FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Redhat > Fedora SELinux Support

 
 
LinkBack Thread Tools
 
Old 01-04-2008, 12:57 AM
Tim Fenn
 
Default sendmail/smrsh f8 avc error

After updating from f7 to f8, it appears smrsh might be mislabelled
(using selinux-policy-3.0.8-72.fc8) - or am I missing something?

type=AVC msg=audit(1199408924.325:1608): avc: denied { getattr } for
pid=10777 comm="sendmail" path="/usr/sbin/smrsh" dev=dm-0 ino=3785966
scontext=system_u:system_r:sendmail_t:s0
tcontext=system_ubject_r:bin_t:s0 tclass=file

type=SYSCALL msg=audit(1199408924.325:1608): arch=c000003e syscall=4
success=no exit=-13 a0=7fff6e1c7d90 a1=7fff6e1c7c70 a2=7fff6e1c7c70
a3=7fff6e1c7d9f items=0 ppid=10776 pid=10777 auid=4294967295 uid=8
gid=12 euid=8 suid=8 fsuid=8 egid=12 sgid=12 fsgid=12 tty=(none)
comm="sendmail" exe="/usr/sbin/sendmail.sendmail"
subj=system_u:system_r:sendmail_t:s0 key=(null)

type=AVC msg=audit(1199408924.333:1609): avc: denied { execute } for
pid=10777 comm="sendmail" name="smrsh" dev=dm-0 ino=3785966
scontext=system_u:system_r:sendmail_t:s0
tcontext=system_ubject_r:bin_t:s0 tclass=file

type=SYSCALL msg=audit(1199408924.333:1609): arch=c000003e syscall=59
success=no exit=-13 a0=2aaaaae7a7a0 a1=7fff6e1c8f00 a2=2aaaaadb4b00
a3=0 items=0 ppid=10776 pid=10777 auid=4294967295 uid=8 gid=12 euid=8
suid=8 fsuid=8 egid=12 sgid=12 fsgid=12 tty=(none) comm="sendmail"
exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:sendmail_t:s0
key=(null)

-Tim

--
CAPS LOCK IS THE CRUISE CONTROL OF AWESOMNESS

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 
Old 01-07-2008, 03:10 PM
Daniel J Walsh
 
Default sendmail/smrsh f8 avc error

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Tim Fenn wrote:
> After updating from f7 to f8, it appears smrsh might be mislabelled
> (using selinux-policy-3.0.8-72.fc8) - or am I missing something?
>
> type=AVC msg=audit(1199408924.325:1608): avc: denied { getattr } for
> pid=10777 comm="sendmail" path="/usr/sbin/smrsh" dev=dm-0 ino=3785966
> scontext=system_u:system_r:sendmail_t:s0
> tcontext=system_ubject_r:bin_t:s0 tclass=file
>
> type=SYSCALL msg=audit(1199408924.325:1608): arch=c000003e syscall=4
> success=no exit=-13 a0=7fff6e1c7d90 a1=7fff6e1c7c70 a2=7fff6e1c7c70
> a3=7fff6e1c7d9f items=0 ppid=10776 pid=10777 auid=4294967295 uid=8
> gid=12 euid=8 suid=8 fsuid=8 egid=12 sgid=12 fsgid=12 tty=(none)
> comm="sendmail" exe="/usr/sbin/sendmail.sendmail"
> subj=system_u:system_r:sendmail_t:s0 key=(null)
>
> type=AVC msg=audit(1199408924.333:1609): avc: denied { execute } for
> pid=10777 comm="sendmail" name="smrsh" dev=dm-0 ino=3785966
> scontext=system_u:system_r:sendmail_t:s0
> tcontext=system_ubject_r:bin_t:s0 tclass=file
>
> type=SYSCALL msg=audit(1199408924.333:1609): arch=c000003e syscall=59
> success=no exit=-13 a0=2aaaaae7a7a0 a1=7fff6e1c8f00 a2=2aaaaadb4b00
> a3=0 items=0 ppid=10776 pid=10777 auid=4294967295 uid=8 gid=12 euid=8
> suid=8 fsuid=8 egid=12 sgid=12 fsgid=12 tty=(none) comm="sendmail"
> exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:sendmail_t:s0
> key=(null)
>
> -Tim
>
Nope should be labeled shell_exec_t. I will update in next release

