F7 : ntpd and selinux
Daniel J Walsh
dwalsh at redhat.com
Mon Jun 11 18:02:21 UTC 2007
Skunk Worx wrote:
> Daniel J Walsh wrote:
>> Skunk Worx wrote:
>>> Daniel J Walsh wrote:
>>>> Skunk Worx wrote:
>>>>> I can see similar comments in bugzilla, so I think this is already
>>>>> being worked.
>>>>> ---
>>>>> John
>>>>>
>>>>> > avc: denied { sys_time } for comm="ntpdate" egid=38 euid=38
>>>>>
>>>> Please attach the log file to show what is causing these messages.
>>>> I can't generate rules from just this info.
>>>>
>>> SELinux is preventing /usr/sbin/ntpdate (dhcpc_t) "sys_time" to
>>> <Unknown> (dhcpc_t).
>>>
>>> If this is not useful could you provide a command line and sample
>>> expected output?
>>>
>>> ---
>>> John
>>>
>> grep ntp /var/log/audit/audit.log
>>
>
> Thanks.
>
> type=AVC msg=audit(1181102914.825:33): avc: denied { getattr } for
> pid=3514 comm="ntpd" name="ntpd" dev=dm-0 ino=16581960
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:object_r:var_lock_t:s0 tclass=file
> type=SYSCALL msg=audit(1181102914.825:33): arch=40000003 syscall=195
> success=yes exit=0 a0=9d87298 a1=bfee9f78 a2=978ff4 a3=9d87298 items=0
> ppid=3507 pid=3514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=(none) comm="ntpd" exe="/bin/bash"
> subj=system_u:system_r:dhcpc_t:s0 key=(null)
> type=AVC_PATH msg=audit(1181102914.825:33): path="/var/lock/subsys/ntpd"
> type=AVC msg=audit(1181102914.825:34): avc: denied { getattr } for
> pid=3514 comm="ntpd" name="ntpd.pid" dev=dm-0 ino=16581959
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:object_r:ntpd_var_run_t:s0 tclass=file
> type=SYSCALL msg=audit(1181102914.825:34): arch=40000003 syscall=195
> success=yes exit=0 a0=9da3ce8 a1=bfee7b48 a2=978ff4 a3=9da3ce8 items=0
> ppid=3507 pid=3514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=(none) comm="ntpd" exe="/bin/bash"
> subj=system_u:system_r:dhcpc_t:s0 key=(null)
> type=AVC_PATH msg=audit(1181102914.825:34): path="/var/run/ntpd.pid"
> type=AVC msg=audit(1181102914.825:35): avc: denied { read } for
> pid=3514 comm="ntpd" name="ntpd.pid" dev=dm-0 ino=16581959
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:object_r:ntpd_var_run_t:s0 tclass=file
> type=SYSCALL msg=audit(1181102914.825:35): arch=40000003 syscall=5
> success=yes exit=3 a0=9da3d00 a1=8000 a2=0 a3=8000 items=0 ppid=3507
> pid=3514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=(none) comm="ntpd" exe="/bin/bash"
> subj=system_u:system_r:dhcpc_t:s0 key=(null)
> type=AVC msg=audit(1181102914.825:36): avc: denied { ioctl } for
> pid=3514 comm="ntpd" name="ntpd.pid" dev=dm-0 ino=16581959
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:object_r:ntpd_var_run_t:s0 tclass=file
> type=SYSCALL msg=audit(1181102914.825:36): arch=40000003 syscall=54
> success=no exit=-25 a0=0 a1=5401 a2=bfee7258 a3=bfee7298 items=0
> ppid=3507 pid=3514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=(none) comm="ntpd" exe="/bin/bash"
> subj=system_u:system_r:dhcpc_t:s0 key=(null)
> type=AVC_PATH msg=audit(1181102914.825:36): path="/var/run/ntpd.pid"
> type=AVC msg=audit(1181102914.825:37): avc: denied { kill } for
> pid=3514 comm="ntpd" capability=5
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:system_r:dhcpc_t:s0 tclass=capability
> type=AVC msg=audit(1181102914.825:37): avc: denied { signal } for
> pid=3514 comm="ntpd" scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:system_r:ntpd_t:s0 tclass=process
> type=SYSCALL msg=audit(1181102914.825:37): arch=40000003 syscall=37
> success=yes exit=0 a0=830 a1=f a2=830 a3=830 items=0 ppid=3507
> pid=3514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=(none) comm="ntpd" exe="/bin/bash"
> subj=system_u:system_r:dhcpc_t:s0 key=(null)
> type=AVC msg=audit(1181102914.825:38): avc: denied { unlink } for
> pid=3520 comm="rm" name="ntpd.pid" dev=dm-0 ino=16581959
