11:35 a.m.
I am continually getting getattr and read AVC errors. From my research, I believe it is
because my hosts file gets modified each time I VPN into my work network.
I cause the host names and IP addresses that are part of the internal work network to be
appended to the hosts file upon the VPN connection and then restore the original hosts
file upon disconnection.
I have tried restorecon /etc/hosts, but I still get the warnings. I have also done the
mypol fixes suggested in the troubleshooting dialog's details page. Nothing I do
resolves this issue.
How can I prevent these AVC errors? Or at least properly modify my hosts file (and
possibly others) the SELinux way?
Emmett
12:31 a.m.
On 05/22/2014 06:35 PM, Emmett Culley wrote:
I am continually getting getattr and read AVC errors. From my
research, I believe it is because my hosts file gets modified each time I VPN into my work
network.
I cause the host names and IP addresses that are part of the internal work network to be
appended to the hosts file upon the VPN connection and then restore the original hosts
file upon disconnection.
I have tried restorecon /etc/hosts, but I still get the warnings. I have also done the
mypol fixes suggested in the troubleshooting dialog's details page. Nothing I do
resolves this issue.
How can I prevent these AVC errors? Or at least properly modify my hosts file (and
possibly others) the SELinux way?
Emmett
--
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
What AVC message are you
getting?
What OS?
Regards,
Miroslav
5:24 p.m.
On 05/22/2014 10:31 PM, Miroslav Grepl wrote:
On 05/22/2014 06:35 PM, Emmett Culley wrote:
> I am continually getting getattr and read AVC errors. From my research, I believe it
is because my hosts file gets modified each time I VPN into my work network.
>
> I cause the host names and IP addresses that are part of the internal work network to
be appended to the hosts file upon the VPN connection and then restore the original hosts
file upon disconnection.
>
> I have tried restorecon /etc/hosts, but I still get the warnings. I have also done
the mypol fixes suggested in the troubleshooting dialog's details page. Nothing I do
resolves this issue.
>
> How can I prevent these AVC errors? Or at least properly modify my hosts file (and
possibly others) the SELinux way?
>
> Emmett
> --
> selinux mailing list
> selinux(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
What AVC message are you getting?
What OS?
Regards,
Miroslav
Linux (Fedora 20)
type=AVC msg=audit(1401200342.155:473): avc: denied { read } for pid=5501
comm="httpd" name="hosts" dev="dm-0" ino=270007
scontext=system_u:system_r:httpd_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
AND
type=AVC msg=audit(1401195880.487:401): avc: denied { getattr } for pid=1064
comm="chronyd" path="/etc/hosts" dev="dm-0" ino=270007
scontext=system_u:system_r:chronyd_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0
tclass=file
type=SYSCALL msg=audit(1401195880.487:401): arch=x86_64 syscall=fstat success=yes exit=0
a0=4 a1=7fff126bb590 a2=7fff126bb590 a3=0 items=0 ppid=1 pid=1064 auid=4294967295 uid=997
gid=996 euid=997 suid=997 fsuid=997 egid=996 sgid=996 fsgid=996 tty=(none) ses=4294967295
comm=chronyd exe=/usr/sbin/chronyd subj=system_u:system_r:chronyd_t:s0 key=(null)
Each of the errors are caused by attempts to access the hosts file.
Emmett
5:36 a.m.
On 05/28/2014 12:24 AM, Emmett Culley wrote:
On 05/22/2014 10:31 PM, Miroslav Grepl wrote:
> On 05/22/2014 06:35 PM, Emmett Culley wrote:
>> I am continually getting getattr and read AVC errors. From my research, I
believe it is because my hosts file gets modified each time I VPN into my work network.
>>
>> I cause the host names and IP addresses that are part of the internal work
network to be appended to the hosts file upon the VPN connection and then restore the
original hosts file upon disconnection.
>>
>> I have tried restorecon /etc/hosts, but I still get the warnings. I have also
done the mypol fixes suggested in the troubleshooting dialog's details page. Nothing
I do resolves this issue.
>>
>> How can I prevent these AVC errors? Or at least properly modify my hosts file
(and possibly others) the SELinux way?
>>
>> Emmett
>> --
>> selinux mailing list
>> selinux(a)lists.fedoraproject.org
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
> What AVC message are you getting?
>
> What OS?
