On Fri, 2008-10-17 at 08:39 -0700, Antonio Olivares wrote:
>
>
> --- On Fri, 10/17/08, Stephen Smalley <sds@xxxxxxxxxxxxx> wrote:
>
> > From: Stephen Smalley <sds@xxxxxxxxxxxxx>
> > Subject: Re: selinux denies dmesg
> > To: olivares14031@xxxxxxxxx
> > Cc: fedora-selinux-list@xxxxxxxxxx
> > Date: Friday, October 17, 2008, 7:32 AM
> > On Thu, 2008-10-16 at 15:27 -0700, Antonio Olivares wrote:
> > > Dear fellow selinux experts,
> > >
> > > After recovering from a kernel panic to check up on
> > the filesystem, I run dmesg and I encounter some avc's
> > >
> > > [olivares@riohigh ~]$ dmesg | grep avc
> > > type=1400 audit(1224195506.669:4): avc: denied {
> > sys_resource } for pid=1534 comm="dmesg"
> > capability=24 scontext=system_u:system_r:dmesg_t:s0
> > tcontext=system_u:system_r:dmesg_t:s0 tclass=capability
> > > type=1400 audit(1224195506.669:5): avc: denied {
> > sys_resource } for pid=1534 comm="dmesg"
> > capability=24 scontext=system_u:system_r:dmesg_t:s0
> > tcontext=system_u:system_r:dmesg_t:s0 tclass=capability
> > > type=1400 audit(1224195506.669:6): avc: denied {
> > sys_resource } for pid=1534 comm="dmesg"
> > capability=24 scontext=system_u:system_r:dmesg_t:s0
> > tcontext=system_u:system_r:dmesg_t:s0 tclass=capability
> > > type=1400 audit(1224195506.669:7): avc: denied {
> > sys_resource } for pid=1534 comm="dmesg"
> > capability=24 scontext=system_u:system_r:dmesg_t:s0
> > tcontext=system_u:system_r:dmesg_t:s0 tclass=capability
> > > type=1400 audit(1224195506.670:8): avc: denied {
> > sys_resource } for pid=1534 comm="dmesg"
> > capability=24 scontext=system_u:system_r:dmesg_t:s0
> > tcontext=system_u:system_r:dmesg_t:s0 tclass=capability
> > > type=1400 audit(1224195506.670:9): avc: denied {
> > sys_resource } for pid=1534 comm="dmesg"
> > capability=24 scontext=system_u:system_r:dmesg_t:s0
> > tcontext=system_u:system_r:dmesg_t:s0 tclass=capability
> > > type=1400 audit(1224195506.670:10): avc: denied {
> > sys_resource } for pid=1534 comm="dmesg"
> > capability=24 scontext=system_u:system_r:dmesg_t:s0
> > tcontext=system_u:system_r:dmesg_t:s0 tclass=capability
> > > type=1400 audit(1224195506.670:11): avc: denied {
> > sys_resource } for pid=1534 comm="dmesg"
> > capability=24 scontext=system_u:system_r:dmesg_t:s0
> > tcontext=system_u:system_r:dmesg_t:s0 tclass=capability
> > > type=1400 audit(1224195506.670:12): avc: denied {
> > sys_resource } for pid=1534 comm="dmesg"
> > capability=24 scontext=system_u:system_r:dmesg_t:s0
> > tcontext=system_u:system_r:dmesg_t:s0 tclass=capability
> > > type=1400 audit(1224195506.670:13): avc: denied {
> > sys_resource } for pid=1534 comm="dmesg"
> > capability=24 scontext=system_u:system_r:dmesg_t:s0
> > tcontext=system_u:system_r:dmesg_t:s0 tclass=capability
> > >
> > >
> > > I have just updated to a newer kernel 2.6.27-13 and
> > new selinux policy updates :)
> > >
> > > [olivares@riohigh ~]$ rpm -qa selinux*
> > > selinux-policy-3.5.12-2.fc10.noarch
> > > selinux-policy-targeted-3.5.12-2.fc10.noarch
> > > [olivares@riohigh ~]$
> > >
> > >
> > > What do I do?
> >
> > Enable syscall auditing and find out what syscall triggered
> > the
> > CAP_SYS_RESOURCE check.
> >
> > --
> > Stephen Smalley
> > National Security Agency
>
> How do I do that:
>
> > Enable syscall auditing and find out what syscall triggered
> > the
> > CAP_SYS_RESOURCE check.
> >
>
> If there is a way to do it?
Do you have auditd running?
Try running:
/sbin/ausearch -m AVC -sv no
> I feel that Selinux should not get in the way of dmesg and other important system commands. Why does it deny it?
>
> Seatroubleshooter has not appeared and on other machine without ext4 I see the following denials:
>
> [olivares@localhost ~]$ dmesg | grep 'avc'
> type=1400 audit(1224252291.136:4): avc: denied { write } for pid=1459 comm="ip6tables-resto" path="/0" dev=devpts ino=2 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=chr_file
> type=1400 audit(1224252414.451:5): avc: denied { execstack } for pid=2951 comm="knotify4" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process
> [olivares@localhost ~]$ dmesg | grep 'avcs'
> [olivares@localhost ~]$ dmesg | grep avc
> type=1400 audit(1224252291.136:4): avc: denied { write } for pid=1459 comm="ip6tables-resto" path="/0" dev=devpts ino=2 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=chr_file
> type=1400 audit(1224252414.451:5): avc: denied { execstack } for pid=2951 comm="knotify4" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process
> [olivares@localhost ~]$
>
>
> Thanks,
>
> Antonio
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com
--
Stephen Smalley
National Security Agency
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
