<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
</head>
<body bgcolor="#ffffff" text="#000000">
I just realized I sent this to myself instead of to the list...<br>
<br>
-------- Original Message --------
<table class="moz-email-headers-table" border="0" cellpadding="0"
cellspacing="0">
<tbody>
<tr>
<th align="right" nowrap="nowrap" valign="baseline">Subject: </th>
<td>Re: Access attempts</td>
</tr>
<tr>
<th align="right" nowrap="nowrap" valign="baseline">Date: </th>
<td>Fri, 12 Jan 2007 17:13:13 -0700</td>
</tr>
<tr>
<th align="right" nowrap="nowrap" valign="baseline">From: </th>
<td>Ken <a class="moz-txt-link-rfc2396E" href="mailto:mantaray_1@cox.net"><mantaray_1@cox.net></a></td>
</tr>
<tr>
<th align="right" nowrap="nowrap" valign="baseline">To: </th>
<td>Ken <a class="moz-txt-link-rfc2396E" href="mailto:mantaray_1@cox.net"><mantaray_1@cox.net></a></td>
</tr>
<tr>
<th align="right" nowrap="nowrap" valign="baseline">References: </th>
<td><a class="moz-txt-link-rfc2396E" href="mailto:45A81E60.9020409@cox.net"><45A81E60.9020409@cox.net></a></td>
</tr>
</tbody>
</table>
<br>
<br>
<pre>Ken wrote:
> I was hoping someone could help me to understand what might be
> happening to trigger the access attempts I am blocking with my policy
> which are listed below. They only seem to appear when I am logged in
> to the "Blackboard" program at the university I attend. I have
> already taken several steps to limit what my browser can do, and I do
> not understand how it can trigger such attempts.
> **********************
> **********************
> Jan 11 15:39:17 schoolhost kernel: audit(1168555157.756:587): avc:
> denied { rawip_send } for saddr=192.168.0.2 src=60945
> daddr=129.219.10.40 dest=443 netif=eth0
> scontext=system_u:system_r:kernel_t:s15:c0.c255
> tcontext=system_u:object_r:netif_eth0_t:s0-s15:c0.c255 tclass=netif
>
> Jan 11 15:39:17 schoolhost kernel: audit(1168555157.992:588): avc:
> denied { rawip_send } for saddr=192.168.0.2 src=60945
> daddr=129.219.10.40 dest=443 netif=eth0
> scontext=system_u:system_r:kernel_t:s15:c0.c255
> tcontext=system_u:object_r:netif_eth0_t:s0-s15:c0.c255 tclass=netif
>
> Jan 11 15:39:18 schoolhost kernel: audit(1168555158.212:590): avc:
> denied { rawip_send } for saddr=192.168.0.2 src=45910
> daddr=129.219.10.30 dest=443 netif=eth0
> scontext=system_u:system_r:kernel_t:s15:c0.c255
> tcontext=system_u:object_r:netif_eth0_t:s0-s15:c0.c255 tclass=netif
>
> Jan 11 15:39:19 schoolhost kernel: audit(1168555159.433:600): avc:
> denied { rawip_send } for pid=2465 comm="X" saddr=192.168.0.2
> src=60945 daddr=129.219.10.40 dest=443 netif=eth0
> scontext=system_u:system_r:kernel_t:s15:c0.c255
> tcontext=system_u:object_r:netif_eth0_t:s0-s15:c0.c255 tclass=netif
> **********************
> **********************
>
> Thanks in advance,
> Ken.
>
> --
> fedora-selinux-list mailing list
> <a class="moz-txt-link-abbreviated" href="mailto:fedora-selinux-list@redhat.com">fedora-selinux-list@redhat.com</a>
> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/fedora-selinux-list">https://www.redhat.com/mailman/listinfo/fedora-selinux-list</a>
>
I just noticed that I sent the wrong part of the log. I accidentally
removed this from the previous post instead of the repeated messages:
************
************
Jan 11 15:39:18 schoolhost kernel: audit(1168555158.481:593): avc:
denied { rawip_send } for pid=417 comm="kjournald" saddr=192.168.0.2
src=45910 daddr=129.219.10.30 dest=443 netif=eth0
scontext=system_u:system_r:kernel_t:s15:c0.c255
tcontext=system_u:object_r:netif_eth0_t:s0-s15:c0.c255 tclass=netif
************
************
My concern is that somehow the browser seems to be able to entice other
running processes, such as "X" and "kjournald" to attempt Internet access.
-Ken-
</pre>
</body>
</html>