avc denied messages from system cron

[Richard Hally]

Russell Coker wrote:

>On Mon, 14 Jun 2004 16:01, Richard Hally <rhallyx at mindspring.com> wrote:
>  
>
>>Jun 13 22:01:00 new2 kernel: audit(1087178460.748:0): avc:  denied  {
>>read } for  pid=3306 exe=/bin/bash name=mtab dev=hda2 ino=869481
>>scontext=system_u:system_r:crond_t
>>tcontext=system_u:object_r:etc_runtime_t tclass=file
>>Jun 13 22:01:00 new2 kernel: audit(1087178460.748:0): avc:  denied  {
>>getattr }
>>for  pid=3306 exe=/bin/bash path=/proc/meminfo dev=proc ino=-268435454
>>scontext=system_u:system_r:crond_t tcontext=system_u:object_r:proc_t
>>tclass=file
>>Jun 13 22:01:00 new2 kernel: audit(1087178460.792:0): avc:  denied  {
>>getattr }
>>for  pid=3306 exe=/bin/bash path=/usr/bin/run-parts dev=hda2 ino=55784
>>scontext=system_u:system_r:crond_t tcontext=system_u:object_r:bin_t
>>tclass=file
>>    
>>
>
>Do any other cron jobs execute correctly?
>  
>
No, I get errors from other system cron jobs as well. I don't run any 
user cron jobs.
Cron works correctly in permissive mode.

>I don't think that in the normal operation of the system there should be a 
>bash script launched in the crond_t domain which tries to run run-parts.  I 
>think that your crond is acting as if it does not support SE Linux.
>
>What version of libselinux do you have installed?  Maybe there is a bug in 
>libselinux which made cron misbehave.
>
>  
>
I have vixie-cron-3.0.1-89 and libselinux-1.13.3-2

here are a couple of the mail(1) messages root gets:
Message 1:
 From root at localhost.localdomain  Mon Jun 14 05:01:00 2004
Date: Mon, 14 Jun 2004 05:01:00 -0400
From: root at localhost.localdomain (Cron Daemon)
To: root at localhost.localdomain
Subject: Cron <root at new2> run-parts /etc/cron.hourly
X-Cron-Env: <SHELL=/bin/bash>
X-Cron-Env: <PATH=/sbin:/bin:/usr/sbin:/usr/bin>
X-Cron-Env: <MAILTO=root>
X-Cron-Env: <HOME=/>
X-Cron-Env: <LOGNAME=root>
 
/bin/bash: line 1: run-parts: command not found
 
Message 4:
 From mailman at localhost.localdomain  Mon Jun 14 08:00:01 2004
Date: Mon, 14 Jun 2004 08:00:01 -0400
From: root at localhost.localdomain (Cron Daemon)
To: mailman at localhost.localdomain
Subject: Cron <mailman at new2> /usr/bin/python -S /var/mailman/cron/checkdbs
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/var/mailman>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=mailman>
 
/bin/sh: line 1: /usr/bin/python: Permission denied
 
&

Richard Hally