error when adding a translation with "semanage translation -a"
Murray McAllister
mmcallis at redhat.com
Tue Sep 2 01:04:09 UTC 2008
Hi,
This is probably user error. I want to add a translation:
1. sudo cat /etc/selinux/targeted/setrans.conf
s0=
s0-s0:c0.c1023=SystemLow-SystemHigh
s0:c0.c1023=SystemHigh
2. $ sudo semanage translation -l
Level Translation
s0
s0-s0:c0.c1023 SystemLow-SystemHigh
s0:c0.c1023 SystemHigh
3. Attempt to add a new translation:
$ sudo semanage translation -a -T NotSecret s0:c1
/etc/init.d/functions: line 19: /sbin/consoletype: Permission denied
basename: write error: Permission denied
basename: write error: Permission denied
env: /etc/init.d/mcstrans: Permission denied
4. Translation appears to have been added:
sudo semanage translation -l
Level Translation
s0
s0-s0:c0.c1023 SystemLow-SystemHigh
s0:c0.c1023 SystemHigh
s0:c1 NotSecret
sudo cat /etc/selinux/targeted/setrans.conf
s0=
s0-s0:c0.c1023=SystemLow-SystemHigh
s0:c0.c1023=SystemHigh
s0:c1=NotSecret
The following is logged to /var/log/messages:
Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing service
(semanage_t) "execute" to ./consoletype (consoletype_exec_t). For
complete SELinux messages. run sealert -l
3a9da9b1-9310-492b-a4fd-3706d8d78259
Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing service
(semanage_t) "execute" to ./consoletype (consoletype_exec_t). For
complete SELinux messages. run sealert -l
3a9da9b1-9310-492b-a4fd-3706d8d78259
Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing service
(semanage_t) "read" to pipe (semanage_t). For complete SELinux messages.
run sealert -l 154967ff-45a0-4b8f-bf04-25546f129dd3
Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing service
(semanage_t) "read" to pipe (semanage_t). For complete SELinux messages.
run sealert -l 154967ff-45a0-4b8f-bf04-25546f129dd3
Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing basename
(semanage_t) "getattr" to pipe (semanage_t). For complete SELinux
messages. run sealert -l 641f7545-c40c-4d79-84c7-97e2b32d8c0a
Aug 31 20:57:00 localhost setroubleshoot: SELinux is preventing basename
(semanage_t) "write" to pipe (semanage_t). For complete SELinux
messages. run sealert -l 2ab7598a-b0f7-4dec-a10d-cb4cfac057ee
Aug 31 20:57:01 localhost setroubleshoot: SELinux is preventing basename
(semanage_t) "getattr" to pipe (semanage_t). For complete SELinux
messages. run sealert -l 641f7545-c40c-4d79-84c7-97e2b32d8c0a
Aug 31 20:57:01 localhost setroubleshoot: SELinux is preventing basename
(semanage_t) "write" to pipe (semanage_t). For complete SELinux
messages. run sealert -l 2ab7598a-b0f7-4dec-a10d-cb4cfac057ee
Aug 31 20:57:01 localhost setroubleshoot: SELinux is preventing service
(semanage_t) "read" to pipe (semanage_t). For complete SELinux messages.
run sealert -l 154967ff-45a0-4b8f-bf04-25546f129dd3
Aug 31 20:57:01 localhost setroubleshoot: SELinux is preventing env
(semanage_t) "transition" to /etc/rc.d/init.d/mcstrans (semanage_t). For
complete SELinux messages. run sealert -l
ac0f934e-29dc-4702-a2f4-3a752150cb8f
The following is logged to /var/log/audit/audit.log:
type=AVC msg=audit(1220180220.598:367): avc: denied { execute } for
pid=2118 comm="service" name="consoletype" dev=sda5 ino=73034
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=system_u:object_r:consoletype_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1220180220.598:367): arch=40000003 syscall=11
success=no exit=-13 a0=8d4c760 a1=8d4c7a8 a2=8d4c3b8 a3=0 items=0
ppid=2117 pid=2118 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 ses=1 comm="service" exe="/bin/bash"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.599:368): avc: denied { execute } for
pid=2118 comm="service" name="consoletype" dev=sda5 ino=73034
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=system_u:object_r:consoletype_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1220180220.599:368): arch=40000003 syscall=33
success=no exit=-13 a0=8d4c760 a1=1 a2=11 a3=8d4c760 items=0 ppid=2117
pid=2118 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 ses=1 comm="service" exe="/bin/bash"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.637:369): avc: denied { read } for
pid=2116 comm="service" path="pipe:[12134]" dev=pipefs ino=12134
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tclass=fifo_file
type=SYSCALL msg=audit(1220180220.637:369): arch=40000003 syscall=3
success=no exit=-13 a0=3 a1=bfb075c8 a2=80 a3=80 items=0 ppid=2115
pid=2116 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 ses=1 comm="service" exe="/bin/bash"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.679:370): avc: denied { read } for
pid=2116 comm="service" path="pipe:[12135]" dev=pipefs ino=12135
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tclass=fifo_file
type=SYSCALL msg=audit(1220180220.679:370): arch=40000003 syscall=3
success=no exit=-13 a0=3 a1=bfb079c8 a2=80 a3=80 items=0 ppid=2115
pid=2116 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 ses=1 comm="service" exe="/bin/bash"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.694:371): avc: denied { getattr } for
pid=2119 comm="basename" path="pipe:[12135]" dev=pipefs ino=12135
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tclass=fifo_file
type=SYSCALL msg=audit(1220180220.694:371): arch=40000003 syscall=197
success=no exit=-13 a0=1 a1=bfd3e414 a2=960ff4 a3=9614c0 items=0
ppid=2116 pid=2119 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 ses=1 comm="basename" exe="/bin/basename"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.708:372): avc: denied { write } for
pid=2119 comm="basename" path="pipe:[12135]" dev=pipefs ino=12135
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tclass=fifo_file
type=SYSCALL msg=audit(1220180220.708:372): arch=40000003 syscall=4
success=no exit=-13 a0=1 a1=b7f3d000 a2=8 a3=8 items=0 ppid=2116
pid=2119 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 ses=1 comm="basename" exe="/bin/basename"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.727:373): avc: denied { getattr } for
pid=2120 comm="basename" path="pipe:[12136]" dev=pipefs ino=12136
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tclass=fifo_file
type=SYSCALL msg=audit(1220180220.727:373): arch=40000003 syscall=197
success=no exit=-13 a0=1 a1=bffb9684 a2=960ff4 a3=9614c0 items=0
ppid=2116 pid=2120 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 ses=1 comm="basename" exe="/bin/basename"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.728:374): avc: denied { write } for
pid=2120 comm="basename" path="pipe:[12136]" dev=pipefs ino=12136
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tclass=fifo_file
type=SYSCALL msg=audit(1220180220.728:374): arch=40000003 syscall=4
success=no exit=-13 a0=1 a1=b80b8000 a2=8 a3=8 items=0 ppid=2116
pid=2120 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 ses=1 comm="basename" exe="/bin/basename"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.749:375): avc: denied { read } for
pid=2116 comm="service" path="pipe:[12136]" dev=pipefs ino=12136
scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tclass=fifo_file
type=SYSCALL msg=audit(1220180220.749:375): arch=40000003 syscall=3
success=no exit=-13 a0=3 a1=bfb079c8 a2=80 a3=80 items=0 ppid=2115
pid=2116 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 ses=1 comm="service" exe="/bin/bash"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1220180220.760:376): avc: denied { transition } for
pid=2121 comm="env" path="/etc/rc.d/init.d/mcstrans" dev=sda5
ino=222868 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:semanage_t:s0 tclass=process
type=SYSCALL msg=audit(1220180220.760:376): arch=40000003 syscall=11
success=no exit=-13 a0=bfd449ce a1=bfd435b8 a2=9922858 a3=5 items=0
ppid=2116 pid=2121 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 ses=1 comm="env" exe="/bin/env"
subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
The system:
* Fedora release 9 (Sulphur)
* kernel-2.6.25.14-108.fc9.i686
* kernel-headers-2.6.25.14-108.fc9.i386
* policycoreutils-2.0.52-5.fc9.i386
* mcstrans-0.2.11-1.fc9.i386
* selinux-policy-targeted-3.3.1-84.fc9.noarch
* selinux-policy-3.3.1-84.fc9.noarch
* selinux-policy-devel-3.3.1-84.fc9.noarch
* libselinux-python-2.0.67-4.fc9.i386
* libselinux-2.0.67-4.fc9.i386
$ sestatus
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 22
Policy from config file: targeted
ps -eZ | grep mcs
system_u:system_r:setrans_t:SystemLow-SystemHigh 1262 ? 00:00:00 mcstransd
Regards,
Murray.
More information about the fedora-selinux-list
mailing list