On Thu, Jun 10, 2010 at 05:23:01PM +0200, Laurent Rineau wrote:
> Hi Dominick. Thanks for your answer. I have followed your recommendations (see
> below).
>
> On Wednesday 09 June 2010 17:58:58 Dominick Grift wrote:
> > lets create a policy patch:
> >
> > echo "policy_module(myaiccu, 1.0.0)" > myaiccu.te;
> > echo "require { type aiccu_t; }" >> myaiccu.te;
> > echo "sysnet_domtrans_ifconfig(aiccu_t)" >> myaiccu.te;
> > echo "modutils_domtrans_insmod_uncond(aiccu_t) >> myaiccu.te;
> > echo "corecmd_exec_shell(aiccu_t)" >> myaiccu.te;
> >
> > see if it build:
> >
> > make -f /usr/share/selinux/devel/Makefile myaiccu.pp
> >
> > Install it:
> >
> > sudo semodule -i myaiccu.pp
>
> I have create myaiccu.te with:
>
> policy_module(myaiccu, 1.0.0)
> require { type aiccu_t; }
> sysnet_domtrans_ifconfig(aiccu_t)
> modutils_domtrans_insmod_uncond(aiccu_t)
> corecmd_exec_shell(aiccu_t)
>
> and typed:
> sudo setenforce 0
> sudo semodule -d local
> sudo semodule -i myaiccu.pp
> then I have disabled and reenabled the network.
>
> I have had three AVC (attached full log), and audit2allow know only says:
>
> #============= aiccu_t ==============
> allow aiccu_t proc_t:file { read getattr open };
>
>
>
> I have retried with a new myaiccu.te:
>
> policy_module(myaiccu, 1.0.1)
i> require { type aiccu_t;
> type proc_t;
> class file { read getattr open };
> }
> sysnet_domtrans_ifconfig(aiccu_t)
> modutils_domtrans_insmod_uncond(aiccu_t)
> corecmd_exec_shell(aiccu_t)
> allow aiccu_t proc_t:file { read getattr open };
>
> and:
> sudo semodule -u myaiccu.pp
> and then the disable/enable of the network gives no AVC.
>
> I hope than can help you fix the aiccu module.
Hello,
Great thanks, if you want you can report the fix to this issue yourself to fedora's bugzilla in the selinux-policy component. You would mention the following:
sysnet_domtrans_ifconfig(aiccu_t)
modutils_domtrans_insmod(aiccu_t)
corecmd_exec_shell(aiccu_t)
kernel_read_system_state(aiccu_t)
And enclose the AVC denials that you've been seeying.
Thanks in advance.
> --
> Laurent Rineau
> http://fedoraproject.org/wiki/LaurentRineau
> ----
> time->Thu Jun 10 17:12:20 2010
> type=SYSCALL msg=audit(1276182740.754:592): arch=c000003e syscall=2 success=yes exit=3 a0=3786942300 a1=0 a2=1b6 a3=2 items=0 ppid=7234 pid=7422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/bin/bash" subj=system_u:system_r:aiccu_t:s0 key=(null)
> type=AVC msg=audit(1276182740.754:592): avc: denied { open } for pid=7422 comm="sh" name="meminfo" dev=proc ino=4026531984 scontext=system_u:system_r:aiccu_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file
> type=AVC msg=audit(1276182740.754:592): avc: denied { read } for pid=7422 comm="sh" name="meminfo" dev=proc ino=4026531984 scontext=system_u:system_r:aiccu_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file
> ----
> time->Thu Jun 10 17:12:20 2010
> type=SYSCALL msg=audit(1276182740.754:593): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7fff68dd8580 a2=7fff68dd8580 a3=2 items=0 ppid=7234 pid=7422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/bin/bash" subj=system_u:system_r:aiccu_t:s0 key=(null)
> type=AVC msg=audit(1276182740.754:593): avc: denied { getattr } for pid=7422 comm="sh" path="/proc/meminfo" dev=proc ino=4026531984 scontext=system_u:system_r:aiccu_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file
> --
> selinux mailing list
> selinux@xxxxxxxxxxxxxxxxxxxxxxx
> https://admin.fedoraproject.org/mailman/listinfo/selinux
Attachment:
pgpDjv7nqzL2H.pgp
Description: PGP signature
-- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/selinux
