FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Redhat > Fedora SELinux Support

 
 
LinkBack Thread Tools
 
Old 09-03-2008, 04:56 PM
Daniel J Walsh
 
Default AVC denials when using RH Cluster Suite's qdiskd and ping heuristic

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sean E. Millichamp wrote:
> On Thu, 2008-08-28 at 18:05 -0400, Sean E. Millichamp wrote:
>
>> When I configure a simple ping test with qdisk I get:
>>
>> type=AVC msg=audit(1219960233.627:4561): avc: denied { read write } for pid=23174 comm="ping" path="/dev/sda4" dev=tmpfs ino=1051 scontext=root:system_ring_t:s0 tcontext=system_ubject_
>> r:fixed_disk_device_t:s0 tclass=blk_file
>>
>> type=AVC msg=audit(1219960233.627:4561): avc: denied { read write } for pid=23174 comm="ping" path="/dev/sdb4" dev=tmpfs ino=985 scontext=root:system_ring_t:s0 tcontext=system_ubject_r
>> :fixed_disk_device_t:s0 tclass=blk_file
>>
>> type=SYSCALL msg=audit(1219960233.627:4561): arch=c000003e syscall=59 success=yes exit=0 a0=1f3575a0 a1=1f357610 a2=1f356150 a3=3 items=0 ppid=23163 pid=23174 auid=0 uid=0 gid=0 euid=0 suid=0
>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=189 comm="ping" exe="/bin/ping" subj=root:system_ring_t:s0 key=(null)
>
> These messages are because qdiskd doesn't properly clean up its file
> descriptors before forking and execing ping. I will clean up my
> findings and submit a patch/open a bug report against qdisk.
>
> Thanks,
> Sean
>
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list@redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Great, I was just about to suggest this. Whenever you see something
bizarre like ping trying to read write raw disks, I think of leaked file
descriptors. or redirection of stdout.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAki+waYACgkQrlYvE4MpobNRVQCbB8ZKR7N378 P18cVG6eRHsY3H
lqIAn0SQgiRvz400F0lvYABizPbatDAG
=b8wE
-----END PGP SIGNATURE-----

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 
Old 09-03-2008, 05:00 PM
"Sean E. Millichamp"
 
Default AVC denials when using RH Cluster Suite's qdiskd and ping heuristic

On Wed, 2008-09-03 at 12:56 -0400, Daniel J Walsh wrote:

> Sean E. Millichamp wrote:
> > These messages are because qdiskd doesn't properly clean up its file
> > descriptors before forking and execing ping. I will clean up my
> > findings and submit a patch/open a bug report against qdisk.

> Great, I was just about to suggest this. Whenever you see something
> bizarre like ping trying to read write raw disks, I think of leaked file
> descriptors. or redirection of stdout.

It turns out qdiskd was (is) leaking a number of file descriptors to its
forked heuristics - and not always predictably because of the threading
qdiskd uses. It would have been a very hard bug to spot if not for
SELinux - mark a win for security!

For those interested the qdisk bug report against RHEL 5 (with suggested
patches) is here: https://bugzilla.redhat.com/show_bug.cgi?id=460645

Sean


--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 

Thread Tools




All times are GMT. The time now is 09:36 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org