On Tue, Sep 12, 2017 at 12:01:35PM -0400, Stephen Smalley wrote:
> On Sep 12, 2017 7:01 AM, "Dominick Grift" <dac.override@xxxxxxxxx> wrote:
>
> I have extended socket class polcap enabled but i am still seeing "socket"
> class events and i was wondering whether that is to be expected?
>
> avc: denied { create } for pid=10484 comm="nethogs" scontext=wheel.id:
> sysadm.role:nethogs.subj:s0 tcontext=wheel.id:sysadm.role:nethogs.subj:s0
> tclass=socket permissive=0
>
> This seems to be common to processes that also create (and map! [1])
> "packet_socket" sockets (tcpdump/nethogs)
>
> [1] avc: denied { map } for pid=10525 comm="nethogs"
> path="socket:[56040]" dev="sockfs" ino=56040
> scontext=wheel.id:sysadm.role:nethogs.subj:s0
> tcontext=wheel.id:sysadm.role:nethogs.subj:s0 tclass=packet_socket
> permissive=0
>
>
> No, that is not expected. Can you enable sys call audit and get those
> records?
type=PROCTITLE msg=audit(09/12/2017 19:35:54.063:4458) : proctitle=nethogs enp8s0
type=SYSCALL msg=audit(09/12/2017 19:35:54.063:4458) : arch=x86_64 syscall=socket success=yes exit=5 a0=local a1=SOCK_RAW a2=ip a3=0xb4 items=0 ppid=3251 pid=8963 auid=kcinimod uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts5 ses=1 comm=nethogs exe=/usr/sbin/nethogs subj=wheel.id:sysadm.role:nethogs.subj:s0 key=(null)
type=AVC msg=audit(09/12/2017 19:35:54.063:4458) : avc: denied { create } for pid=8963 comm=nethogs scontext=wheel.id:sysadm.role:nethogs.subj:s0 tcontext=wheel.id:sysadm.role:nethogs.subj:s0 tclass=socket permissive=1
type=PROCTITLE msg=audit(09/12/2017 19:35:07.983:4457) : proctitle=nethogs enp8s0
type=MMAP msg=audit(09/12/2017 19:35:07.983:4457) : fd=5 flags=MAP_SHARED
type=SYSCALL msg=audit(09/12/2017 19:35:07.983:4457) : arch=x86_64 syscall=mmap success=yes exit=140169557827584 a0=0x0 a1=0x200000 a2=PROT_READ|PROT_WRITE a3=MAP_SHARED items=0 ppid=3251 pid=8907 auid=kcinimod uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts5 ses=1 comm=nethogs exe=/usr/sbin/nethogs subj=wheel.id:sysadm.role:nethogs.subj:s0 key=(null)
type=AVC msg=audit(09/12/2017 19:35:07.983:4457) : avc: denied { map } for pid=8907 comm=nethogs path=socket:[103238] dev="sockfs" ino=103238 scontext=wheel.id:sysadm.role:nethogs.subj:s0 tcontext=wheel.id:sysadm.role:nethogs.subj:s0 tclass=packet_socket permissive=1
>
>
> --
> Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
> Dominick Grift
--
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
Attachment:
signature.asc
Description: PGP signature
