Linux Archive

Linux Archive (http://www.linux-archive.org/)
-   Fedora SELinux Support (http://www.linux-archive.org/fedora-selinux-support/)
-   -   Removefix old avc's (http://www.linux-archive.org/fedora-selinux-support/597372-removefix-old-avcs.html)

Frank Murphy 11-12-2011 05:08 AM
Removefix old avc's
 
on an F16 box, sealert is empty.

but:
~$ ausearch -m avc
----
time->Sat Oct 29 15:27:51 2011
type=SYSCALL msg=audit(1319898471.737:80): arch=c000003e syscall=137
success=no exit=-13 a0=7f725ff344ae a1=7fff730a6850 a2=1000
a3=7fff730a65e0 items=0 ppid=3424 pid=3435 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="restorecon" exe="/sbin/setfiles"
subj=system_u:system_r:setfiles_t:s0 key=(null)
type=AVC msg=audit(1319898471.737:80): avc: denied { getattr } for
pid=3435 comm="restorecon" name="/" dev=sysfs ino=1
scontext=system_u:system_r:setfiles_t:s0
tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem
----
time->Sat Oct 29 15:27:51 2011
type=SYSCALL msg=audit(1319898471.902:81): arch=c000003e syscall=137
success=no exit=-13 a0=7ffdb5d014ae a1=7fff2da8f300 a2=1000 a3=0 items=0
ppid=3436 pid=3437 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd"
exe="/usr/bin/python"
subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1319898471.902:81): avc: denied { getattr } for
pid=3437 comm="setroubleshootd" name="/" dev=sysfs ino=1
scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem
----
time->Sat Oct 29 15:30:43 2011
type=SYSCALL msg=audit(1319898643.744:84): arch=c000003e syscall=137
success=no exit=-13 a0=7fc6a4f444ae a1=7fffc431d1c0 a2=1000 a3=0 items=0
ppid=3728 pid=3729 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd"
exe="/usr/bin/python"
subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1319898643.744:84): avc: denied { getattr } for
pid=3729 comm="setroubleshootd" name="/" dev=sysfs ino=1
scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem
----
time->Sat Oct 29 15:30:43 2011
type=SYSCALL msg=audit(1319898643.650:83): arch=c000003e syscall=137
success=no exit=-13 a0=7fd65c6754ae a1=7fff4322e2c0 a2=1000
a3=7fff4322e050 items=0 ppid=1393 pid=3727 auid=4294967295 uid=93 gid=93
euid=0 suid=0 fsuid=0 egid=93 sgid=93 fsgid=93 tty=(none) ses=4294967295
comm="exim" exe="/usr/sbin/exim" subj=system_u:system_r:exim_t:s0 key=(null)
type=AVC msg=audit(1319898643.650:83): avc: denied { getattr } for
pid=3727 comm="exim" name="/" dev=sysfs ino=1
scontext=system_u:system_r:exim_t:s0
tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem

This box was upgraded from F15,
so what do I need do about these avcs'
and why they don't show up in sealert.

Currently
selinux-policy-targeted-3.10.0-51.fc16

there seems to be an upgrade available:
selinux-policy-targeted-3.10.0-55.fc16

will it make any difference to above?

--
Regards,

Frank Murphy
UTF_8 Encoded
Friend of fedoraproject.org
--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux

Thomas Cameron 11-12-2011 09:04 PM
Removefix old avc's
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/12/2011 12:08 AM, Frank Murphy wrote:
> on an F16 box, sealert is empty.
>
> but:
> ~$ ausearch -m avc
> ----
> time->Sat Oct 29 15:27:51 2011
> type=SYSCALL msg=audit(1319898471.737:80): arch=c000003e syscall=137
> success=no exit=-13 a0=7f725ff344ae a1=7fff730a6850 a2=1000
> a3=7fff730a65e0 items=0 ppid=3424 pid=3435 auid=4294967295 uid=0 gid=0
> euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
> comm="restorecon" exe="/sbin/setfiles"
> subj=system_u:system_r:setfiles_t:s0 key=(null)
> type=AVC msg=audit(1319898471.737:80): avc: denied { getattr } for
> pid=3435 comm="restorecon" name="/" dev=sysfs ino=1
> scontext=system_u:system_r:setfiles_t:s0
> tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem
> ----
> time->Sat Oct 29 15:27:51 2011
> type=SYSCALL msg=audit(1319898471.902:81): arch=c000003e syscall=137
> success=no exit=-13 a0=7ffdb5d014ae a1=7fff2da8f300 a2=1000 a3=0 items=0
> ppid=3436 pid=3437 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd"
> exe="/usr/bin/python"
> subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)
> type=AVC msg=audit(1319898471.902:81): avc: denied { getattr } for
> pid=3437 comm="setroubleshootd" name="/" dev=sysfs ino=1
> scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023
> tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem
> ----
> time->Sat Oct 29 15:30:43 2011
> type=SYSCALL msg=audit(1319898643.744:84): arch=c000003e syscall=137
> success=no exit=-13 a0=7fc6a4f444ae a1=7fffc431d1c0 a2=1000 a3=0 items=0
> ppid=3728 pid=3729 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd"
> exe="/usr/bin/python"
> subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)
> type=AVC msg=audit(1319898643.744:84): avc: denied { getattr } for
> pid=3729 comm="setroubleshootd" name="/" dev=sysfs ino=1
> scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023
> tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem
> ----
> time->Sat Oct 29 15:30:43 2011
> type=SYSCALL msg=audit(1319898643.650:83): arch=c000003e syscall=137
> success=no exit=-13 a0=7fd65c6754ae a1=7fff4322e2c0 a2=1000
> a3=7fff4322e050 items=0 ppid=1393 pid=3727 auid=4294967295 uid=93 gid=93
> euid=0 suid=0 fsuid=0 egid=93 sgid=93 fsgid=93 tty=(none) ses=4294967295
> comm="exim" exe="/usr/sbin/exim" subj=system_u:system_r:exim_t:s0 key=(null)
> type=AVC msg=audit(1319898643.650:83): avc: denied { getattr } for
> pid=3727 comm="exim" name="/" dev=sysfs ino=1
> scontext=system_u:system_r:exim_t:s0
> tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem
>
> This box was upgraded from F15,
> so what do I need do about these avcs'
> and why they don't show up in sealert.
>
> Currently
> selinux-policy-targeted-3.10.0-51.fc16
>
> there seems to be an upgrade available:
> selinux-policy-targeted-3.10.0-55.fc16
>
> will it make any difference to above?
>