>
> Regards,
> Miroslav
>
Linux (Fedora 20)
type=AVC msg=audit(1401200342.155:473): avc: denied { read } for pid=5501
comm="httpd" name="hosts" dev="dm-0" ino=270007
scontext=system_u:system_r:httpd_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
AND
type=AVC msg=audit(1401195880.487:401): avc: denied { getattr } for pid=1064
comm="chronyd" path="/etc/hosts" dev="dm-0" ino=270007
scontext=system_u:system_r:chronyd_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0
tclass=file
type=SYSCALL msg=audit(1401195880.487:401): arch=x86_64 syscall=fstat success=yes exit=0
a0=4 a1=7fff126bb590 a2=7fff126bb590 a3=0 items=0 ppid=1 pid=1064 auid=4294967295 uid=997
gid=996 euid=997 suid=997 fsuid=997 egid=996 sgid=996 fsgid=996 tty=(none) ses=4294967295
comm=chronyd exe=/usr/sbin/chronyd subj=system_u:system_r:chronyd_t:s0 key=(null)
Each of the errors are caused by attempts to access the hosts file.
Emmett
--
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
"admin_home_t"
is label for files/dirs in /root directory. It means the
/etc/hosts is moved from this directory. Any chance you have a script
which does it?
10:13 a.m.
restorecon -R -v /etc/hosts
Would fix this issue.
On 05/28/2014 06:36 AM, Miroslav Grepl wrote:
On 05/28/2014 12:24 AM, Emmett Culley wrote:
> On 05/22/2014 10:31 PM, Miroslav Grepl wrote:
>> On 05/22/2014 06:35 PM, Emmett Culley wrote:
>>> I am continually getting getattr and read AVC errors. From my
>>> research, I believe it is because my hosts file gets modified each
>>> time I VPN into my work network.
>>>
>>> I cause the host names and IP addresses that are part of the
>>> internal work network to be appended to the hosts file upon the VPN
>>> connection and then restore the original hosts file upon
>>> disconnection.
>>>
>>> I have tried restorecon /etc/hosts, but I still get the warnings.
>>> I have also done the mypol fixes suggested in the troubleshooting
>>> dialog's details page. Nothing I do resolves this issue.
>>>
>>> How can I prevent these AVC errors? Or at least properly modify my
>>> hosts file (and possibly others) the SELinux way?
>>>
>>> Emmett
>>> --
>>> selinux mailing list
>>> selinux(a)lists.fedoraproject.org
>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>> What AVC message are you getting?
>>
>> What OS?
>>
>> Regards,
>> Miroslav
>>
> Linux (Fedora 20)
>
> type=AVC msg=audit(1401200342.155:473): avc: denied { read } for
> pid=5501 comm="httpd" name="hosts" dev="dm-0"
ino=270007
> scontext=system_u:system_r:httpd_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
>
> AND
>
> type=AVC msg=audit(1401195880.487:401): avc: denied { getattr }
> for pid=1064 comm="chronyd" path="/etc/hosts"
dev="dm-0" ino=270007
> scontext=system_u:system_r:chronyd_t:s0
> tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
>
>
> type=SYSCALL msg=audit(1401195880.487:401): arch=x86_64 syscall=fstat
> success=yes exit=0 a0=4 a1=7fff126bb590 a2=7fff126bb590 a3=0 items=0
> ppid=1 pid=1064 auid=4294967295 uid=997 gid=996 euid=997 suid=997
> fsuid=997 egid=996 sgid=996 fsgid=996 tty=(none) ses=4294967295
> comm=chronyd exe=/usr/sbin/chronyd
> subj=system_u:system_r:chronyd_t:s0 key=(null)
>
> Each of the errors are caused by attempts to access the hosts file.
>
> Emmett
>
> --
> selinux mailing list
> selinux(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
"admin_home_t" is label for files/dirs in /root directory. It means
the /etc/hosts is moved from this directory. Any chance you have a
script which does it?
--
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
3:20 a.m.
On 05/28/2014 05:13 PM, Daniel J Walsh wrote:
restorecon -R -v /etc/hosts
Would fix this issue.
Yes, but he needs to repeat it.
On 05/28/2014 06:36 AM, Miroslav Grepl wrote:
> On 05/28/2014 12:24 AM, Emmett Culley wrote:
>> On 05/22/2014 10:31 PM, Miroslav Grepl wrote:
>>> On 05/22/2014 06:35 PM, Emmett Culley wrote:
>>>> I am continually getting getattr and read AVC errors. From my
>>>> research, I believe it is because my hosts file gets modified each
>>>> time I VPN into my work network.
>>>>
>>>> I cause the host names and IP addresses that are part of the
>>>> internal work network to be appended to the hosts file upon the VPN
>>>> connection and then restore the original hosts file upon
>>>> disconnection.
>>>>
>>>> I have tried restorecon /etc/hosts, but I still get the warnings.
>>>> I have also done the mypol fixes suggested in the troubleshooting
>>>> dialog's details page. Nothing I do resolves this issue.
>>>>
>>>> How can I prevent these AVC errors? Or at least properly modify my
>>>> hosts file (and possibly others) the SELinux way?
>>>>
>>>> Emmett
>>>> --
>>>> selinux mailing list
>>>> selinux(a)lists.fedoraproject.org
>>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>> What AVC message are you getting?
>>>
>>> What OS?
>>>
>>> Regards,
>>> Miroslav
>>>
>> Linux (Fedora 20)
>>
>> type=AVC msg=audit(1401200342.155:473): avc: denied { read } for
>> pid=5501 comm="httpd" name="hosts" dev="dm-0"
ino=270007
>> scontext=system_u:system_r:httpd_t:s0-s0:c0.c1023
>> tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
>>
>> AND
>>
>> type=AVC msg=audit(1401195880.487:401): avc: denied { getattr }
>> for pid=1064 comm="chronyd" path="/etc/hosts"
dev="dm-0" ino=270007
>> scontext=system_u:system_r:chronyd_t:s0
>> tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
>>
>>
>> type=SYSCALL msg=audit(1401195880.487:401): arch=x86_64 syscall=fstat
>> success=yes exit=0 a0=4 a1=7fff126bb590 a2=7fff126bb590 a3=0 items=0
>> ppid=1 pid=1064 auid=4294967295 uid=997 gid=996 euid=997 suid=997
>> fsuid=997 egid=996 sgid=996 fsgid=996 tty=(none) ses=4294967295
>> comm=chronyd exe=/usr/sbin/chronyd
>> subj=system_u:system_r:chronyd_t:s0 key=(null)
>>
>> Each of the errors are caused by attempts to access the hosts file.
>>
>> Emmett
>>
>> --
>> selinux mailing list
>> selinux(a)lists.fedoraproject.org
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
> "admin_home_t" is label for files/dirs in /root directory. It means
> the /etc/hosts is moved from this directory. Any chance you have a
> script which does it?
>
>
> --
> selinux mailing list
> selinux(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
12:25 p.m.
On 05/29/2014 01:20 AM, Miroslav Grepl wrote:
On 05/28/2014 05:13 PM, Daniel J Walsh wrote:
> restorecon -R -v /etc/hosts
>
> Would fix this issue.
Yes, but he needs to repeat it.
>
> On 05/28/2014 06:36 AM, Miroslav Grepl wrote:
>> On 05/28/2014 12:24 AM, Emmett Culley wrote:
>>> On 05/22/2014 10:31 PM, Miroslav Grepl wrote:
>>>> On 05/22/2014 06:35 PM, Emmett Culley wrote:
>>>>> I am continually getting getattr and read AVC errors. From my
>>>>> research, I believe it is because my hosts file gets modified each
>>>>> time I VPN into my work network.
>>>>>
>>>>> I cause the host names and IP addresses that are part of the
>>>>> internal work network to be appended to the hosts file upon the VPN
>>>>> connection and then restore the original hosts file upon
>>>>> disconnection.
>>>>>
>>>>> I have tried restorecon /etc/hosts, but I still get the warnings.
>>>>> I have also done the mypol fixes suggested in the troubleshooting
>>>>> dialog's details page. Nothing I do resolves this issue.
>>>>>
>>>>> How can I prevent these AVC errors? Or at least properly modify my
>>>>> hosts file (and possibly others) the SELinux way?
>>>>>
>>>>> Emmett
>>>>> --
>>>>> selinux mailing list
>>>>> selinux(a)lists.fedoraproject.org
>>>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>> What AVC message are you getting?
>>>>
>>>> What OS?
>>>>
>>>> Regards,
>>>> Miroslav
>>>>
>>> Linux (Fedora 20)
>>>
>>> type=AVC msg=audit(1401200342.155:473): avc: denied { read } for
>>> pid=5501 comm="httpd" name="hosts" dev="dm-0"
ino=270007
>>> scontext=system_u:system_r:httpd_t:s0-s0:c0.c1023
>>> tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
>>>
>>> AND
>>>
>>> type=AVC msg=audit(1401195880.487:401): avc: denied { getattr }
>>> for pid=1064 comm="chronyd" path="/etc/hosts"
dev="dm-0" ino=270007
>>> scontext=system_u:system_r:chronyd_t:s0
>>> tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
>>>
>>>
>>> type=SYSCALL msg=audit(1401195880.487:401): arch=x86_64 syscall=fstat
>>> success=yes exit=0 a0=4 a1=7fff126bb590 a2=7fff126bb590 a3=0 items=0
>>> ppid=1 pid=1064 auid=4294967295 uid=997 gid=996 euid=997 suid=997
>>> fsuid=997 egid=996 sgid=996 fsgid=996 tty=(none) ses=4294967295
>>> comm=chronyd exe=/usr/sbin/chronyd
>>> subj=system_u:system_r:chronyd_t:s0 key=(null)
>>>
>>> Each of the errors are caused by attempts to access the hosts file.
