SELinux is preventing sh from getattr access on the file /usr/sbin/ldconfig.

[Ed Greshko]

On 06/28/15 18:04, Daniel J Walsh wrote:
>
> On 06/27/2015 07:01 PM, Ed Greshko wrote:
>> On 06/27/15 21:15, Andras Simon wrote:
>>> 2015-06-27 15:11 GMT+02:00, Andras Simon <szajmi at gmail.com>:
>>>> Should I be worried about the $subject?
>>> And there's also a "SELinux is preventing sh from execute access on
>>> the file /usr/sbin/ldconfig" which I've only just noticed. It sounds
>>> even scarier.
>>>
>> Does your output match these?
>>
>> [egreshko at meimei ~]$ ls -Z /bin/bash
>> system_u:object_r:shell_exec_t:s0 /bin/bash
>>
>> [egreshko at meimei ~]$ ls -Z /usr/sbin/ldconfig
>> system_u:object_r:ldconfig_exec_t:s0 /usr/sbin/ldconfig
>>
> Do you have the avc's?
>
> ausearch -m avc

You know, I never thought to look on my system.  Yes, I do....

[root at meimei ~]# ausearch -m avc
----
time->Sun Jun 21 08:20:44 2015
type=PROCTITLE msg=audit(1434846044.471:29013): proctitle=7368002D63002F7362696E2F6C64636F6E666967202D7020323E2F6465762F6E756C6C
type=SYSCALL msg=audit(1434846044.471:29013): arch=c000003e syscall=4 success=no exit=-13 a0=7efe835bccf0 a1=7fff87180610 a2=7fff87180610 a3=7fff87180600 items=0 ppid=736 pid=737 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" subj=system_u:system_r:firewalld_t:s0 key=(null)
type=AVC msg=audit(1434846044.471:29013): avc:  denied  { getattr } for  pid=737 comm="sh" path="/usr/sbin/ldconfig" dev="sda2" ino=1884883 scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file permissive=0
----
time->Sun Jun 21 08:20:44 2015
type=PROCTITLE msg=audit(1434846044.471:29014): proctitle=7368002D63002F7362696E2F6C64636F6E666967202D7020323E2F6465762F6E756C6C
type=SYSCALL msg=audit(1434846044.471:29014): arch=c000003e syscall=4 success=no exit=-13 a0=7efe835bccf0 a1=7fff871805f0 a2=7fff871805f0 a3=7fff87180600 items=0 ppid=736 pid=737 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" subj=system_u:system_r:firewalld_t:s0 key=(null)
type=AVC msg=audit(1434846044.471:29014): avc:  denied  { getattr } for  pid=737 comm="sh" path="/usr/sbin/ldconfig" dev="sda2" ino=1884883 scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file permissive=0
----
time->Sun Jun 21 08:20:44 2015
type=PROCTITLE msg=audit(1434846044.471:29012): proctitle=7368002D63002F7362696E2F6C64636F6E666967202D7020323E2F6465762F6E756C6C
type=SYSCALL msg=audit(1434846044.471:29012): arch=c000003e syscall=59 success=no exit=-13 a0=7efe835bccf0 a1=7efe835bcdf0 a2=7efe835bbe30 a3=7fff87180600 items=0 ppid=736 pid=737 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" subj=system_u:system_r:firewalld_t:s0 key=(null)
type=AVC msg=audit(1434846044.471:29012): avc:  denied  { execute } for  pid=737 comm="sh" name="ldconfig" dev="sda2" ino=1884883 scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file permissive=0


-- 
Sorta what I want to say when folks habitually complain about Fedora - https://youtu.be/ZArl8fTfub4