inode confusion?
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1 Hi, After recent policy upgrade (selinux-policy-targeted-3.10.0-145.fc17.noarch) I noticed some cron jobs are failing and generate selinux avc: time->Fri Aug 24 04:02:05 2012 type=SYSCALL msg=audit(1345780925.499:656): arch=c000003e syscall=2 success=no exit=-13 a0=404a07 a1=0 a2=0 a3=0 items=0 ppid=21070 pid=21091 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=85 comm="tmpwatch" exe="/usr/sbin/tmpwatch" subj=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1345780925.499:656): avc: denied { read } for pid=21091 comm="tmpwatch" name="root" dev="dm-1" ino=8194 scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir tmpwatch definitely shouldn't be going to /root home, and I am pretty sure it doesn't. What's interesting though is this fact: [root@fedora ~]# ls -ldi /root 8194 dr-xr-x---. 5 root root 4096 Aug 18 15:18 /root [root@fedora ~]# ls -ldi /var/tmp 8194 drwxrwxrwt. 3 root root 4096 Aug 24 23:41 /var/tmp both directories have the same inode number, which selinux is complaining about. Since they are on different files system, it's normal: [root@fedora ~]# df -h Filesystem Size Used Avail Use% Mounted on rootfs 4.0G 1.1G 2.7G 30% / devtmpfs 223M 0 223M 0% /dev tmpfs 244M 0 244M 0% /dev/shm tmpfs 244M 380K 244M 1% /run /dev/mapper/vgx-root 4.0G 1.1G 2.7G 30% / tmpfs 244M 0 244M 0% /sys/fs/cgroup tmpfs 244M 0 244M 0% /media /dev/mapper/vgx-home 1008M 34M 923M 4% /home /dev/mapper/vgx-tmp 504M 17M 462M 4% /tmp /dev/mapper/vgx-var 1008M 303M 655M 32% /var /dev/xvda1 504M 94M 386M 20% /boot But it makes me wonder, if SELinux is confused somehow? Regards, Vadym -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iEYEARECAAYFAlA4F7kACgkQmYV3iqStpjvYYACfcSV/KBMl6lzYM7Y/iASwuQhg gnEAn3aILGJEjV/Zckc0QY8UqCRpob5V =fGNj -----END PGP SIGNATURE----- -- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux |
inode confusion?
On Fri, 2012-08-24 at 20:09 -0400, Vadym Chepkov wrote:
> > time->Fri Aug 24 04:02:05 2012 > type=SYSCALL msg=audit(1345780925.499:656): arch=c000003e syscall=2 success=no exit=-13 a0=404a07 a1=0 a2=0 a3=0 items=0 ppid=21070 pid=21091 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=85 comm="tmpwatch" exe="/usr/sbin/tmpwatch" subj=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 key=(null) > type=AVC msg=audit(1345780925.499:656): avc: denied { read } for pid=21091 comm="tmpwatch" name="root" dev="dm-1" ino=8194 scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir > > But it makes me wonder, if SELinux is confused somehow? No it is clear that tmpwatch wants to list /root for whatever reason. comm="tmpwatch" name="root" dev="dm-1" > Regards, > Vadym > > > > > -- > selinux mailing list > selinux@lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/selinux -- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux |
inode confusion?
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1 On Aug 26, 2012, at 6:15 AM, Dominick Grift wrote: > On Fri, 2012-08-24 at 20:09 -0400, Vadym Chepkov wrote: >> >> time->Fri Aug 24 04:02:05 2012 >> type=SYSCALL msg=audit(1345780925.499:656): arch=c000003e syscall=2 success=no exit=-13 a0=404a07 a1=0 a2=0 a3=0 items=0 ppid=21070 pid=21091 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=85 comm="tmpwatch" exe="/usr/sbin/tmpwatch" subj=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 key=(null) >> type=AVC msg=audit(1345780925.499:656): avc: denied { read } for pid=21091 comm="tmpwatch" name="root" dev="dm-1" ino=8194 scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir >> > >> But it makes me wonder, if SELinux is confused somehow? > > No it is clear that tmpwatch wants to list /root for whatever reason. > > comm="tmpwatch" > name="root" > dev="dm-1" Just a coincidence then. Could it be that root's cron jobs are executed with /root as a current directory and this breaks tmpwatch ? Vadym -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iEYEARECAAYFAlA6FuIACgkQmYV3iqStpju91gCeNcXDBqtrOk 5BpHWiD3E+TGBd 1c8AoJhAjb0JDSPSU41CAtG/iQFNPSIf =F6xi -----END PGP SIGNATURE----- -- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux |
inode confusion?
On Sat, Aug 25, 2012 at 2:09 AM, Vadym Chepkov <vchepkov@gmail.com> wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, After recent policy upgrade (selinux-policy-targeted-3.10.0-145.fc17.noarch) I noticed some cron jobs are failing and generate selinux avc: time->Fri Aug 24 04:02:05 2012 type=SYSCALL msg=audit(1345780925.499:656): arch=c000003e syscall=2 success=no exit=-13 a0=404a07 a1=0 a2=0 a3=0 items=0 ppid=21070 pid=21091 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=85 comm="tmpwatch" exe="/usr/sbin/tmpwatch" subj=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1345780925.499:656): avc: *denied *{ read } for *pid=21091 comm="tmpwatch" name="root" dev="dm-1" ino=8194 scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir tmpwatch definitely shouldn't be going to /root home, and I am pretty sure it doesn't. No, isn't true. For example try to see which is the device that dm-0 point sudo lvdisplay|awk '/LV Name/{n=$3} /Block device/{d=$3; sub(".*:","dm-",d); print d,n;}' -- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux |
inode confusion?
On Sun, 2012-08-26 at 08:30 -0400, Vadym Chepkov wrote:
> Just a coincidence then. > Could it be that root's cron jobs are executed with /root as a current directory and this breaks tmpwatch ? Could be yes, Although i would not expect a read but rather a search on /root > Vadym > > -- > selinux mailing list > selinux@lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/selinux -- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux |
| All times are GMT. The time now is 12:14 AM. |
VBulletin, Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.