cupsd accessing afick.log clamd.log freshclam.log

[Vikram Goyal]

Hello,

I am getting these avc denied messages. I am not sure if these should be
incorporated in local policy.

type=AVC msg=audit(1159051843.723:565): avc:  denied  { read write } for
pid=14645 comm="cupsd" name="afick.log" dev=sda12 ino=643989
scontext=user_u:system_r:cupsd_t:s0-s0:c0.c255
tcontext=system_u:object_r:var_log_t:s0 tclass=file

type=AVC msg=audit(1159051843.723:565): avc:  denied  { read write } for
pid=14645 comm="cupsd" name="clamd.log" dev=sda12 ino=643867
scontext=user_u:system_r:cupsd_t:s0-s0:c0.c255
tcontext=root:object_r:clamd_var_log_t:s0 tclass=file

type=AVC msg=audit(1159051843.723:565): avc:  denied  { read write } for
pid=14645 comm="cupsd" name="freshclam.log" dev=sda12 ino=643915
scontext=user_u:system_r:cupsd_t:s0-s0:c0.c255
tcontext=root:object_r:var_log_t:s0 tclass=file


audit2allow produces - 
allow cupsd_t clamd_var_log_t:file { read write };
allow cupsd_t var_log_t:file { read write };


The installed versions are:
cups-1.2.3-1.6
clamav-0.88.4-21.fc5.at
afick-2.2-2.2.fc5.rf

Thanks!
-- 
vikram...
         ||||||||
         ||||||||
^^'''''^^||root||^^^'''''''^^
        // \\   ))
       //(( \\// \\
      // /\\ ||   \\
     || / )) ((    \\
-- 
If in any problem you find yourself doing an immense amount of work, the
answer can be obtained by simple inspection.
-- 
~|~
 =
Registered Linux User #285795

[Tim Waugh]

On Sun, 2006-09-24 at 13:41 +0530, Vikram Goyal wrote:
>  I am getting these avc denied messages. I am not sure if these should
> be
>  incorporated in local policy. 
cupsd shouldn't be trying to read these at all, let alone write to them.
Do you get these avc messages every time you start CUPS?

Tim.
*/

[Daniel J Walsh]

Vikram Goyal wrote:
>  Hello,
>
>  I am getting these avc denied messages. I am not sure if these should be
>  incorporated in local policy.
>
>  type=AVC msg=audit(1159051843.723:565): avc:  denied  { read write } for
>  pid=14645 comm="cupsd" name="afick.log" dev=sda12 ino=643989
>  scontext=user_u:system_r:cupsd_t:s0-s0:c0.c255
>  tcontext=system_u:object_r:var_log_t:s0 tclass=file
>
>  type=AVC msg=audit(1159051843.723:565): avc:  denied  { read write } for
>  pid=14645 comm="cupsd" name="clamd.log" dev=sda12 ino=643867
>  scontext=user_u:system_r:cupsd_t:s0-s0:c0.c255
>  tcontext=root:object_r:clamd_var_log_t:s0 tclass=file
>
>  type=AVC msg=audit(1159051843.723:565): avc:  denied  { read write } for
>  pid=14645 comm="cupsd" name="freshclam.log" dev=sda12 ino=643915
>  scontext=user_u:system_r:cupsd_t:s0-s0:c0.c255
>  tcontext=root:object_r:var_log_t:s0 tclass=file
>
>
>  audit2allow produces - 
>  allow cupsd_t clamd_var_log_t:file { read write };
>  allow cupsd_t var_log_t:file { read write };
>
>     
These look like leaked file descriptor.  Most likely logrotate.  Since 
logrotate probably opens these files for r/w and it restarts cups.

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=205072
>  The installed versions are:
>  cups-1.2.3-1.6
>  clamav-0.88.4-21.fc5.at
>  afick-2.2-2.2.fc5.rf
>
>  Thanks!
>

[Vikram Goyal]

On Mon, Sep 25, 2006 at 11:02:50AM -0400, Daniel J Walsh wrote:
>  >  
>  These look like leaked file descriptor.  Most likely logrotate.  Since 
>  logrotate probably opens these files for r/w and it restarts cups.
>  
>  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=205072
>  >The installed versions are:
>  >cups-1.2.3-1.6
>  >clamav-0.88.4-21.fc5.at
>  >afick-2.2-2.2.fc5.rf
>  >
>  >Thanks!
>  >   
Yes, These avc's do not show at startup but afterwards, most probably
after cron.daily has gome through it's routine, but I'm not sure.

By the way I forgot to post selinux packs installed. They are:

selinux-policy-targeted-2.3.7-2.fc5
selinux-policy-2.3.7-2.fc5

Thanks!
-- 
vikram...
         ||||||||
         ||||||||
^^'''''^^||root||^^^'''''''^^
        // \\   ))
       //(( \\// \\
      // /\\ ||   \\
     || / )) ((    \\
-- 
A university faculty is 500 egotists with a common parking problem.
-- 
 _
~|~
 =
Registered Linux User #285795