Hi,
After sending the previous message with 'git send-email', I noticed
strange AVC denials in the logs. The first entry is correct, but the
next have PID 0 and 16:
time->Fri May 15 13:49:30 2020
type=PROCTITLE msg=audit(1589539770.992:1614):
proctitle=2F7573722F62696E2F7065726C002F7573722F6C69622F6769742D636F72652F6769742D73656E642D656D61696C002D2D736D74702D6465627567002D2D616E6E6F74617465002D2D746F0073656C696E757840766765722E6B65726E656C2E6F726700642F706F6C696379636F72657574696C732E6769742F303030312D73
type=SOCKADDR msg=audit(1589539770.992:1614):
saddr=020000197F0000010000000000000000
type=SYSCALL msg=audit(1589539770.992:1614): arch=c000003e syscall=42
success=no exit=-115 a0=7 a1=5a00209eba80 a2=10 a3=fffffffffffffa8b
items=0 ppid=10011 pid=10012 auid=1000 uid=1000 gid=1000 euid=1000
suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=1
comm="git-send-email" exe="/usr/bin/perl" subj=user_u:user_r:user_t:s0
key=(null)
type=AVC msg=audit(1589539770.992:1614): avc: denied { recv } for
pid=10012 comm="git-send-email" saddr=127.0.0.1 src=25 daddr=127.0.0.1
dest=45482 netif=lo scontext=user_u:user_r:user_t:s0
tcontext=system_u:object_r:smtp_server_packet_t:s0 tclass=packet
permissive=0
----
time->Fri May 15 13:49:32 2020
type=AVC msg=audit(1589539772.016:1615): avc: denied { recv } for
pid=16 comm="ksoftirqd/1" saddr=127.0.0.1 src=25 daddr=127.0.0.1
dest=45482 netif=lo scontext=user_u:user_r:user_t:s0
tcontext=system_u:object_r:smtp_server_packet_t:s0 tclass=packet
permissive=0
----
time->Fri May 15 13:49:38 2020
type=AVC msg=audit(1589539778.096:1617): avc: denied { recv } for
pid=0 comm="swapper/1" saddr=127.0.0.1 src=25 daddr=127.0.0.1 dest=45482
netif=lo scontext=user_u:user_r:user_t:s0
tcontext=system_u:object_r:smtp_server_packet_t:s0 tclass=packet
permissive=0
----
Could it be a bug in kernel somewhere (AVC generated from wrong context)
or should this be expected? The version of kernel is 5.3.7 and Netfilter
NFT rules label all packets with SECMARK.
-Topi
