Syslog and Selinux

[Bob Chiodini]

Good Morning,

I have not seen anything logged to the syslog (/var/log/messages) since
the 24th.  I did not see anything searching the archives, but the search
might not be working.

 The following error appears trying to start syslogd:

Starting system logger: syslogd: error while loading shared libraries:
libc.so.6: failed to map segment from shared object: Permission denied

at the console:

 audit(1093612883.714:0): avc:  denied  { execute } for  pid=35
82 path=/lib/tls/libc-2.3.3.so dev=hda2 ino=3993575 scontext=root:system_r:syslo
gd_t tcontext=root:object_r:lib_t tclass=file
audit(1093612883.718:0): avc:  denied  { execute } for  pid=3583 path=/lib/tls/l
ibc-2.3.3.so dev=hda2 ino=3993575 scontext=root:system_r:syslogd_t tcontext=root
:object_r:lib_t tclass=file
audit(1093612883.723:0): avc:  denied  { execute } for  pid=3585 path=/lib/tls/l
ibc-2.3.3.so dev=hda2 ino=3993575 scontext=root:system_r:syslogd_t tcontext=root
:object_r:lib_t tclass=file

FYI:  Pid 35 is pdflush

I also noticed that portmapper gets a similar error:

Starting portmap: portmap: error while loading shared libraries:
libnsl.so.1: failed to map segment from shared object: Permission denied

at the console:

service portmap restart
Stopping portmap: audit(1093613082.145:0): avc:  denied  { execute } for  pid=36
11 path=/lib/tls/libc-2.3.3.so dev=hda2 ino=3993575 scontext=root:system_r:syslo
gd_t tcontext=root:object_r:lib_t tclass=file
                                                           [FAILED]
Starting portmap: audit(1093613082.155:0): avc:  denied  { read write } for  pid
=3615 exe=/sbin/portmap path=/dev/tty1 dev=hda2 ino=4115095 scontext=root:system
_r:portmap_t tcontext=root:object_r:tty_device_t tclass=chr_file
audit(1093613082.155:0): avc:  denied  { execute } for  pid=3615 path=/lib/libns
l-2.3.3.so dev=hda2 ino=3993654 scontext=root:system_r:portmap_t tcontext=root:o
bject_r:lib_t tclass=file
audit(1093613082.159:0): avc:  denied  { execute } for  pid=3616 path=/lib/tls/l
ibc-2.3.3.so dev=hda2 ino=3993575 scontext=root:system_r:syslogd_t tcontext=root
:object_r:lib_t tclass=file
portmap: error while loading shared libraries: libnsl.so.1: failed to map segmen
t from shared object: Permission denied
audit(1093613082.163:0): avc:  denied  { execute } for  pid=3618 path=/lib/tls/l
ibc-2.3.3.so dev=hda2 ino=3993575 scontext=root:system_r:syslogd_t tcontext=root
:object_r:lib_t tclass=file
                                                           [FAILED]
In this instance pid 36 is pdflush.

Any help would be appreciated.

Bob...

[Steve G]

>  The following error appears trying to start syslogd: 
Out of curiosity, what selinux-policy are you using and version?

-Steve Grubb



		
_______________________________
Do you Yahoo!?
Win 1 of 4,000 free domain names from Yahoo! Enter now.
http://promotions.yahoo.com/goldrush

[Daniel J Walsh]

Bob Chiodini wrote:

