denying despite allow rule

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/10/2011 04:21 PM, Maria Iano wrote:
> selinux is denying an action that seems to be allowed in the policy.  
> Any ideas on why this would be? I want to fix this with a local  
> policy, but audit2allow just tells me to add the same allow rule that  
> is already present according to sesearch.
> 
> Here are the audit messages:
> 
> host=eng-vocngcn03.eng.gci type=AVC msg=audit(1299790809.242:685639):  
> avc: denied { rename } for pid=21701 comm="vsftpd"  
> name=".local-110585184.jpg.3836" dev=dm-22 ino=13467775  
> scontext=system_u:system_r:ftpd_t:s0  
> tcontext=system_u:object_r:samba_share_t:s0 tclass=file
> 
> host=eng-vocngcn03.eng.gci type=SYSCALL  
> msg=audit(1299790809.242:685639): arch=c000003e syscall=82 success=no  
> exit=-13 a0=2aca78d2c2a0 a1=2aca78d2c300 a2=1 a3=312d6c61636f6c2f  
> items=0 ppid=21697 pid=21701 auid=4294967295 uid=14 gid=100 euid=14  
> suid=14 fsuid=14 egid=100 sgid=100 fsgid=100 tty=(none) ses=4294967295  
> comm="vsftpd" exe="/usr/sbin/vsftpd" subj=system_u:system_r:ftpd_t:s0  
> key=(null)
> 
> Based on the AVC message I put together and sesearch command below,  
> and it shows that there is an allow rule:
> 
> #sesearch -a -t samba_share_t -s ftpd_t -c file -p rename
> Found 1 av rules:
>     allow ftpd_t samba_share_t : file { ioctl read write create  
> getattr setattr lock append unlink link rename };
> 
> Thanks,
> Maria
> --
> selinux mailing list
> selinux at lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
> 
> 
Run the AVC though audit2why
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk15QiQACgkQrlYvE4MpobOaiACeJXa7z4KIRdBpPTC82ZyJtUKl
/eYAnjyb6OpZ2Nia6wAlRkQsk8NMQS6E
=+1zP
-----END PGP SIGNATURE-----