It's almost never a bad idea to update to the latest packages, but I
don't think it will "fix" this issue.

These are just old entries in /var/log/audit/audit.log. You can safely
ignore them or just move the old log files off somewhere else. If *new*
alerts come up, then take appropriate action.

Make sense?

Thomas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Red Hat - http://enigmail.mozdev.org/

iEYEARECAAYFAk6+7VQACgkQmzle50YHwaADDgCffT71rohBvm GIcyo/yIAaKunw
efkAnRPyeiwt1sofIEW0qlp73oZDM5iK
=BVt9
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux

Daniel J Walsh 11-14-2011 06:08 PM
Removefix old avc's
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/12/2011 01:08 AM, Frank Murphy wrote:
> on an F16 box, sealert is empty.
>
> but: ~$ ausearch -m avc ---- time->Sat Oct 29 15:27:51 2011
> type=SYSCALL msg=audit(1319898471.737:80): arch=c000003e
> syscall=137 success=no exit=-13 a0=7f725ff344ae a1=7fff730a6850
> a2=1000 a3=7fff730a65e0 items=0 ppid=3424 pid=3435 auid=4294967295
> uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
> ses=4294967295 comm="restorecon" exe="/sbin/setfiles"
> subj=system_u:system_r:setfiles_t:s0 key=(null) type=AVC
> msg=audit(1319898471.737:80): avc: denied { getattr } for
> pid=3435 comm="restorecon" name="/" dev=sysfs ino=1
> scontext=system_u:system_r:setfiles_t:s0
> tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem ----
> time->Sat Oct 29 15:27:51 2011 type=SYSCALL
> msg=audit(1319898471.902:81): arch=c000003e syscall=137 success=no
> exit=-13 a0=7ffdb5d014ae a1=7fff2da8f300 a2=1000 a3=0 items=0
> ppid=3436 pid=3437 auid=4294967295 uid=0 gid=0 euid=0 suid=0
> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
> comm="setroubleshootd" exe="/usr/bin/python"
> subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)
> type=AVC msg=audit(1319898471.902:81): avc: denied { getattr }
> for pid=3437 comm="setroubleshootd" name="/" dev=sysfs ino=1
> scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023
> tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem ----
> time->Sat Oct 29 15:30:43 2011 type=SYSCALL
> msg=audit(1319898643.744:84): arch=c000003e syscall=137 success=no
> exit=-13 a0=7fc6a4f444ae a1=7fffc431d1c0 a2=1000 a3=0 items=0
> ppid=3728 pid=3729 auid=4294967295 uid=0 gid=0 euid=0 suid=0
> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
> comm="setroubleshootd" exe="/usr/bin/python"
> subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)
> type=AVC msg=audit(1319898643.744:84): avc: denied { getattr }
> for pid=3729 comm="setroubleshootd" name="/" dev=sysfs ino=1
> scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023
> tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem ----
> time->Sat Oct 29 15:30:43 2011 type=SYSCALL
> msg=audit(1319898643.650:83): arch=c000003e syscall=137 success=no
> exit=-13 a0=7fd65c6754ae a1=7fff4322e2c0 a2=1000 a3=7fff4322e050
> items=0 ppid=1393 pid=3727 auid=4294967295 uid=93 gid=93 euid=0
> suid=0 fsuid=0 egid=93 sgid=93 fsgid=93 tty=(none) ses=4294967295
> comm="exim" exe="/usr/sbin/exim" subj=system_u:system_r:exim_t:s0
> key=(null) type=AVC msg=audit(1319898643.650:83): avc: denied {
> getattr } for pid=3727 comm="exim" name="/" dev=sysfs ino=1
> scontext=system_u:system_r:exim_t:s0
> tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem
>
> This box was upgraded from F15, so what do I need do about these
> avcs' and why they don't show up in sealert.
>
> Currently selinux-policy-targeted-3.10.0-51.fc16
>
> there seems to be an upgrade available:
> selinux-policy-targeted-3.10.0-55.fc16
>
> will it make any difference to above?
>
Yes I believe it will.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk7BZzoACgkQrlYvE4MpobMiAgCfThvCMpVwxT UpdPZ0+iFFJ+7E
zrEAn1wE2ny5I/25tPdDllkhnXqOy0EH
=a59M
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux


All times are GMT. The time now is 05:22 PM.

VBulletin, Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.