-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 12/14/2012 09:25 AM, m.roth@xxxxxxxxx wrote: > Daniel J Walsh wrote: >> On 12/13/2012 09:35 AM, m.roth@xxxxxxxxx wrote: >>> Current CentOS 6.3 >>> >>> I get this. / is only 54%. >>> >>> SELinux is preventing /usr/bin/perl from using the sys_resource >>> capability. >>> >>> ***** Plugin sys_resource (91.4 confidence) suggests >>> *********************** > <snip> >> sys_resource is basically what the kernel will report when you are gone >> over a resource limit for a particular UID, and require the sys_resource >> capability to continue. Could be file system, number of processes open > file >> descriptors. >> >> We see these happening more in a more for root processes and we have >> bugzillas open for expanding the max numbers of processes for root, I think >> under RHEL, but a quick google did not find it. > > Suddenly, as in the last few weeks to a month, possibly as updates were > applied and new kernels run, I'm seeing a bunch of these. > > On another system, I see in this morning's logs > --------------------- Selinux Audit Begin ------------------------ > > **Unmatched Entries** > Audit daemon has no space left on logging partition > Audit daemon is suspending logging due to no space left on logging > partition. > > ---------------------- Selinux Audit End ------------------------- > --------------------- Disk Space Begin ------------------------ > > Filesystem Size Used Avail Use% Mounted on > /dev/sda3 914G 722G 146G 84% / > /dev/sda1 1008M 103M 855M 11% /boot > > ---------------------- Disk Space End ------------------------- > > However, I also see that a user was running R, and oom-killer was invoked. > My suspicion is that it's *not* disk space that's run out, as the message > suggests, but rather that the system ran out of memory, and the sealert > gave the wrong information. > > Your thoughts, Dan (or anyone)? > > mark > > -- > selinux mailing list > selinux@xxxxxxxxxxxxxxxxxxxxxxx > https://admin.fedoraproject.org/mailman/listinfo/selinux > How would this look. ***** Plugin sys_resource (91.4 confidence) suggests *********************** If you do not want processes to require capabilities to use up all the system resources on your system; Then you need to diagnose why your system is running out of system resources and fix the problem. According to /usr/include/linux/capability.h is sys_resource is required to: /* Override resource limits. Set resource limits. */ /* Override quota limits. */ /* Override reserved space on ext2 filesystem */ /* Modify data journaling mode on ext3 filesystem (uses journaling resources) */ /* NOTE: ext2 honors fsuid when checking for resource overrides, so you can override using fsuid too */ /* Override size restrictions on IPC message queues */ /* Allow more than 64hz interrupts from the real-time clock */ /* Override max number of consoles on console allocation */ /* Override max number of keymaps */ /* Override resource limits. Set resource limits. */ /* Override quota limits. */ /* Override reserved space on ext2 filesystem */ /* Modify data journaling mode on ext3 filesystem (uses journaling resources) */ /* NOTE: ext2 honors fsuid when checking for resource overrides, so you can override using fsuid too */ /* Override size restrictions on IPC message queues */ /* Allow more than 64hz interrupts from the real-time clock */ /* Override max number of consoles on console allocation */ /* Override max number of keymaps */ /* Override resource limits. Set resource limits. */ /* Override quota limits. */ /* Override reserved space on ext2 filesystem */ /* Modify data journaling mode on ext3 filesystem (uses journaling resources) */ /* NOTE: ext2 honors fsuid when checking for resource overrides, so you can override using fsuid too */ /* Override size restrictions on IPC message queues */ /* Allow more than 64hz interrupts from the real-time clock */ /* Override max number of consoles on console allocation */ /* Override max number of keymaps */ Do fix the cause of the SYS_RESOURCE on your system. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iEYEARECAAYFAlDMaOcACgkQrlYvE4MpobNy3ACfWqbKznDfacUUtQUnPv8HkFvU n/gAnRsOCkmloboOKs5823CsoDpI2ILS =4GMD -----END PGP SIGNATURE----- -- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/selinux
