ifconfig/pipefs avc messages.

Daniel J Walsh dwalsh at redhat.com
Mon Aug 29 17:00:13 UTC 2005 

dragoran wrote:

> dragoran wrote:
>
> > I have found this messages in /var/log/audit/audit.log:
> >
> >> type=AVC msg=audit(1120371250.432:658540): avc:  denied  { write }
> >> for  pid=3342 comm="ifconfig" name=[11205] dev=pipefs ino=11205
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371250.432:658540): avc:  denied  { read }
> >> for  pid=3342 comm="ifconfig" name=[11205] dev=pipefs ino=11205
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371250.432:658540): avc:  denied  { write }
> >> for  pid=3342 comm="ifconfig" name=[11203] dev=pipefs ino=11203
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371250.432:658540): avc:  denied  { read }
> >> for  pid=3342 comm="ifconfig" name=[11203] dev=pipefs ino=11203
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371250.432:658540): avc:  denied  { write }
> >> for  pid=3342 comm="ifconfig" name=[11202] dev=pipefs ino=11202
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371250.432:658540): avc:  denied  { read }
> >> for  pid=3342 comm="ifconfig" name=[11202] dev=pipefs ino=11202
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371250.432:658540): avc:  denied  { write }
> >> for  pid=3342 comm="ifconfig" name=[11201] dev=pipefs ino=11201
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371250.432:658540): avc:  denied  { read }
> >> for  pid=3342 comm="ifconfig" name=[11201] dev=pipefs ino=11201
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371250.432:658540): avc:  denied  { write }
> >> for  pid=3342 comm="ifconfig" name=[11687] dev=pipefs ino=11687
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371250.432:658540): avc:  denied  { write }
> >> for  pid=3342 comm="ifconfig" name=[11687] dev=pipefs ino=11687
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=PATH msg=audit(1120371251.502:661490): item=1 inode=2127845
> >> dev=08:05 mode=0100755 ouid=0 ogid=0 rdev=00:00
> >> type=PATH msg=audit(1120371251.502:661490): item=0
> >> name="/sbin/ifconfig" inode=9297060 dev=08:05 mode=0100755 ouid=0
> >> ogid=0 rdev=00:00
> >> type=AVC_PATH msg=audit(1120371251.502:661490):  path="pipe:[11687]"
> >> type=AVC_PATH msg=audit(1120371251.502:661490):  path="pipe:[11687]"
> >> type=AVC_PATH msg=audit(1120371251.502:661490):  path="pipe:[11201]"
> >> type=AVC_PATH msg=audit(1120371251.502:661490):  path="pipe:[11201]"
> >> type=AVC_PATH msg=audit(1120371251.502:661490):  path="pipe:[11202]"
> >> type=AVC_PATH msg=audit(1120371251.502:661490):  path="pipe:[11202]"
> >> type=AVC_PATH msg=audit(1120371251.502:661490):  path="pipe:[11203]"
> >> type=AVC_PATH msg=audit(1120371251.502:661490):  path="pipe:[11203]"
> >> type=AVC_PATH msg=audit(1120371251.502:661490):  path="pipe:[11205]"
> >> type=AVC_PATH msg=audit(1120371251.502:661490):  path="pipe:[11205]"
> >> type=SYSCALL msg=audit(1120371251.502:661490): arch=c000003e
> >> syscall=59 success=yes exit=0 a0=627990 a1=627cb0 a2=608440
> >> a3=2aaaaaac5000 items=2 pid=3370 auid=4294967295 uid=0 gid=0 euid=0
> >> suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="ifconfig"
> >> exe="/sbin/ifconfig"
> >> type=AVC msg=audit(1120371251.502:661490): avc:  denied  { write }
> >> for  pid=3370 comm="ifconfig" name=[11205] dev=pipefs ino=11205
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371251.502:661490): avc:  denied  { read }
> >> for  pid=3370 comm="ifconfig" name=[11205] dev=pipefs ino=11205
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371251.502:661490): avc:  denied  { write }
> >> for  pid=3370 comm="ifconfig" name=[11203] dev=pipefs ino=11203
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371251.502:661490): avc:  denied  { read }
> >> for  pid=3370 comm="ifconfig" name=[11203] dev=pipefs ino=11203
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371251.502:661490): avc:  denied  { write }
> >> for  pid=3370 comm="ifconfig" name=[11202] dev=pipefs ino=11202
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371251.502:661490): avc:  denied  { read }
> >> for  pid=3370 comm="ifconfig" name=[11202] dev=pipefs ino=11202
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371251.502:661490): avc:  denied  { write }
> >> for  pid=3370 comm="ifconfig" name=[11201] dev=pipefs ino=11201
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371251.502:661490): avc:  denied  { read }
> >> for  pid=3370 comm="ifconfig" name=[11201] dev=pipefs ino=11201
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371251.502:661490): avc:  denied  { write }
> >> for  pid=3370 comm="ifconfig" name=[11687] dev=pipefs ino=11687
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=AVC msg=audit(1120371251.502:661490): avc:  denied  { write }
> >> for  pid=3370 comm="ifconfig" name=[11687] dev=pipefs ino=11687
> >> scontext=root:system_r:ifconfig_t tcontext=root:system_r:unconfined_t
> >> tclass=fifo_file
> >> type=PATH msg=audit(1120371251.510:662032): item=1 inode=2127845
> >> dev=08:05 mode=0100755 ouid=0 ogid=0 rdev=00:00
> >> type=PATH msg=audit(1120371251.510:662032): item=0 name="/sbin/ip"
> >> inode=9297052 dev=08:05 mode=0100755 ouid=0 ogid=0 rdev=00:00
> >
> >
> > I did fixfiles relabel but it have'nt fixed them.
> > Whats the problem?
> > bug in the policy? (using fc4 and selinux-policy-targeted-1.25.3-12)
> >
> > --
> > fedora-selinux-list mailing list
> > fedora-selinux-list at redhat.com
> > http://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >
> >
> found out that iplugd from fc extras was causing this.
> its labeled as:
>
> > ls -Z /usr/sbin/ifplugd
> > -rwxr-xr-x  root     root     system_u:object_r:sbin_t        > 
> /usr/sbin/ifplugd
>
Could you label this NetworkManager_exec_t?  And do a restart?
Do the messages go away?

>
>
>
> -- 
> fedora-selinux-list mailing list
> fedora-selinux-list at redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list



--

More information about the fedora-selinux-list mailing list