Latest selinux update & ping

[Stephen Smalley]

On Wed, 2007-04-11 at 20:53 +0300, Jouni Viikari wrote:
> Hi,
> 
> After the latest selinux updates I get a lot of these messages at my
> log:
> 
> SELinux is preventing /bin/ping (ping_t) "search" to locale (locale_t)
> 
> or audit log:
> 
> denied  { search } for  pid=16255 comm="ping" name="locale" dev=dm-0
> ino=3113039 scontext=system_u:system_r:ping_t:s0
> tcontext=system_u:object_r:locale_t:s0 tclass=dir
> 
> 
> type=SYSCALL msg=audit(1176300990.257:65255): arch=40000003 syscall=5
> success=no exit=-13 a0=bf91d6e0 a1=0 a2=1b6 a3=8816018 items=0
> ppid=18973 pid=18974 auid=4294967295 uid=507 gid=507 euid=0 suid
> =0 fsuid=0 egid=507 sgid=507 fsgid=507 tty=(none) comm="ping"
> exe="/bin/ping" subj=system_u:system_r:ping_t:s0 key=(null)
> type=AVC msg=audit(1176300990.257:65256): avc:  denied  { search } for
> pid=18974 comm="ping" name="locale" dev=dm-0 ino=3113039
> scontext=system_u:system_r:ping_t:s0 tcontext=system_u:object_r:loca
> le_t:s0 tclass=dir
> 
> The last line repeats itself many times.
> 
> The pings are run by Big Brother which as a one task pings my network to
> see all is up.
> 
> Is this a local problem here, selinux problem or ping problem?

I'd say it is a selinux policy problem (should allow ping to read locale
data).  You can work around it by creating a local policy module with
audit2allow and installing it via semodule until it is fixed in the
policy.  Not sure why it would only show up after an update.

-- 
Stephen Smalley
National Security Agency