AVCs whilst installing latest F8 update batch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Paul Howarth wrote:
> Got a bunch of AVCs whilst installing these updates today:
> 
> Nov 22 07:50:15 Updated: bind-libs - 32:9.5.0-18.a7.fc8.x86_64
> Nov 22 07:50:17 Updated: pilot-link - 2:0.12.2-7.fc8.x86_64
> Nov 22 07:50:20 Updated: bind - 32:9.5.0-18.a7.fc8.x86_64
> Nov 22 07:50:22 Updated: smolt - 1.0-1.fc8.noarch
> Nov 22 07:50:25 Updated: system-config-firewall-tui - 1.0.11-1.fc8.noarch
> Nov 22 07:50:25 Updated: bind-utils - 32:9.5.0-18.a7.fc8.x86_64
> Nov 22 07:50:29 Updated: system-config-firewall - 1.0.11-1.fc8.noarch
> Nov 22 07:50:29 Updated: smolt-firstboot - 1.0-1.fc8.noarch
> Nov 22 07:50:35 Updated: bind-chroot - 32:9.5.0-18.a7.fc8.x86_64
> Nov 22 07:50:37 Updated: setroubleshoot-plugins - 1.10.4-1.fc8.noarch
> Nov 22 07:50:38 Updated: libao - 0.8.8-2.fc8.x86_64
> Nov 22 07:50:40 Updated: pilot-link - 2:0.12.2-7.fc8.i386
> 
> 
> Piping the AVCs into audit2allow -R yielded:
> 
> require {
>         type named_conf_t;
>         type setfiles_t;
>         type proc_t;
>         class lnk_file relabelfrom;
>         class dir relabelfrom;
>         class file relabelfrom;
>         class filesystem associate;
> }
> 
> #============= named_conf_t ==============
> allow named_conf_t proc_t:filesystem associate;
> 
> #============= setfiles_t ==============
> allow setfiles_t self:dir relabelfrom;
> allow setfiles_t self:file relabelfrom;
> allow setfiles_t self:lnk_file relabelfrom;
> kernel_getattr_core_if(setfiles_t)
> kernel_getattr_message_if(setfiles_t)
> kernel_read_device_sysctls(setfiles_t)
> kernel_read_kernel_sysctls(setfiles_t)
> kernel_read_net_sysctls(setfiles_t)
> kernel_read_software_raid_state(setfiles_t)
> kernel_read_vm_sysctls(setfiles_t)
> 
> As far as I can see, the updates installed OK.
> 
> I can post the raw audit messages if it's useful.
> 
> Paul.
> 
> -- 
> fedora-selinux-list mailing list
> fedora-selinux-list at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Most of these are caused by bind-chroot running a recursive restorecon
over the /var/chroot directory after /proc is mounted.   The restorecon
command runs over all the directories and tries to relabel them
named_conf_t including the /proc mounted under the chroot.  bind-chroot
should run the restorecon before mounting the file systems, which would
eliminate these avc's.  I have updated the bugzilla.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFHVCKmrlYvE4MpobMRAgzsAJsFX/TJCHznz3XTynhpG60tjspAfACeN8oL
OmS/X49YK/J9gNzvZTfFUHI=
=yetv
-----END PGP SIGNATURE-----