> Good Morning,
>
> I have not seen anything logged to the syslog (/var/log/messages) since
> the 24th.  I did not see anything searching the archives, but the search
> might not be working.
>
>  The following error appears trying to start syslogd:
>
> Starting system logger: syslogd: error while loading shared libraries:
> libc.so.6: failed to map segment from shared object: Permission denied
>
> at the console:
>
>  audit(1093612883.714:0): avc:  denied  { execute } for  pid=35
> 82 path=/lib/tls/libc-2.3.3.so dev=hda2 ino=3993575 scontext=root:system_r:syslo
> gd_t tcontext=root:object_r:lib_t tclass=file
> audit(1093612883.718:0): avc:  denied  { execute } for  pid=3583 path=/lib/tls/l
> ibc-2.3.3.so dev=hda2 ino=3993575 scontext=root:system_r:syslogd_t tcontext=root
> :object_r:lib_t tclass=file
> audit(1093612883.723:0): avc:  denied  { execute } for  pid=3585 path=/lib/tls/l
> ibc-2.3.3.so dev=hda2 ino=3993575 scontext=root:system_r:syslogd_t tcontext=root
> :object_r:lib_t tclass=file
>
> FYI:  Pid 35 is pdflush
>
> I also noticed that portmapper gets a similar error:
>
> Starting portmap: portmap: error while loading shared libraries:
> libnsl.so.1: failed to map segment from shared object: Permission denied
>
> at the console:
>
> service portmap restart
> Stopping portmap: audit(1093613082.145:0): avc:  denied  { execute } for  pid=36
> 11 path=/lib/tls/libc-2.3.3.so dev=hda2 ino=3993575 scontext=root:system_r:syslo
> gd_t tcontext=root:object_r:lib_t tclass=file
>                                                            [FAILED]
> Starting portmap: audit(1093613082.155:0): avc:  denied  { read write } for  pid
> =3615 exe=/sbin/portmap path=/dev/tty1 dev=hda2 ino=4115095 scontext=root:system
> _r:portmap_t tcontext=root:object_r:tty_device_t tclass=chr_file
> audit(1093613082.155:0): avc:  denied  { execute } for  pid=3615 path=/lib/libns
> l-2.3.3.so dev=hda2 ino=3993654 scontext=root:system_r:portmap_t tcontext=root:o
> bject_r:lib_t tclass=file
> audit(1093613082.159:0): avc:  denied  { execute } for  pid=3616 path=/lib/tls/l
> ibc-2.3.3.so dev=hda2 ino=3993575 scontext=root:system_r:syslogd_t tcontext=root
> :object_r:lib_t tclass=file
> portmap: error while loading shared libraries: libnsl.so.1: failed to map segmen
> t from shared object: Permission denied
> audit(1093613082.163:0): avc:  denied  { execute } for  pid=3618 path=/lib/tls/l
> ibc-2.3.3.so dev=hda2 ino=3993575 scontext=root:system_r:syslogd_t tcontext=root
> :object_r:lib_t tclass=file
>                                                            [FAILED]
> In this instance pid 36 is pdflush.
>
> Any help would be appreciated.
>
> Bob...
>   
>  
restorecon /lib/tls/libc-2.3.3.so

will fix it, but how did the file get their with the wrong security context?

Dan

[Bob Chiodini]

On Fri, 2004-08-27 at 09:46, Daniel J Walsh wrote:
>  >  
>  >
>  restorecon /lib/tls/libc-2.3.3.so
>  
>  will fix it, but how did the file get their with the wrong security context?
>  
>  Dan 
On Fri, 2004-08-27 at 09:41, Steve G wrote: 
>  > The following error appears trying to start syslogd:
>  
>  Out of curiosity, what selinux-policy are you using and version?
>  
>  -Steve Grubb
>   
Dan,

Unknown.  I have been applying the updates daily (yum) from:

http://mirror.hiwaay.net/redhat/fedora/linux/core/development/i386/

and have not reconfigured anything in the selinux world.

Steve,

From rpm -qa | grep -i selinux:

selinux-policy-strict-1.17.4-2
libselinux-devel-1.17.1-1
selinux-doc-1.14.1-1
selinux-policy-targeted-sources-1.17.4-2
selinux-policy-strict-sources-1.17.4-2
selinux-policy-targeted-1.17.4-2
libselinux-1.17.1-1

kernel is 2.6.8-1.526.

cat /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#       enforcing - SELinux security policy is enforced.
#       permissive - SELinux prints warnings instead of enforcing.
#       disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= type of policy in use. Possible values are:
#       targeted - Only targeted network daemons are protected.
#       strict - Full SELinux protection.
SELINUXTYPE=targeted

I ran restorecon on /lib/tls/libc-2.3.3.so, /lib/libnsl-2.3.3.so, and
/lib/libnss_files-2.3.3.so as they were all referenced starting syslogd
and portmap.  No errors starting the two services afterward.

Bob...

[Stephen Smalley]

On Fri, 2004-08-27 at 09:46, Daniel J Walsh wrote:
>  restorecon /lib/tls/libc-2.3.3.so
>  
>  will fix it, but how did the file get their with the wrong security context? 
Most likely explanation is that at some point where the targeted
file_contexts file was broken due to an undefined type, he did an update
that updated those files.  In that case, rpm proceeds with the install
but doesn't know what to label the files, so they fall back into the
default type, I think.  Colin's patch to have setfiles revalidate the
file contexts when the policy is rebuilt should avoid future
occurrences.  Another good idea would be to change matchpathcon_init and
rpm to just skip invalid entries with a warning, but still try to match,
as the invalid entries typically only affect a few specific files.


-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency