While running the 427 kernel in enforcing mode and selinux-policy-strict-1.13.4-5, the following avc denied messages occur from the system cron hourly job:
Jun 13 22:01:00 new2 kernel: audit(1087178460.748:0): avc: denied { read } for pid=3306 exe=/bin/bash name=mtab dev=hda2 ino=869481 scontext=system_u:system_r:crond_t tcontext=system_u:object_r:etc_runtime_t tclass=file Jun 13 22:01:00 new2 kernel: audit(1087178460.748:0): avc: denied { getattr } for pid=3306 exe=/bin/bash path=/proc/meminfo dev=proc ino=-268435454 scontext=system_u:system_r:crond_t tcontext=system_u:object_r:proc_t tclass=file Jun 13 22:01:00 new2 kernel: audit(1087178460.792:0): avc: denied { getattr } for pid=3306 exe=/bin/bash path=/usr/bin/run-parts dev=hda2 ino=55784 scontext=system_u:system_r:crond_t tcontext=system_u:object_r:bin_t tclass=file
HTH Richard Hally
On Mon, 14 Jun 2004 16:01, Richard Hally rhallyx@mindspring.com wrote:
Jun 13 22:01:00 new2 kernel: audit(1087178460.748:0): avc: denied { read } for pid=3306 exe=/bin/bash name=mtab dev=hda2 ino=869481 scontext=system_u:system_r:crond_t tcontext=system_u:object_r:etc_runtime_t tclass=file Jun 13 22:01:00 new2 kernel: audit(1087178460.748:0): avc: denied { getattr } for pid=3306 exe=/bin/bash path=/proc/meminfo dev=proc ino=-268435454 scontext=system_u:system_r:crond_t tcontext=system_u:object_r:proc_t tclass=file Jun 13 22:01:00 new2 kernel: audit(1087178460.792:0): avc: denied { getattr } for pid=3306 exe=/bin/bash path=/usr/bin/run-parts dev=hda2 ino=55784 scontext=system_u:system_r:crond_t tcontext=system_u:object_r:bin_t tclass=file
Do any other cron jobs execute correctly?
I don't think that in the normal operation of the system there should be a bash script launched in the crond_t domain which tries to run run-parts. I think that your crond is acting as if it does not support SE Linux.
What version of libselinux do you have installed? Maybe there is a bug in libselinux which made cron misbehave.
Russell Coker wrote:
On Mon, 14 Jun 2004 16:01, Richard Hally rhallyx@mindspring.com wrote:
Jun 13 22:01:00 new2 kernel: audit(1087178460.748:0): avc: denied { read } for pid=3306 exe=/bin/bash name=mtab dev=hda2 ino=869481 scontext=system_u:system_r:crond_t tcontext=system_u:object_r:etc_runtime_t tclass=file Jun 13 22:01:00 new2 kernel: audit(1087178460.748:0): avc: denied { getattr } for pid=3306 exe=/bin/bash path=/proc/meminfo dev=proc ino=-268435454 scontext=system_u:system_r:crond_t tcontext=system_u:object_r:proc_t tclass=file Jun 13 22:01:00 new2 kernel: audit(1087178460.792:0): avc: denied { getattr } for pid=3306 exe=/bin/bash path=/usr/bin/run-parts dev=hda2 ino=55784 scontext=system_u:system_r:crond_t tcontext=system_u:object_r:bin_t tclass=file
Do any other cron jobs execute correctly?
No, I get errors from other system cron jobs as well. I don't run any user cron jobs. Cron works correctly in permissive mode.
I don't think that in the normal operation of the system there should be a bash script launched in the crond_t domain which tries to run run-parts. I think that your crond is acting as if it does not support SE Linux.
What version of libselinux do you have installed? Maybe there is a bug in libselinux which made cron misbehave.
I have vixie-cron-3.0.1-89 and libselinux-1.13.3-2
here are a couple of the mail(1) messages root gets: Message 1: From root@localhost.localdomain Mon Jun 14 05:01:00 2004 Date: Mon, 14 Jun 2004 05:01:00 -0400 From: root@localhost.localdomain (Cron Daemon) To: root@localhost.localdomain Subject: Cron root@new2 run-parts /etc/cron.hourly X-Cron-Env: <SHELL=/bin/bash> X-Cron-Env: <PATH=/sbin:/bin:/usr/sbin:/usr/bin> X-Cron-Env: <MAILTO=root> X-Cron-Env: <HOME=/> X-Cron-Env: <LOGNAME=root>
/bin/bash: line 1: run-parts: command not found
Message 4: From mailman@localhost.localdomain Mon Jun 14 08:00:01 2004 Date: Mon, 14 Jun 2004 08:00:01 -0400 From: root@localhost.localdomain (Cron Daemon) To: mailman@localhost.localdomain Subject: Cron mailman@new2 /usr/bin/python -S /var/mailman/cron/checkdbs X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/var/mailman> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=mailman>
/bin/sh: line 1: /usr/bin/python: Permission denied
&
Richard Hally
selinux@lists.fedoraproject.org