Daniel J Walsh wrote:
>
> David Rye wrote:
> > Have run in to a problem on a couple of servers that I have updated in
> > the last week or so.
> >
> > snmpd does not start after a reboot, the following log extract is from
> > /var/log/messages on server f4.
> >
> > Jan 31 17:26:54 f4 acpid: acpid startup succeeded
> > Jan 31 17:26:54 f4 kernel: audit(1138728414.530:2): avc: denied {
> > execmem } fo
> > r pid=5278 comm="snmpd" scontext=user_u:system_r:snmpd_t
> > tcontext=user_u:system
> > _r:snmpd_t tclass=process
> > Jan 31 17:26:54 f4 snmpd: /usr/sbin/snmpd: error while loading shared
> > libraries:
> > libbeecrypt.so.6: cannot enable executable stack as shared object
> > requires: Per
> > mission denied
> > Jan 31 17:26:54 f4 snmpd: snmpd startup failed
> >
> >
> >
> >
> Does it work if you
> execstack -c /usr/lib/libbeecrypt.so.6
Yes and no.
snmpd starts but the following entery is added to /var/log/messages
Feb 1 18:31:48 workstation1 kernel: audit(1138818708.669:5): avc:
denied { search } for pid=3176 comm="snmpd"
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:sysctl_dev_t
tclass=dir
snmpwalk will then display the mib tree or at any rate most of it.
However while running snmpwalk 9000 additional avc: eneries were
added to /var/log/messages.
Feb 1 18:37:33 workstation1 kernel: audit(1138819053.932:7): avc:
denied { signull } for pid=3285 comm="snmpd"
scontext=root:system_r:snmpd_t
tcontext=root:system_r:unconfined_t
tclass=process
Feb 1 18:37:33 workstation1 kernel: audit(1138819053.932:8): avc:
denied { signull } for pid=3285 comm="snmpd"
scontext=root:system_r:snmpd_t
tcontext=root:system_r:unconfined_t
tclass=process
Feb 1 18:37:33 workstation1 kernel: audit(1138819053.932:9): avc:
denied { signull } for pid=3285 comm="snmpd"
scontext=root:system_r:snmpd_t
tcontext=root:system_r:unconfined_t
tclass=process
Feb 1 18:37:33 workstation1 kernel: audit(1138819053.932:10): avc:
denied { signull } for pid=3285 comm="snmpd"
scontext=root:system_r:snmpd_t
tcontext=root:system_r:unconfined_t
tclass=process
Feb 1 18:37:33 workstation1 kernel: audit(1138819053.932:11): avc:
denied { signull } for pid=3285 comm="snmpd"
scontext=root:system_r:snmpd_t
tcontext=root:system_r:unconfined_t
tclass=process
Feb 1 18:37:33 workstation1 kernel: audit(1138819053.932:12): avc:
denied { signull } for pid=3285 comm="snmpd"
scontext=root:system_r:snmpd_t
tcontext=root:system_r:unconfined_t
tclass=process
Feb 1 18:37:33 workstation1 kernel: audit(1138819053.932:13): avc:
denied { signull } for pid=3285 comm="snmpd"
scontext=root:system_r:snmpd_t
tcontext=root:system_r:unconfined_t
tclass=process
Feb 1 18:37:33 workstation1 kernel: audit(1138819053.932:14): avc:
denied { signull } for pid=3285 comm="snmpd"
scontext=root:system_r:snmpd_t
tcontext=root:system_r:unconfined_t
tclass=process
Feb 1 18:37:33 workstation1 kernel: audit(1138819053.956:15): avc:
denied { getattr } for pid=3285 comm="snmpd" name="/" dev=usbfs
ino=1392
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:usbfs_t
tclass=dir
Feb 1 18:37:33 workstation1 kernel: audit(1138819053.962:16): avc:
denied { getattr } for pid=3285 comm="snmpd" name="/" dev=hda1 ino=2
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:boot_t
tclass=dir
Feb 1 18:37:34 workstation1 kernel: audit(1138819054.000:17): avc:
denied { getattr } for pid=3285 comm="snmpd" name="/" dev=usbfs
ino=1392
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:usbfs_t
tclass=dir
Feb 1 18:37:34 workstation1 kernel: audit(1138819054.002:18): avc:
denied { getattr } for pid=3285 comm="snmpd" name="/" dev=hda1 ino=2
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:boot_t
tclass=dir
Feb 1 18:37:34 workstation1 kernel: audit(1138819054.018:19): avc:
denied { getattr } for pid=3285 comm="snmpd" name="/" dev=usbfs
ino=1392
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:usbfs_t
tclass=dir
Feb 1 18:37:34 workstation1 kernel: audit(1138819054.020:20): avc:
denied { getattr } for pid=3285 comm="snmpd" name="/" dev=hda1 ino=2
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:boot_t
tclass=dir
Feb 1 18:37:34 workstation1 kernel: audit(1138819054.035:21): avc:
