Re: SELinux is preventing sh from getattr access on the file /usr/sbin/ldconfig.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On 06/28/2015 07:53 AM, Suvayu Ali wrote:
> On Sun, Jun 28, 2015 at 06:04:38AM -0400, Daniel J Walsh wrote:
>>
>> On 06/27/2015 07:01 PM, Ed Greshko wrote:
>>> On 06/27/15 21:15, Andras Simon wrote:
>>>> 2015-06-27 15:11 GMT+02:00, Andras Simon <szajmi@xxxxxxxxx>:
>>>>> Should I be worried about the $subject?
>>>> And there's also a "SELinux is preventing sh from execute access on
>>>> the file /usr/sbin/ldconfig" which I've only just noticed. It sounds
>>>> even scarier.
>>>>
>>> Does your output match these?
>>>
>>> [egreshko@meimei ~]$ ls -Z /bin/bash
>>> system_u:object_r:shell_exec_t:s0 /bin/bash
>>>
>>> [egreshko@meimei ~]$ ls -Z /usr/sbin/ldconfig
>>> system_u:object_r:ldconfig_exec_t:s0 /usr/sbin/ldconfig
>>>
>> Do you have the avc's?
>>
>> ausearch -m avc
> I also saw these alerts during a package update.
>
> time->Thu Jun 25 17:56:49 2015
> type=PROCTITLE msg=audit(1435247809.870:4079): proctitle=7368002D63002F7362696E2F6C64636F6E666967202D7020323E2F6465762F6E756C6C
> type=SYSCALL msg=audit(1435247809.870:4079): arch=c000003e syscall=59 success=no exit=-13 a0=7f955d728b00 a1=7f955d728c00 a2=7f955d727c40 a3=7fffc7dab900 items=0 ppid=30356 pid=30357 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" subj=system_u:system_r:firewalld_t:s0 key=(null)
> type=AVC msg=audit(1435247809.870:4079): avc:  denied  { execute } for  pid=30357 comm="sh" name="ldconfig" dev="sdb1" ino=450673 scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file permissive=0
> ----
> time->Thu Jun 25 17:56:49 2015
> type=PROCTITLE msg=audit(1435247809.870:4080): proctitle=7368002D63002F7362696E2F6C64636F6E666967202D7020323E2F6465762F6E756C6C
> type=SYSCALL msg=audit(1435247809.870:4080): arch=c000003e syscall=4 success=no exit=-13 a0=7f955d728b00 a1=7fffc7dab9b0 a2=7fffc7dab9b0 a3=7fffc7dab900 items=0 ppid=30356 pid=30357 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" subj=system_u:system_r:firewalld_t:s0 key=(null)
> type=AVC msg=audit(1435247809.870:4080): avc:  denied  { getattr } for  pid=30357 comm="sh" path="/usr/sbin/ldconfig" dev="sdb1" ino=450673 scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file permissive=0
> ----
> time->Thu Jun 25 17:56:49 2015
> type=PROCTITLE msg=audit(1435247809.870:4081): proctitle=7368002D63002F7362696E2F6C64636F6E666967202D7020323E2F6465762F6E756C6C
> type=SYSCALL msg=audit(1435247809.870:4081): arch=c000003e syscall=4 success=no exit=-13 a0=7f955d728b00 a1=7fffc7dab990 a2=7fffc7dab990 a3=7fffc7dab900 items=0 ppid=30356 pid=30357 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" subj=system_u:system_r:firewalld_t:s0 key=(null)
> type=AVC msg=audit(1435247809.870:4081): avc:  denied  { getattr } for  pid=30357 comm="sh" path="/usr/sbin/ldconfig" dev="sdb1" ino=450673 scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file permissive=0
>
This is very strange.  Doing ldconfig during a package update is
expected, but why would firewalld be executing it. 
ps -eZ | grep firewalld

-- 
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org



[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [EPEL Devel]     [Fedora Magazine]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Desktop]     [Fedora Fonts]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Fedora Sparc]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux