Hashes seems OK when i turn selinux protection off, as soon as i turn
selinux on while running rkhunter, they show up as BAD.
So i figure they are okey, but rkhunter is denied access to something.
Can someone explain what i ahev to do to make it right?
I´m on fc5, and i think it´s fully updated if i havent missed out on
any new repos.
dries.repo fedora-extras.repo
freshrpms.repo
fedora-core.repo fedora-legacy.repo livna.repo
fedora-development.repo fedora-updates.repo
macromedia.repo
fedora-extras-development.repo fedora-updates-testing.repo nuu.repo
--------------------------------------------------------
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 21
Policy from config file: targeted
--------------------------------------------------------
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: permissive
Mode from config file: enforcing
Policy version: 21
Policy from config file: targeted
--------------------------------------------------------
type=AVC msg=audit(1161332509.183:234): avc: denied { read write }
for pid=28899 comm="prelink" name="0" dev=devpts ino=2
scontext=user_u:system_r:prelink_t:s0
tcontext=user_u:object_r:devpts_t:s0 tclass=chr_file
type=AVC msg=audit(1161332509.183:234): avc: denied { read write }
for pid=28899 comm="prelink" name="0" dev=devpts ino=2
scontext=user_u:system_r:prelink_t:s0
tcontext=user_u:object_r:devpts_t:s0 tclass=chr_file
type=AVC msg=audit(1161332509.183:234): avc: denied { write } for
pid=28899 comm="prelink" name="prelink.tst" dev=dm-0 ino=1277164
scontext=user_u:system_r:prelink_t:s0 tcontext=user_u:object_r:var_t:s0
tclass=file
type=AVC msg=audit(1161332509.183:234): avc: denied { read write }
for pid=28899 comm="prelink" name="0" dev=devpts ino=2
scontext=user_u:system_r:prelink_t:s0
tcontext=user_u:object_r:devpts_t:s0 tclass=chr_file
type=SYSCALL msg=audit(1161332509.183:234): arch=40000003 syscall=11
success=yes exit=0 a0=8fd6ec8 a1=8fd6ae0 a2=8f4b3b8 a3=8fd6d38 items=0
ppid=28898 pid=28899 auid=523 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="prelink" exe="/usr/sbin/prelink"
subj=user_u:system_r:prelink_t:s0 key=(null)
type=AVC_PATH msg=audit(1161332509.183:234): path="/dev/pts/0"
type=AVC_PATH msg=audit(1161332509.183:234):
path="/var/rkhunter/tmp/prelink.tst"
type=AVC_PATH msg=audit(1161332509.183:234): path="/dev/pts/0"
type=AVC msg=audit(1161332509.859:235): avc: denied { read write }
for pid=28959 comm="prelink" name="0" dev=devpts ino=2
scontext=user_u:system_r:prelink_t:s0
tcontext=user_u:object_r:devpts_t:s0 tclass=chr_file
type=AVC msg=audit(1161332509.859:235): avc: denied { read write }
for pid=28959 comm="prelink" name="0" dev=devpts ino=2
scontext=user_u:system_r:prelink_t:s0
tcontext=user_u:object_r:devpts_t:s0 tclass=chr_file
type=AVC msg=audit(1161332509.859:235): avc: denied { write } for
pid=28959 comm="prelink" name="prelink.tst" dev=dm-0 ino=1277164
scontext=user_u:system_r:prelink_t:s0 tcontext=user_u:object_r:var_t:s0
tclass=file
type=AVC msg=audit(1161332509.859:235): avc: denied { read write }
for pid=28959 comm="prelink" name="0" dev=devpts ino=2
scontext=user_u:system_r:prelink_t:s0
tcontext=user_u:object_r:devpts_t:s0 tclass=chr_file
type=SYSCALL msg=audit(1161332509.859:235): arch=40000003 syscall=11
success=yes exit=0 a0=8fd66f0 a1=8fd6ae0 a2=8f4b3b8 a3=8fd6ea0 items=0
ppid=28958 pid=28959 auid=523 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="prelink" exe="/usr/sbin/prelink"
subj=user_u:system_r:prelink_t:s0 key=(null)
type=AVC_PATH msg=audit(1161332509.859:235): path="/dev/pts/0"
type=AVC_PATH msg=audit(1161332509.859:235):
path="/var/rkhunter/tmp/prelink.tst"
type=AVC_PATH msg=audit(1161332509.859:235): path="/dev/pts/0"
Regards
/pi
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
