[policy-1.9-11] ssh-agent takes all the CPU in enforcing mode.

[Aleksey Nogin]

What I see in the logs is

audit(1080124752.283:0): avc:  denied  { write } for  pid=2885 
exe=/usr/bin/ssh-agent path=/home/aleksey/.xsession-errors dev=hda2 
ino=310712 scontext=aleksey:staff_r:staff_ssh_agent_t 
tcontext=aleksey:object_r:staff_home_t tclass=file

and strace shows

getpid()                                = 2886
rt_sigaction(SIGPIPE, {0x1b9cc8, [], SA_RESTORER, 0x137478}, {SIG_IGN}, 
8) = 0
socket(PF_UNIX, SOCK_DGRAM, 0)          = 3
fcntl64(3, F_SETFD, FD_CLOEXEC)         = 0
connect(3, {sa_family=AF_UNIX, path="/dev/log"}, 16) = 0
send(3, "<35>Mar 24 02:48:10 ssh-agent[2886]: error: accept from 
AUTH_SOCKET: Socket operation on non-socket", 99, 0) = 99
rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0
close(3)                                = 0
select(2, [1], [], NULL, NULL)          = 1 (in [1])
accept(1, 0xfeee0800, [110])            = -1 ENOTSOCK (Socket operation 
on non-socket)
time([1080125290])                      = 1080125290
getpid()                                = 2886

going in circles.

-- 
Aleksey Nogin

Home Page: http://nogin.org/
E-Mail: nogin(a)cs.caltech.edu (office), aleksey(a)nogin.org (personal)
Office: Jorgensen 70, tel: [phone]

[Russell Coker]

On Wed, 24 Mar 2004 21:50, Aleksey Nogin <aleksey(a)nogin.org&gt; wrote:
>  What I see in the logs is
>
>  audit(1080124752.283:0): avc:  denied  { write } for  pid=2885
>  exe=/usr/bin/ssh-agent path=/home/aleksey/.xsession-errors dev=hda2
>  ino=310712 scontext=aleksey:staff_r:staff_ssh_agent_t
>  tcontext=aleksey:object_r:staff_home_t tclass=file 
Try using the attached ssh_agent_macros.te.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[Aleksey Nogin]

On 24.03.2004 04:54, Russell Coker wrote:

>  On Wed, 24 Mar 2004 21:50, Aleksey Nogin <aleksey(a)nogin.org&gt;
> wrote:
>  
> >What I see in the logs is
> >
> >audit(1080124752.283:0): avc:  denied  { write } for  pid=2885
> >exe=/usr/bin/ssh-agent path=/home/aleksey/.xsession-errors dev=hda2
> >ino=310712 scontext=aleksey:staff_r:staff_ssh_agent_t
> >tcontext=aleksey:object_r:staff_home_t tclass=file
>  
>  
>  Try using the attached ssh_agent_macros.te.
>   
I added the following two lines to my ssh_agent_macros.te and the 
problem went away, thanks!

>  allow $1_ssh_agent_t { home_root_t $1_home_dir_t }:dir search;
>  allow $1_ssh_agent_t $1_home_t:file { getattr write append }; 
-- 
Aleksey Nogin

Home Page: http://nogin.org/
E-Mail: nogin(a)cs.caltech.edu (office), aleksey(a)nogin.org (personal)
Office: Jorgensen 70, tel: [phone]