denied { getattr } for pid=3285 comm="snmpd" name="/" dev=usbfs
ino=1392
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:usbfs_t
tclass=dir
Feb 1 18:37:34 workstation1 kernel: audit(1138819054.055:22): avc:
denied { getattr } for pid=3285 comm="snmpd" name="/" dev=hda1 ino=2
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:boot_t
tclass=dir
Feb 1 18:37:34 workstation1 kernel: audit(1138819054.071:23): avc:
denied { getattr } for pid=3285 comm="snmpd" name="/" dev=usbfs
ino=1392
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:usbfs_t
tclass=dir
Feb 1 18:37:34 workstation1 kernel: audit(1138819054.073:24): avc:
denied { getattr } for pid=3285 comm="snmpd" name="/" dev=hda1 ino=2
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:boot_t
tclass=dir
Feb 1 18:37:34 workstation1 kernel: audit(1138819054.092:25): avc:
denied { getattr } for pid=3285 comm="snmpd" name="/" dev=usbfs
ino=1392
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:usbfs_t
tclass=dir
Feb 1 18:37:34 workstation1 kernel: audit(1138819054.095:26): avc:
denied { getattr } for pid=3285 comm="snmpd" name="/" dev=hda1 ino=2
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:boot_t
tclass=dir
Feb 1 18:37:34 workstation1 kernel: audit(1138819054.111:27): avc:
denied { getattr } for pid=3285 comm="snmpd" name="/" dev=usbfs
ino=1392
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:usbfs_t
tclass=dir
Feb 1 18:37:34 workstation1 kernel: audit(1138819054.111:28): avc:
denied { getattr } for pid=3285 comm="snmpd" name="/" dev=hda1 ino=2
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:boot_t
tclass=dir
Feb 1 18:37:36 workstation1 kernel: audit(1138819056.112:29): avc:
denied { getattr } for pid=3285 comm="snmpd" name="tmp" dev=hda2
ino=9895940
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:tmp_t
tclass=dir
Feb 1 18:37:36 workstation1 kernel: audit(1138819056.135:30): avc:
denied { read } for pid=3285 comm="snmpd" name="tmp" dev=hda2
ino=3915910
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:usr_t
tclass=lnk_file
Feb 1 18:37:36 workstation1 kernel: audit(1138819056.135:31): avc:
denied { getattr } for pid=3285 comm="snmpd" name="tmp" dev=hda2
ino=4374529
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:tmp_t
tclass=dir
Feb 1 18:37:42 workstation1 kernel: audit(1138819062.738:32): avc:
denied { getattr } for pid=3285 comm="snmpd" name="tmp" dev=hda2
ino=9895940
scontext=root:system_r:snmpd_t tcontext=system_u:object_r:tmp_t
tclass=dir
Feb 1 18:37:42 workstation1 kernel: audit(1138819062.738:33): avc:
denied { read } for pid=3285 comm="snmpd" name="tmp" dev=hda2
ino=3915910
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:usr_t
tclass=lnk_file
Feb 1 18:37:42 workstation1 kernel: audit(1138819062.738:34): avc:
denied { getattr } for pid=3285 comm="snmpd" name="tmp" dev=hda2
ino=4374529
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:tmp_t
tclass=dir
Feb 1 18:37:44 workstation1 kernel: audit(1138819063.999:35): avc:
denied { getattr } for pid=3285 comm="snmpd" name="tmp" dev=hda2
ino=9895940
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:tmp_t
tclass=dir
Feb 1 18:37:44 workstation1 kernel: audit(1138819063.999:36): avc:
denied { read } for pid=3285 comm="snmpd" name="tmp" dev=hda2
ino=3915910
scontext=root:system_r:snmpd_t
tcontext=system_u:object_r:usr_t
tclass=lnk_file
------snip another 6000 odd lines all getattr or read on file tmp----
inode
3915910 sym link /usr/tmp to /var/tmp
4374529 /tmp
9895940 /var/tmp
> > Running
> > execstack -q /usr/lib/libbeecrypt.so.6
> > gives
> > X /usr/lib/libbeecrypt.so.6
> >
> > So the library is explisitly marked as requiring an executable stack.
> >
> > looking at the obvious rpms yields the following
> >
> > kernel-2.6.12-1.1381_FC3 was kernel-2.6.11-1.14_FC3
> > net-snmp-5.2.1.2-FC3.1 unchanged
> > net-snmp-libs-5.2.1.2-FC3.1 unchanged
> > selinux-policy-targeted-1.17.30-3.19 was
> > selinux-policy-targeted-1.17.30-2.96
> > libselinux-1.19.1-8 unchanged
> > beecrypt-3.1.0-6 unchanged
> >
> >
> > Any suggestions appreciated.
> >
> >
--
J. David Rye
http://www.roadrunner.uk.com
http://www.rha.org.uk
mailto://d.rye@xxxxxxxxxxxxxx
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
