SELinux kerneloops and dhclient issues

[Daniel J Walsh]

Stephen Croll wrote:
> Daniel J Walsh wrote:
>> The dhcp_t (/sbin/dhclient) trying to read/write an unconfined_t
>> unix_stream_socket, is a leaked file descriptor.  So it is a bug in some
>> application that you are using to bring up your network.  What app are
>> you using for this?
>>   
> 
> The following apps produce the issue: /sbin/ifup, /sbin/ifdown, and
> /sbin/dhclient.  Sample usage:
> 
> [root at gerbil ~]# /sbin/ifconfig
> lo        Link encap:Local Loopback
>          inet addr:127.0.0.1  Mask:255.0.0.0
>          inet6 addr: ::1/128 Scope:Host
>          UP LOOPBACK RUNNING  MTU:16436  Metric:1
>          RX packets:3776 errors:0 dropped:0 overruns:0 frame:0
>          TX packets:3776 errors:0 dropped:0 overruns:0 carrier:0
>          collisions:0 txqueuelen:0
>          RX bytes:188960 (184.5 KiB)  TX bytes:188960 (184.5 KiB)
> 
> [root at gerbil ~]# /sbin/ifup eth0    <---------------------- AVC Denial
> 
> Determining IP information for eth0... done.
> [root at gerbil ~]# /sbin/ifconfig
> eth0      Link encap:Ethernet  HWaddr 00:15:C5:3E:AC:A7
>          inet addr:192.168.2.4  Bcast:192.168.2.255  Mask:255.255.255.0
>          inet6 addr: fe80::215:c5ff:fe3e:aca7/64 Scope:Link
>          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>          RX packets:15 errors:0 dropped:0 overruns:0 frame:0
>          TX packets:152 errors:0 dropped:0 overruns:0 carrier:0
>          collisions:0 txqueuelen:1000
>          RX bytes:3507 (3.4 KiB)  TX bytes:34235 (33.4 KiB)
>          Interrupt:17
> 
> lo        Link encap:Local Loopback
>          inet addr:127.0.0.1  Mask:255.0.0.0
>          inet6 addr: ::1/128 Scope:Host
>          UP LOOPBACK RUNNING  MTU:16436  Metric:1
>          RX packets:3776 errors:0 dropped:0 overruns:0 frame:0
>          TX packets:3776 errors:0 dropped:0 overruns:0 carrier:0
>          collisions:0 txqueuelen:0
>          RX bytes:188960 (184.5 KiB)  TX bytes:188960 (184.5 KiB)
> 
> [root at gerbil ~]# /sbin/ifdown eth0    <---------------------- AVC Denial
> [root at gerbil ~]# /sbin/ifconfig
> lo        Link encap:Local Loopback
>          inet addr:127.0.0.1  Mask:255.0.0.0
>          inet6 addr: ::1/128 Scope:Host
>          UP LOOPBACK RUNNING  MTU:16436  Metric:1
>          RX packets:3776 errors:0 dropped:0 overruns:0 frame:0
>          TX packets:3776 errors:0 dropped:0 overruns:0 carrier:0
>          collisions:0 txqueuelen:0
>          RX bytes:188960 (184.5 KiB)  TX bytes:188960 (184.5 KiB)
> 
> [root at gerbil ~]# /sbin/ifconfig eth0 up
> [root at gerbil ~]# /sbin/ifconfig
> eth0      Link encap:Ethernet  HWaddr 00:15:C5:3E:AC:A7
>          inet6 addr: fe80::215:c5ff:fe3e:aca7/64 Scope:Link
>          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>          RX packets:16 errors:0 dropped:0 overruns:0 frame:0
>          TX packets:164 errors:0 dropped:0 overruns:0 carrier:0
>          collisions:0 txqueuelen:1000
>          RX bytes:3571 (3.4 KiB)  TX bytes:36889 (36.0 KiB)
>          Interrupt:17
> 
> lo        Link encap:Local Loopback
>          inet addr:127.0.0.1  Mask:255.0.0.0
>          inet6 addr: ::1/128 Scope:Host
>          UP LOOPBACK RUNNING  MTU:16436  Metric:1
>          RX packets:3776 errors:0 dropped:0 overruns:0 frame:0
>          TX packets:3776 errors:0 dropped:0 overruns:0 carrier:0
>          collisions:0 txqueuelen:0
>          RX bytes:188960 (184.5 KiB)  TX bytes:188960 (184.5 KiB)
> 
> [root at gerbil ~]# /sbin/dhclient eth0    <---------------------- AVC Denial
> [root at gerbil ~]# /sbin/ifconfig
> eth0      Link encap:Ethernet  HWaddr 00:15:C5:3E:AC:A7
>          inet addr:192.168.2.4  Bcast:192.168.2.255  Mask:255.255.255.0
>          inet6 addr: fe80::215:c5ff:fe3e:aca7/64 Scope:Link
>          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>          RX packets:17 errors:0 dropped:0 overruns:0 frame:0
>          TX packets:182 errors:0 dropped:0 overruns:0 carrier:0
>          collisions:0 txqueuelen:1000
>          RX bytes:3918 (3.8 KiB)  TX bytes:41608 (40.6 KiB)
>          Interrupt:17
> 
> lo        Link encap:Local Loopback
>          inet addr:127.0.0.1  Mask:255.0.0.0
>          inet6 addr: ::1/128 Scope:Host
>          UP LOOPBACK RUNNING  MTU:16436  Metric:1
>          RX packets:3776 errors:0 dropped:0 overruns:0 frame:0
>          TX packets:3776 errors:0 dropped:0 overruns:0 carrier:0
>          collisions:0 txqueuelen:0
>          RX bytes:188960 (184.5 KiB)  TX bytes:188960 (184.5 KiB)
> -- 
> Steve Croll
> 
So it looks like you already have a leaked file descriptor in the shell
that you are running these commands from

Does ls -lZ /proc/self/fd show anything stange?