chcon -t shell_exec_t /usr/sbin/smrsh

Will fix it for now.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkeCTvwACgkQrlYvE4MpobMC5QCgmEZgm6BrY7 17a9V56NGRFAgk
LEAAnibrzoEk3juw6UfOkuTbTC+LaODP
=5fH/
-----END PGP SIGNATURE-----

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 
Old 01-08-2008, 06:05 PM
Tim Fenn
 
Default sendmail/smrsh f8 avc error

On Mon, 07 Jan 2008 11:10:37 -0500 Daniel J Walsh <dwalsh@redhat.com>
wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Tim Fenn wrote:
> > After updating from f7 to f8, it appears smrsh might be mislabelled
> > (using selinux-policy-3.0.8-72.fc8) - or am I missing something?
> >
> > type=AVC msg=audit(1199408924.325:1608): avc: denied { getattr }
> > for pid=10777 comm="sendmail" path="/usr/sbin/smrsh" dev=dm-0
> > ino=3785966 scontext=system_u:system_r:sendmail_t:s0
> > tcontext=system_ubject_r:bin_t:s0 tclass=file
> >
> > type=SYSCALL msg=audit(1199408924.325:1608): arch=c000003e syscall=4
> > success=no exit=-13 a0=7fff6e1c7d90 a1=7fff6e1c7c70 a2=7fff6e1c7c70
> > a3=7fff6e1c7d9f items=0 ppid=10776 pid=10777 auid=4294967295 uid=8
> > gid=12 euid=8 suid=8 fsuid=8 egid=12 sgid=12 fsgid=12 tty=(none)
> > comm="sendmail" exe="/usr/sbin/sendmail.sendmail"
> > subj=system_u:system_r:sendmail_t:s0 key=(null)
> >
> > type=AVC msg=audit(1199408924.333:1609): avc: denied { execute }
> > for pid=10777 comm="sendmail" name="smrsh" dev=dm-0 ino=3785966
> > scontext=system_u:system_r:sendmail_t:s0
> > tcontext=system_ubject_r:bin_t:s0 tclass=file
> >
> > type=SYSCALL msg=audit(1199408924.333:1609): arch=c000003e
> > syscall=59 success=no exit=-13 a0=2aaaaae7a7a0 a1=7fff6e1c8f00
> > a2=2aaaaadb4b00 a3=0 items=0 ppid=10776 pid=10777 auid=4294967295
> > uid=8 gid=12 euid=8 suid=8 fsuid=8 egid=12 sgid=12 fsgid=12
> > tty=(none) comm="sendmail" exe="/usr/sbin/sendmail.sendmail"
> > subj=system_u:system_r:sendmail_t:s0 key=(null)
> >
> > -Tim
> >
> Nope should be labeled shell_exec_t. I will update in next release
>
> chcon -t shell_exec_t /usr/sbin/smrsh
>
> Will fix it for now.

Thanks again, Dan. Also take a look at mailman:

avc: denied { getattr } for comm=smrsh dev=dm-0 egid=12 euid=8
exe=/usr/sbin/smrsh exit=-13 fsgid=12 fsuid=8 gid=12 items=0
path=/usr/lib/mailman/mail/mailman pid=2542
scontext=unconfined_u:system_r:sendmail_t:s0 sgid=12
subj=unconfined_u:system_r:sendmail_t:s0 suid=8 tclass=file
tcontext=system_ubject_r:bin_t:s0 tty=(none) uid=8

Regards,
Tim

--
CAPS LOCK IS THE CRUISE CONTROL OF AWESOMNESS

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 

Thread Tools




All times are GMT. The time now is 09:08 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org