setrans_t *:dir search .....

[Tom London]

Running latest rawhide, targeted/enforcing.

mctransd wants to access the 'processID' directories in /proc, and
this is failing, e.g.:

type=AVC msg=audit(1158434177.034:15): avc:  denied  { search } for
pid=1914 comm="mcstransd" name="2348" dev=proc ino=153878530
scontext=system_u:system_r:setrans_t:s0
tcontext=system_u:system_r:crond_t:s0-s0:c0.c255 tclass=dir
type=SYSCALL msg=audit(1158434177.034:15): arch=40000003 syscall=5
success=no exit=-13 a0=9828568 a1=8000 a2=0 a3=8000 items=0 ppid=1
pid=1914 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="mcstransd" exe="/sbin/mcstransd"
subj=system_u:system_r:setrans_t:s0 key=(null)
type=AVC msg=audit(1158434177.038:16): avc:  denied  { search } for
pid=1914 comm="mcstransd" name="2348" dev=proc ino=153878530
scontext=system_u:system_r:setrans_t:s0
tcontext=system_u:system_r:crond_t:s0-s0:c0.c255 tclass=dir
type=SYSCALL msg=audit(1158434177.038:16): arch=40000003 syscall=5
success=no exit=-13 a0=9828678 a1=8000 a2=0 a3=8000 items=0 ppid=1
pid=1914 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="mcstransd" exe="/sbin/mcstransd"
subj=system_u:system_r:setrans_t:s0 key=(null)

Seems to be failing for crond_t, cupd_t, udev_t, xdm_t

Also, 'ls -ldZ /proc/2348' fails in enforcing mode now:
[root@localhost proc]# ls -ldZ 2348
ls: 2348: Permission denied
[root@localhost proc]# getenforce
Enforcing
[root@localhost proc]# setenforce 0
[root@localhost proc]#
[root@localhost proc]# ls -ldZ 2348
dr-xr-xr-x  root root system_u:system_r:crond_t:SystemLow-SystemHigh 2348
[root@localhost proc]#
[root@localhost proc]# setenforce 1
[root@localhost proc]#


tom
-- 
Tom London

[Daniel J Walsh]

Tom London wrote:
>  Running latest rawhide, targeted/enforcing.
>
>  mctransd wants to access the 'processID' directories in /proc, and
>  this is failing, e.g.:
>
>  type=AVC msg=audit(1158434177.034:15): avc:  denied  { search } for
>  pid=1914 comm="mcstransd" name="2348" dev=proc ino=153878530
>  scontext=system_u:system_r:setrans_t:s0
>  tcontext=system_u:system_r:crond_t:s0-s0:c0.c255 tclass=dir
>  type=SYSCALL msg=audit(1158434177.034:15): arch=40000003 syscall=5
>  success=no exit=-13 a0=9828568 a1=8000 a2=0 a3=8000 items=0 ppid=1
>  pid=1914 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
>  sgid=0 fsgid=0 tty=(none) comm="mcstransd" exe="/sbin/mcstransd"
>  subj=system_u:system_r:setrans_t:s0 key=(null)
>  type=AVC msg=audit(1158434177.038:16): avc:  denied  { search } for
>  pid=1914 comm="mcstransd" name="2348" dev=proc ino=153878530
>  scontext=system_u:system_r:setrans_t:s0
>  tcontext=system_u:system_r:crond_t:s0-s0:c0.c255 tclass=dir
>  type=SYSCALL msg=audit(1158434177.038:16): arch=40000003 syscall=5
>  success=no exit=-13 a0=9828678 a1=8000 a2=0 a3=8000 items=0 ppid=1
>  pid=1914 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
>  sgid=0 fsgid=0 tty=(none) comm="mcstransd" exe="/sbin/mcstransd"
>  subj=system_u:system_r:setrans_t:s0 key=(null)
>
>  Seems to be failing for crond_t, cupd_t, udev_t, xdm_t
>
>  Also, 'ls -ldZ /proc/2348' fails in enforcing mode now:
>  [root@localhost proc]# ls -ldZ 2348
>  ls: 2348: Permission denied
>  [root@localhost proc]# getenforce
>  Enforcing
>  [root@localhost proc]# setenforce 0
>  [root@localhost proc]#
>  [root@localhost proc]# ls -ldZ 2348
>  dr-xr-xr-x  root root system_u:system_r:crond_t:SystemLow-SystemHigh 2348
>  [root@localhost proc]#
>  [root@localhost proc]# setenforce 1
>  [root@localhost proc]#
>
>
>  tom 
Fixed in latest policy.  2.3.14-3
I wonder why these just started showing up.  Problem should have been 
there all along.