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:object_r:ntpd_var_run_t:s0 tclass=file
> type=AVC msg=audit(1181102914.825:39): avc: denied { remove_name }
> for pid=3521 comm="rm" name="ntpd" dev=dm-0 ino=16581960
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:object_r:var_lock_t:s0 tclass=dir
> type=AVC msg=audit(1181102914.825:39): avc: denied { unlink } for
> pid=3521 comm="rm" name="ntpd" dev=dm-0 ino=16581960
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:object_r:var_lock_t:s0 tclass=file
> type=AVC msg=audit(1181102914.825:40): avc: denied { execute } for
> pid=3528 comm="ntpd" name="ntpdate" dev=dm-0 ino=2733415
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:object_r:ntpdate_exec_t:s0 tclass=file
> type=AVC msg=audit(1181102914.825:40): avc: denied {
> execute_no_trans } for pid=3528 comm="ntpd" name="ntpdate" dev=dm-0
> ino=2733415 scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:object_r:ntpdate_exec_t:s0 tclass=file
> type=AVC msg=audit(1181102914.825:40): avc: denied { read } for
> pid=3528 comm="ntpd" name="ntpdate" dev=dm-0 ino=2733415
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:object_r:ntpdate_exec_t:s0 tclass=file
> type=SYSCALL msg=audit(1181102914.825:40): arch=40000003 syscall=11
> success=yes exit=0 a0=9da1ac0 a1=9d82f60 a2=9d8fdd0 a3=0 items=0
> ppid=3514 pid=3528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=(none) comm="ntpdate"
> exe="/usr/sbin/ntpdate" subj=system_u:system_r:dhcpc_t:s0 key=(null)
> type=AVC_PATH msg=audit(1181102914.825:40): path="/usr/sbin/ntpdate"
> type=AVC_PATH msg=audit(1181102914.825:40): path="/usr/sbin/ntpdate"
> type=AVC msg=audit(1181102914.825:41): avc: denied { name_bind } for
> pid=3528 comm="ntpdate" src=123 scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:object_r:ntp_port_t:s0 tclass=udp_socket
> type=SYSCALL msg=audit(1181102914.825:41): arch=40000003 syscall=102
> success=yes exit=0 a0=2 a1=bfee8400 a2=8000f698 a3=0 items=0 ppid=3514
> pid=3528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=(none) comm="ntpdate" exe="/usr/sbin/ntpdate"
> subj=system_u:system_r:dhcpc_t:s0 key=(null)
> type=AVC msg=audit(1181102914.825:42): avc: denied { sys_nice } for
> pid=3528 comm="ntpdate" capability=23
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:system_r:dhcpc_t:s0 tclass=capability
> type=AVC msg=audit(1181102914.825:42): avc: denied { setsched } for
> pid=3528 comm="ntpdate" scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:system_r:dhcpc_t:s0 tclass=process
> type=SYSCALL msg=audit(1181102914.825:42): arch=40000003 syscall=97
> success=yes exit=0 a0=0 a1=0 a2=fffffff4 a3=2 items=0 ppid=3514
> pid=3528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=(none) comm="ntpdate" exe="/usr/sbin/ntpdate"
> subj=system_u:system_r:dhcpc_t:s0 key=(null)
> type=AVC msg=audit(1181102914.825:43): avc: denied { setgid } for
> pid=3528 comm="ntpdate" capability=6
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:system_r:dhcpc_t:s0 tclass=capability
> type=SYSCALL msg=audit(1181102914.825:43): arch=40000003 syscall=206
> success=yes exit=0 a0=0 a1=0 a2=325ff4 a3=2 items=0 ppid=3514 pid=3528
> auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
> fsgid=0 tty=(none) comm="ntpdate" exe="/usr/sbin/ntpdate"
> subj=system_u:system_r:dhcpc_t:s0 key=(null)
> type=AVC msg=audit(1181102914.825:44): avc: denied { setuid } for
> pid=3528 comm="ntpdate" capability=7
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:system_r:dhcpc_t:s0 tclass=capability
> type=SYSCALL msg=audit(1181102914.825:44): arch=40000003 syscall=208
> success=yes exit=0 a0=ffffffff a1=26 a2=ffffffff a3=2 items=0
> ppid=3514 pid=3528 auid=4294967295 uid=0 gid=0 euid=38 suid=0 fsuid=38
> egid=38 sgid=0 fsgid=38 tty=(none) comm="ntpdate"
> exe="/usr/sbin/ntpdate" subj=system_u:system_r:dhcpc_t:s0 key=(null)
> type=AVC msg=audit(1181102914.825:45): avc: denied { setcap } for
> pid=3528 comm="ntpdate" scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:system_r:dhcpc_t:s0 tclass=process
> type=SYSCALL msg=audit(1181102914.825:45): arch=40000003 syscall=185
> success=yes exit=0 a0=801fd0fc a1=801fd104 a2=cd70f0 a3=801fd0fc
> items=0 ppid=3514 pid=3528 auid=4294967295 uid=0 gid=0 euid=38 suid=0
> fsuid=38 egid=38 sgid=0 fsgid=38 tty=(none) comm="ntpdate"
> exe="/usr/sbin/ntpdate" subj=system_u:system_r:dhcpc_t:s0 key=(null)
> type=AVC msg=audit(1181102914.825:46): avc: denied { sys_time } for
> pid=3528 comm="ntpdate" capability=25
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:system_r:dhcpc_t:s0 tclass=capability
> type=SYSCALL msg=audit(1181102914.825:46): arch=40000003 syscall=124
> success=yes exit=0 a0=bfee7e4c a1=0 a2=325ff4 a3=0 items=0 ppid=3514
> pid=3528 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38
> egid=38 sgid=38 fsgid=38 tty=(none) comm="ntpdate"
> exe="/usr/sbin/ntpdate" subj=system_u:system_r:dhcpc_t:s0 key=(null)
> type=AVC msg=audit(1181102914.825:47): avc: denied { add_name } for
> pid=3532 comm="touch" name="ntpd"
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:object_r:var_lock_t:s0 tclass=dir
> type=AVC msg=audit(1181102914.825:47): avc: denied { create } for
> pid=3532 comm="touch" name="ntpd"
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:object_r:var_lock_t:s0 tclass=file
> type=AVC msg=audit(1181102914.825:48): avc: denied { write } for
> pid=3532 comm="touch" name="ntpd" dev=dm-0 ino=16581960
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:object_r:var_lock_t:s0 tclass=file
> type=AVC msg=audit(1181112994.480:61): avc: denied { sys_nice } for
> pid=4141 comm="ntpdate" capability=23
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:system_r:dhcpc_t:s0 tclass=capability
> type=SYSCALL msg=audit(1181112994.480:61): arch=40000003 syscall=97
> success=yes exit=0 a0=0 a1=0 a2=fffffff4 a3=2 items=0 ppid=4127
> pid=4141 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=(none) comm="ntpdate" exe="/usr/sbin/ntpdate"
> subj=system_u:system_r:dhcpc_t:s0 key=(null)
> type=AVC msg=audit(1181112994.480:62): avc: denied { setgid } for
> pid=4141 comm="ntpdate" capability=6
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:system_r:dhcpc_t:s0 tclass=capability
> type=SYSCALL msg=audit(1181112994.480:62): arch=40000003 syscall=206
> success=yes exit=0 a0=0 a1=0 a2=25fff4 a3=2 items=0 ppid=4127 pid=4141
> auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
> fsgid=0 tty=(none) comm="ntpdate" exe="/usr/sbin/ntpdate"
> subj=system_u:system_r:dhcpc_t:s0 key=(null)
> type=AVC msg=audit(1181112994.480:63): avc: denied { setuid } for
> pid=4141 comm="ntpdate" capability=7
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:system_r:dhcpc_t:s0 tclass=capability
> type=SYSCALL msg=audit(1181112994.480:63): arch=40000003 syscall=208
> success=yes exit=0 a0=ffffffff a1=26 a2=ffffffff a3=2 items=0
> ppid=4127 pid=4141 auid=4294967295 uid=0 gid=0 euid=38 suid=0 fsuid=38
> egid=38 sgid=0 fsgid=38 tty=(none) comm="ntpdate"
> exe="/usr/sbin/ntpdate" subj=system_u:system_r:dhcpc_t:s0 key=(null)
> type=AVC msg=audit(1181112994.480:64): avc: denied { sys_time } for
> pid=4141 comm="ntpdate" capability=25
> scontext=system_u:system_r:dhcpc_t:s0
> tcontext=system_u:system_r:dhcpc_t:s0 tclass=capability
> type=SYSCALL msg=audit(1181112994.480:64): arch=40000003 syscall=124
> success=yes exit=0 a0=bf9ab91c a1=0 a2=25fff4 a3=0 items=0 ppid=4127
> pid=4141 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38
> egid=38 sgid=38 fsgid=38 tty=(none) comm="ntpdate"
> exe="/usr/sbin/ntpdate" subj=system_u:system_r:dhcpc_t:s0 key=(null)
>
Added rules to allow this in selinux-policy-2.6.4-14
More information about the fedora-list
mailing list