Re: puzzling SELinux alert.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 4/15/21 3:57 PM, Roger Heflin wrote:
(also responding to Samuel)

Google drive probably.  The first few lines should tell you what
process it was starting.

I really usually only look at filesystem type calls as those are
usually the most valuable for something like this.  open, unlink
(remove), stat (get info like ls shows), and say rename or renameat.

A lot of stats always fail as it is used to see if various things
exist here or there.

Basic it loads an executable, lots of setup of that executable then
toward the end is the real work the program does.

On a mv strace I get 117 lines with the executable and options at the
top, a bunch of loading of libs and stuff for executable then 10 lines
from the bottom is the actual rename, and the exit of the program.

bash.32[~]: grep 2636 caja.out > grep2636.txt
bash.33[~]: grep open caja.out > grepopen.txt
bash.34[~]: grep stat caja.out > grepstat.txt
bash.35[~]:
bash.35[~]: grep exec caja.out
2619 execve("/usr/bin/caja", ["/usr/bin/caja"], 0x7fff14191888 /* 69 vars */) = 0
2622  read(27, "2619  execve(\"/usr/bin/caja\", [\""..., 4096) = 4096
2636 execve("/usr/bin/totem-video-thumbnailer", ["/usr/bin/totem-video-thumbnailer", "-s", "128", "file:///home/bill/KhongWe"..., "/tmp/.mate_desktop_thumbnail.19V"...], 0x7ffdd556b338 /* 69 vars */ <unfinished ...>
2636  <... execve resumed>)             = 0
2652 openat(AT_FDCWD, "/sys/fs/selinux/booleans/allow_execmem", O_RDONLY) = -1 ENOENT (No such file or directory) 2652 openat(AT_FDCWD, "/sys/fs/selinux/booleans/allow_execmem", O_RDONLY) = -1 ENOENT (No such file or directory) 2652 openat(AT_FDCWD, "/sys/fs/selinux/booleans/deny_execmem", O_RDONLY) = 31
bash.36[~]:
bash.36[~]: grep unlink caja.out
2643 unlink("") = -1 ENOENT (No such file or directory)
2635  unlink("/tmp/.mate_desktop_thumbnail.19VW10") = 0
2635 unlink("/home/bill/.cache/thumbnails/fail/mate-thumbnail-factory/c39b432d203676f5e93a91a2d0d076d4.png.NVLR10") = -1 ENOENT (No such file or directory)
bash.37[~]:
bash.37[~]: grep remove caja.out
2636 stat("/usr/lib64/gstreamer-1.0/libgstremovesilence.so", {st_mode=S_IFREG|0755, st_size=28392, ...}) = 0
bash.38[~]:
bash.38[~]: grep rename caja.out
2635 rename("/home/bill/KhongWeeHo.mkv", "/home/bill/KhongWeeHo_20160327.mkv" <unfinished ...>
2635  <... rename resumed>)             = 0
2635 rename("/home/bill/.cache/thumbnails/fail/mate-thumbnail-factory/c39b432d203676f5e93a91a2d0d076d4.png.NVLR10", "/home/bill/.cache/thumbnails/fail/mate-thumbnail-factory/c39b432d203676f5e93a91a2d0d076d4.png") = 0
bash.39[~]:

The grep for the process ID "2636" found lines.
The grep for "open" found 4665 lines.
The grep for "stat" found 7449 lines.

The file caja.out is 148910 lines long.
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure



[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [EPEL Devel]     [Fedora Magazine]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Desktop]     [Fedora Fonts]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Fedora Sparc]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux