SELinux alleged Attack!

[Karl Larsen]

Andy Green wrote:
> Somebody in the thread at some point said:
>   
>> Vinayak Mahadevan wrote:
>>     
>
>   
>>> let the machine  run for some days and then let us know your
>>> experience with the machine.
>>>       
>
>   
>>    So far so good. But I would like to know why SELinux did this. And
>> what do I need to do to to make SELinux work on this machine? There seem
>> to be others that use it and it works without a problem.
>>     
>
> If selinux is to blame for something, you always get a short AVC message
> about what was denied.  You can find these AVCs both on VC1 (during
> boot/initscripts) and in /var/log/messages.
>
> Put selinux back in permissive mode and copy the AVCs here.  If there
> are tons of them, just copy a representative sample.
>
> # grep avc /var/log/messages
>
> Also FWIW, if the story is that your symptoms exist in permissive mode
> but not in disabled, you're really saying there is a bad and somewhat
> unlikely bug in selinux.
>
> -Andy
>
>   
Here is what I got the day of the problem:


[root at k5di ~]# grep avc /var/log/messages
Oct 11 02:31:08 k5di dbus: Can't send to audit system: USER_AVC avc:  
received policyload notice (seqno=2) : exe="/bin/dbus-daemon" 
(sauid=500, hostname=?, addr=?, terminal=?)
Oct 11 02:31:20 k5di dbus: Can't send to audit system: USER_AVC avc:  
received policyload notice (seqno=3) : exe="/bin/dbus-daemon" 
(sauid=500, hostname=?, addr=?, terminal=?)
Oct 11 02:31:35 k5di dbus: Can't send to audit system: USER_AVC avc:  
received policyload notice (seqno=4) : exe="/bin/dbus-daemon" 
(sauid=500, hostname=?, addr=?, terminal=?)
Oct 11 02:31:49 k5di dbus: Can't send to audit system: USER_AVC avc:  
received policyload notice (seqno=5) : exe="/bin/dbus-daemon" 
(sauid=500, hostname=?, addr=?, terminal=?)
Oct 11 02:32:04 k5di dbus: Can't send to audit system: USER_AVC avc:  
received policyload notice (seqno=6) : exe="/bin/dbus-daemon" 
(sauid=500, hostname=?, addr=?, terminal=?)
Oct 11 02:52:39 k5di setroubleshoot: [avc.ERROR] Plugin Exception 
plugins.catchall_file  Traceback (most recent call last):   File 
"/usr/lib/python2.5/site-packages/setroubleshoot/analyze.py", line 259, 
in analyze_avc     report_receiver.report_problem(report)   File 
"/usr/lib/python2.5/site-packages/setroubleshoot/server.py", line 157, 
in report_problem     _(" For complete SELinux messages. run sealert -l 
%s" % siginfo.local_id )) UnicodeDecodeError: 'ascii' codec can't decode 
byte 0x93 in position 66: ordinal not in range(128)
Oct 11 02:52:39 k5di setroubleshoot: [avc.ERROR] Plugin Exception 
plugins.catchall  Traceback (most recent call last):   File 
"/usr/lib/python2.5/site-packages/setroubleshoot/analyze.py", line 259, 
in analyze_avc     report_receiver.report_problem(report)   File 
"/usr/lib/python2.5/site-packages/setroubleshoot/server.py", line 157, 
in report_problem     _(" For complete SELinux messages. run sealert -l 
%s" % siginfo.local_id )) UnicodeDecodeError: 'ascii' codec can't decode 
byte 0x93 in position 66: ordinal not in range(128)
[root at k5di ~]#

I can't make much out of it. Greek you know.



-- 

	Karl F. Larsen, AKA K5DI
	Linux User
	#450462   http://counter.li.org.