On Wed, 2007-04-11 at 20:53 +0300, Jouni Viikari wrote:
> Hi,
>
> After the latest selinux updates I get a lot of these messages at my
> log:
>
> SELinux is preventing /bin/ping (ping_t) "search" to locale (locale_t)
>
> or audit log:
>
> denied { search } for pid=16255 comm="ping" name="locale" dev=dm-0
> ino=3113039 scontext=system_u:system_r:ping_t:s0
> tcontext=system_u:object_r:locale_t:s0 tclass=dir
>
>
> type=SYSCALL msg=audit(1176300990.257:65255): arch=40000003 syscall=5
> success=no exit=-13 a0=bf91d6e0 a1=0 a2=1b6 a3=8816018 items=0
> ppid=18973 pid=18974 auid=4294967295 uid=507 gid=507 euid=0 suid
> =0 fsuid=0 egid=507 sgid=507 fsgid=507 tty=(none) comm="ping"
> exe="/bin/ping" subj=system_u:system_r:ping_t:s0 key=(null)
> type=AVC msg=audit(1176300990.257:65256): avc: denied { search } for
> pid=18974 comm="ping" name="locale" dev=dm-0 ino=3113039
> scontext=system_u:system_r:ping_t:s0 tcontext=system_u:object_r:loca
> le_t:s0 tclass=dir
>
> The last line repeats itself many times.
>
> The pings are run by Big Brother which as a one task pings my network to
> see all is up.
>
> Is this a local problem here, selinux problem or ping problem?
I'd say it is a selinux policy problem (should allow ping to read locale
data). You can work around it by creating a local policy module with
audit2allow and installing it via semodule until it is fixed in the
policy. Not sure why it would only show up after an update.
--
Stephen Smalley
National Security Agency
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