>>>
>>> Emmett
>>>
>>> --
>>> selinux mailing list
>>> selinux(a)lists.fedoraproject.org
>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>> "admin_home_t" is label for files/dirs in /root directory. It means
>> the /etc/hosts is moved from this directory. Any chance you have a
>> script which does it?
>>
>>
>> --
>> selinux mailing list
>> selinux(a)lists.fedoraproject.org
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
Yes, I am using a script to save the current hosts file to /root when starting a
VPN connection, then moving it back when closing the VPN connection. I will add the
restorecon command to the script.
Emmett
4:21 p.m.
On 05/30/2014 01:25 PM, Emmett Culley wrote:
On 05/29/2014 01:20 AM, Miroslav Grepl wrote:
> On 05/28/2014 05:13 PM, Daniel J Walsh wrote:
>> restorecon -R -v /etc/hosts
>>
>> Would fix this issue.
> Yes, but he needs to repeat it.
>> On 05/28/2014 06:36 AM, Miroslav Grepl wrote:
>>> On 05/28/2014 12:24 AM, Emmett Culley wrote:
>>>> On 05/22/2014 10:31 PM, Miroslav Grepl wrote:
>>>>> On 05/22/2014 06:35 PM, Emmett Culley wrote:
>>>>>> I am continually getting getattr and read AVC errors. From my
>>>>>> research, I believe it is because my hosts file gets modified
each
>>>>>> time I VPN into my work network.
>>>>>>
>>>>>> I cause the host names and IP addresses that are part of the
>>>>>> internal work network to be appended to the hosts file upon the
VPN
>>>>>> connection and then restore the original hosts file upon
>>>>>> disconnection.
>>>>>>
>>>>>> I have tried restorecon /etc/hosts, but I still get the
warnings.
>>>>>> I have also done the mypol fixes suggested in the
troubleshooting
>>>>>> dialog's details page. Nothing I do resolves this issue.
>>>>>>
>>>>>> How can I prevent these AVC errors? Or at least properly modify
my
>>>>>> hosts file (and possibly others) the SELinux way?
>>>>>>
>>>>>> Emmett
>>>>>> --
>>>>>> selinux mailing list
>>>>>> selinux(a)lists.fedoraproject.org
>>>>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>>> What AVC message are you getting?
>>>>>
>>>>> What OS?
>>>>>
>>>>> Regards,
>>>>> Miroslav
>>>>>
>>>> Linux (Fedora 20)
>>>>
>>>> type=AVC msg=audit(1401200342.155:473): avc: denied { read } for
>>>> pid=5501 comm="httpd" name="hosts"
dev="dm-0" ino=270007
>>>> scontext=system_u:system_r:httpd_t:s0-s0:c0.c1023
>>>> tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
>>>>
>>>> AND
>>>>
>>>> type=AVC msg=audit(1401195880.487:401): avc: denied { getattr }
>>>> for pid=1064 comm="chronyd" path="/etc/hosts"
dev="dm-0" ino=270007
>>>> scontext=system_u:system_r:chronyd_t:s0
>>>> tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
>>>>
>>>>
>>>> type=SYSCALL msg=audit(1401195880.487:401): arch=x86_64 syscall=fstat
>>>> success=yes exit=0 a0=4 a1=7fff126bb590 a2=7fff126bb590 a3=0 items=0
>>>> ppid=1 pid=1064 auid=4294967295 uid=997 gid=996 euid=997 suid=997
>>>> fsuid=997 egid=996 sgid=996 fsgid=996 tty=(none) ses=4294967295
>>>> comm=chronyd exe=/usr/sbin/chronyd
>>>> subj=system_u:system_r:chronyd_t:s0 key=(null)
>>>>
>>>> Each of the errors are caused by attempts to access the hosts file.
>>>>
>>>> Emmett
>>>>
>>>> --
>>>> selinux mailing list
>>>> selinux(a)lists.fedoraproject.org
>>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>> "admin_home_t" is label for files/dirs in /root directory. It
means
>>> the /etc/hosts is moved from this directory. Any chance you have a
>>> script which does it?
>>>
>>>
>>> --
>>> selinux mailing list
>>> selinux(a)lists.fedoraproject.org
>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>
Yes, I am using a script to save the current hosts file to /root when starting a VPN
connection, then moving it back when closing the VPN connection. I will add the
restorecon command to the script.
Emmett
--
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
In Rawhide/Fedora 21 and RHEL7 you can just use mv -Z
3619
days inactive
3627
days old
selinux@lists.fedoraproject.org
7 comments
3 participants
participants (3)
-
Daniel J Walsh -
Emmett Culley -
Miroslav Grepl