a07 a1=0 a2=0 a3=0 items=0 ppid=21070 pid=21091 auid=0 uid=0 gid=0 euid=0
> suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=85 comm="tmpwatch"
> exe="/usr/sbin/tmpwatch" subj=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023
> key=(null)
> > type=AVC msg=audit(1345780925.499:656): avc:  denied  { read } for  pid=21091
> comm="tmpwatch" name="root" dev="dm-1" ino=8194
> scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023
> tcontext=system_u:object_r:admin_home_t:s0 tclass=dir
> > 
>  
> > But it makes me wonder, if SELinux is confused somehow?
>  
>  No it is clear that tmpwatch wants to list /root for whatever reason.
>  
>  comm="tmpwatch"
>  name="root"
>  dev="dm-1" 

Just a coincidence then. 
Could it be that root's cron jobs are executed with /root as a current directory and
this breaks tmpwatch ?

Vadym

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.18 (Darwin)
> Comment: GPGTools - http://gpgtools.org
>
> iEYEARECAAYFAlA6FuIACgkQmYV3iqStpju91gCeNcXDBqtrOk5BpHWiD3E+TGBd
> 1c8AoJhAjb0JDSPSU41CAtG/iQFNPSIf
> =F6xi
> -----END PGP SIGNATURE-----

[yersinia]

On Sat, Aug 25, 2012 at 2:09 AM, Vadym Chepkov <vchepkov(a)gmail.com&gt; wrote:

>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>
>  Hi,
>
>  After recent policy upgrade (selinux-policy-targeted-3.10.0-145
>  .fc17.noarch)
>  I noticed some cron jobs are failing and generate selinux avc:
>
>  time->Fri Aug 24 04:02:05 2012
>  type=SYSCALL msg=audit(1345780925.499:656): arch=c000003e syscall=2
>  success=no exit=-13 a0=404a07 a1=0 a2=0 a3=0 items=0 ppid=21070 pid=21091
>  auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
>  ses=85 comm="tmpwatch" exe="/usr/sbin/tmpwatch"
>  subj=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 key=(null)
>  type=AVC msg=audit(1345780925.499:656): avc:  denied  { read } for
>   pid=21091 comm="tmpwatch" name="root" dev="dm-1" ino=8194
>  scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023
>  tcontext=system_u:object_r:admin_home_t:s0 tclass=dir
>
>
>  tmpwatch definitely shouldn't be going to /root home, and I am pretty sure
>  it doesn't.
>
>  No, isn't true. For example try to see which is the device that dm-0 point 
sudo lvdisplay|awk '/LV Name/{n=$3} /Block device/{d=$3;
sub(".*:","dm-",d); print d,n;}'

[Dominick Grift]

On Sun, 2012-08-26 at 08:30 -0400, Vadym Chepkov wrote:

>  Just a coincidence then. 
>  Could it be that root's cron jobs are executed with /root as a current directory and
> this breaks tmpwatch ? 
Could be yes, Although i would not expect a read but rather a search
on /root
>  Vadym 

>  
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux