FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Redhat > Fedora SELinux Support

 
 
LinkBack Thread Tools
 
Old 01-03-2008, 01:51 PM
"Tom London"
 
Default depmod_t failure again..... sigh

Today's yum update of kernel reports (in targeted/enforcing):

Installing: kernel ####################### [10/60]
WARNING: Couldn't open directory
/tmp/initrd.fu5084/lib/modules/2.6.24-0.133.rc6.git8.fc9: Permission
denied
FATAL: Could not open
/tmp/initrd.fu5084/lib/modules/2.6.24-0.133.rc6.git8.fc9/modules.dep.temp
for writing: Permission denied

Here is the raw AVC:

type=AVC msg=audit(1199371409.130:30): avc: denied { search } for
pid=7185 comm="depmod" name="tmp" dev=dm-0 ino=2686977
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=system_ubject_r:tmp_t:s0 tclass=dir
type=SYSCALL msg=audit(1199371409.130:30): arch=40000003 syscall=5
success=no exit=-13 a0=8941070 a1=98800 a2=2e646f6d a3=8941110 items=0
ppid=4720 pid=7185 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371409.130:31): avc: denied { search } for
pid=7185 comm="depmod" name="tmp" dev=dm-0 ino=2686977
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=system_ubject_r:tmp_t:s0 tclass=dir
type=SYSCALL msg=audit(1199371409.130:31): arch=40000003 syscall=5
success=no exit=-13 a0=bfb012b0 a1=241 a2=1b6 a3=895d480 items=0
ppid=4720 pid=7185 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)

Removing kernel package, and rerunning in permissive mode yields:

type=AVC msg=audit(1199371729.926:38): avc: denied { search } for
pid=10294 comm="depmod" name="tmp" dev=dm-0 ino=2686977
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=system_ubject_r:tmp_t:s0 tclass=dir
type=AVC msg=audit(1199371729.926:38): avc: denied { search } for
pid=10294 comm="depmod" name="initrd.qF8194" dev=dm-0 ino=2687511
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=dir
type=AVC msg=audit(1199371729.926:38): avc: denied { read } for
pid=10294 comm="depmod" name="2.6.24-0.133.rc6.git8.fc9" dev=dm-0
ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=dir
type=SYSCALL msg=audit(1199371729.926:38): arch=40000003 syscall=5
success=yes exit=3 a0=8ac5070 a1=98800 a2=2e646f6d a3=8ac5110 items=0
ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371729.927:39): avc: denied { getattr } for
pid=10294 comm="depmod"
path="/tmp/initrd.qF8194/lib/modules/2.6.24-0.133.rc6.git8.fc9"
dev=dm-0 ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=dir
type=SYSCALL msg=audit(1199371729.927:39): arch=40000003 syscall=197
success=yes exit=0 a0=3 a1=bfd6253c a2=950ff4 a3=3 items=0 ppid=7830
pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371729.927:40): avc: denied { read } for
pid=10294 comm="depmod" name="scsi_mod.ko" dev=dm-0 ino=2687575
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=file
type=SYSCALL msg=audit(1199371729.927:40): arch=40000003 syscall=5
success=yes exit=4 a0=8ae2514 a1=0 a2=1b6 a3=8ae8c20 items=0 ppid=7830
pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371729.927:41): avc: denied { getattr } for
pid=10294 comm="depmod"
path="/tmp/initrd.qF8194/lib/modules/2.6.24-0.133.rc6.git8.fc9/scsi_mod.ko"
dev=dm-0 ino=2687575 scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=file
type=SYSCALL msg=audit(1199371729.927:41): arch=40000003 syscall=197
success=yes exit=0 a0=4 a1=bfd6228c a2=950ff4 a3=8ae8c20 items=0
ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371729.931:42): avc: denied { write } for
pid=10294 comm="depmod" name="2.6.24-0.133.rc6.git8.fc9" dev=dm-0
ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=dir
type=AVC msg=audit(1199371729.931:42): avc: denied { add_name } for
pid=10294 comm="depmod" name="modules.dep.temp"
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=dir
type=AVC msg=audit(1199371729.931:42): avc: denied { create } for
pid=10294 comm="depmod" name="modules.dep.temp"
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=file
type=AVC msg=audit(1199371729.931:42): avc: denied { write } for
pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0 ino=2687612
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=file
type=SYSCALL msg=audit(1199371729.931:42): arch=40000003 syscall=5
success=yes exit=3 a0=bfd62510 a1=241 a2=1b6 a3=8b3b1e0 items=0
ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371729.932:43): avc: denied { remove_name }
for pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0
ino=2687612 scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=dir
type=AVC msg=audit(1199371729.932:43): avc: denied { rename } for
pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0 ino=2687612
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=file
type=SYSCALL msg=audit(1199371729.932:43): arch=40000003 syscall=38
success=yes exit=0 a0=bfd62510 a1=bfd62570 a2=8b3b1e0 a3=bfd62510
items=0 ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)

