<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
On 06/23/2009 05:11 PM, Paul Howarth wrote:
<blockquote
cite="mid:20090623161119.760ffee5@metropolis.intra.city-fan.org"
type="cite">
<pre wrap="">On Mon, 22 Jun 2009 10:37:10 +0100
Paul Howarth <a class="moz-txt-link-rfc2396E" href="mailto:paul@city-fan.org"><paul@city-fan.org></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On 22/06/09 07:58, Paul Howarth wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On Sun, 21 Jun 2009 01:49:01 +0530
Rahul Sundaram<a class="moz-txt-link-rfc2396E" href="mailto:sundaram@fedoraproject.org"><sundaram@fedoraproject.org></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On 06/20/2009 04:41 PM, Daniel J Walsh wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On 06/19/2009 05:54 AM, Rahul Sundaram wrote:
Is it continuing to happen or was this a one time occurrence. The
only code that I imagine opens and reads /selinux/mls is
libselinux and this opens it, reads the value and closes the file
in the same function call, so it can not leak.
</pre>
</blockquote>
<pre wrap="">It happens everytime I connect to a CDMA network via NetworkManager
and run vpnc.
Rahul
</pre>
</blockquote>
<pre wrap="">I've just had a very similar denial, when starting openvpn via
NetworkManager:
type=AVC msg=audit(1245653684.772:27): avc: denied { read } for
pid=5486 comm="openvpn" name="mls" dev=selinuxfs ino=12
scontext=system_u:system_r:openvpn_t:s0
tcontext=system_u:object_r:security_t:s0 tclass=file type=SYSCALL
msg=audit(1245653684.772:27): arch=c000003e syscall=2 success=no
exit=-13 a0=7fff5652e270 a1=0 a2=7fff5652e27c a3=fffffff8 items=0
ppid=5475 pid=5486 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="openvpn"
exe="/usr/sbin/openvpn" subj=system_u:system_r:openvpn_t:s0
key=(null)
Didn't stop openvpn working.
</pre>
</blockquote>
<pre wrap="">Just got this one too, after running "rndc querylog" to turn on
named's query logging from a root shell.
type=AVC msg=audit(1245663191.793:115): avc: denied { read } for
pid=21774 comm="rndc" name="mls" dev=selinuxfs ino=12
scontext=unconfined_u:unconfined_r:ndc_t:s0-s0:c0.c1023
tcontext=system_u:object_r:security_t:s0 tclass=file
type=SYSCALL msg=audit(1245663191.793:115): arch=c000003e syscall=2
success=no exit=-13 a0=7fffa1a717d0 a1=0 a2=7fffa1a717dc a3=fffffff8
items=0 ppid=14800 pid=21774 auid=500 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts4 ses=5 comm="rndc"
exe="/usr/sbin/rndc"
subj=unconfined_u:unconfined_r:ndc_t:s0-s0:c0.c1023 key=(null)
</pre>
</blockquote>
<pre wrap=""><!---->
/usr/sbin/rndc is linked against libselinux, which ties in with
Stephen's explanation of the openvpn/vpnc issue too.
I'm adding these to local policy for now:
selinux_dontaudit_read_fs(ifconfig_t)
selinux_dontaudit_read_fs(ndc_t)
selinux_dontaudit_read_fs(openvpn_t)
Paul.
--
fedora-selinux-list mailing list
<a class="moz-txt-link-abbreviated" href="mailto:fedora-selinux-list@redhat.com">fedora-selinux-list@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/fedora-selinux-list">https://www.redhat.com/mailman/listinfo/fedora-selinux-list</a>
</pre>
</blockquote>
<br>
Fixed in selinux-policy-3.6.12-57.fc11<br>
</body>
</html>