or
#============= depmod_t ==============
allow depmod_t rpm_script_tmp_t:dir { write search read remove_name
getattr add_name };
allow depmod_t rpm_script_tmp_t:file { read write getattr create rename };
allow depmod_t tmp_t:dir search;


tom
--
Tom London

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 
Old 01-03-2008, 03:18 PM
Eric Paris
 
Default depmod_t failure again..... sigh

Dan knows and he has it fixed on his local system, he will push it
rawhide soonish

-Eric

On Thu, 2008-01-03 at 06:51 -0800, Tom London wrote:
> Today's yum update of kernel reports (in targeted/enforcing):
>
> Installing: kernel ####################### [10/60]
> WARNING: Couldn't open directory
> /tmp/initrd.fu5084/lib/modules/2.6.24-0.133.rc6.git8.fc9: Permission
> denied
> FATAL: Could not open
> /tmp/initrd.fu5084/lib/modules/2.6.24-0.133.rc6.git8.fc9/modules.dep.temp
> for writing: Permission denied
>
> Here is the raw AVC:
>
> type=AVC msg=audit(1199371409.130:30): avc: denied { search } for
> pid=7185 comm="depmod" name="tmp" dev=dm-0 ino=2686977
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=system_ubject_r:tmp_t:s0 tclass=dir
> type=SYSCALL msg=audit(1199371409.130:30): arch=40000003 syscall=5
> success=no exit=-13 a0=8941070 a1=98800 a2=2e646f6d a3=8941110 items=0
> ppid=4720 pid=7185 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
> subj=unconfined_u:system_r:depmod_t:s0 key=(null)
> type=AVC msg=audit(1199371409.130:31): avc: denied { search } for
> pid=7185 comm="depmod" name="tmp" dev=dm-0 ino=2686977
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=system_ubject_r:tmp_t:s0 tclass=dir
> type=SYSCALL msg=audit(1199371409.130:31): arch=40000003 syscall=5
> success=no exit=-13 a0=bfb012b0 a1=241 a2=1b6 a3=895d480 items=0
> ppid=4720 pid=7185 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
> subj=unconfined_u:system_r:depmod_t:s0 key=(null)
>
> Removing kernel package, and rerunning in permissive mode yields:
>
> type=AVC msg=audit(1199371729.926:38): avc: denied { search } for
> pid=10294 comm="depmod" name="tmp" dev=dm-0 ino=2686977
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=system_ubject_r:tmp_t:s0 tclass=dir
> type=AVC msg=audit(1199371729.926:38): avc: denied { search } for
> pid=10294 comm="depmod" name="initrd.qF8194" dev=dm-0 ino=2687511
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=dir
> type=AVC msg=audit(1199371729.926:38): avc: denied { read } for
> pid=10294 comm="depmod" name="2.6.24-0.133.rc6.git8.fc9" dev=dm-0
> ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=dir
> type=SYSCALL msg=audit(1199371729.926:38): arch=40000003 syscall=5
> success=yes exit=3 a0=8ac5070 a1=98800 a2=2e646f6d a3=8ac5110 items=0
> ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
> subj=unconfined_u:system_r:depmod_t:s0 key=(null)
> type=AVC msg=audit(1199371729.927:39): avc: denied { getattr } for
> pid=10294 comm="depmod"
> path="/tmp/initrd.qF8194/lib/modules/2.6.24-0.133.rc6.git8.fc9"
> dev=dm-0 ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=dir
> type=SYSCALL msg=audit(1199371729.927:39): arch=40000003 syscall=197
> success=yes exit=0 a0=3 a1=bfd6253c a2=950ff4 a3=3 items=0 ppid=7830
> pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
> fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
> subj=unconfined_u:system_r:depmod_t:s0 key=(null)
> type=AVC msg=audit(1199371729.927:40): avc: denied { read } for
> pid=10294 comm="depmod" name="scsi_mod.ko" dev=dm-0 ino=2687575
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=file
> type=SYSCALL msg=audit(1199371729.927:40): arch=40000003 syscall=5
> success=yes exit=4 a0=8ae2514 a1=0 a2=1b6 a3=8ae8c20 items=0 ppid=7830
> pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
> fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
> subj=unconfined_u:system_r:depmod_t:s0 key=(null)
> type=AVC msg=audit(1199371729.927:41): avc: denied { getattr } for
> pid=10294 comm="depmod"
> path="/tmp/initrd.qF8194/lib/modules/2.6.24-0.133.rc6.git8.fc9/scsi_mod.ko"
> dev=dm-0 ino=2687575 scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=file
> type=SYSCALL msg=audit(1199371729.927:41): arch=40000003 syscall=197
> success=yes exit=0 a0=4 a1=bfd6228c a2=950ff4 a3=8ae8c20 items=0
> ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
> subj=unconfined_u:system_r:depmod_t:s0 key=(null)
> type=AVC msg=audit(1199371729.931:42): avc: denied { write } for
> pid=10294 comm="depmod" name="2.6.24-0.133.rc6.git8.fc9" dev=dm-0
> ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=dir
> type=AVC msg=audit(1199371729.931:42): avc: denied { add_name } for
> pid=10294 comm="depmod" name="modules.dep.temp"
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=dir
> type=AVC msg=audit(1199371729.931:42): avc: denied { create } for
> pid=10294 comm="depmod" name="modules.dep.temp"
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=file
> type=AVC msg=audit(1199371729.931:42): avc: denied { write } for
> pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0 ino=2687612
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=file
> type=SYSCALL msg=audit(1199371729.931:42): arch=40000003 syscall=5
> success=yes exit=3 a0=bfd62510 a1=241 a2=1b6 a3=8b3b1e0 items=0
> ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
> subj=unconfined_u:system_r:depmod_t:s0 key=(null)
> type=AVC msg=audit(1199371729.932:43): avc: denied { remove_name }
> for pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0
> ino=2687612 scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=dir
> type=AVC msg=audit(1199371729.932:43): avc: denied { rename } for
> pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0 ino=2687612
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_ubject_r:rpm_script_tmp_t:s0 tclass=file
> type=SYSCALL msg=audit(1199371729.932:43): arch=40000003 syscall=38
> success=yes exit=0 a0=bfd62510 a1=bfd62570 a2=8b3b1e0 a3=bfd62510
> items=0 ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
> subj=unconfined_u:system_r:depmod_t:s0 key=(null)
>
> or
> #============= depmod_t ==============
> allow depmod_t rpm_script_tmp_t:dir { write search read remove_name
> getattr add_name };
> allow depmod_t rpm_script_tmp_t:file { read write getattr create rename };
> allow depmod_t tmp_t:dir search;
>
>
> tom

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 

Thread Tools




All times are GMT. The time now is 12:08 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org