[refpolicy] CentOS-6.2 /bin/ps selinux avc

James B. Byrne byrnejb at harte-lyne.ca
Tue Jul 3 10:54:03 CDT 2012


OS = CentOS-6.2 (RHEL6)

I have just noticed a large number of similar selinux entries in the
syslog on one of our hosts:

Jul  3 11:30:05 inet09 setroubleshoot: SELinux is preventing /bin/ps
from search access on the directory 1180. For complete SELinux
messages. run sealert -l f09d35d9-4dfc-4722-8ad2-f1ba2bf2442f

# sealert -l f09d35d9-4dfc-4722-8ad2-f1ba2bf2442f
SELinux is preventing /bin/ps from search access on the directory 1180.

*****  Plugin catchall (100. confidence) suggests  *******************

If you believe that ps should be allowed search access on the 1180
directory by default. Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do allow this access for now by executing:
# grep ps /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


# ls -Zd /proc/1180
dr-xr-xr-x. root root system_u:system_r:restorecond_t:s0 /proc/1180

# grep ps /var/log/audit/audit.log | audit2allow


#============= httpd_sys_script_t ==============
allow httpd_sys_script_t chkpwd_t:dir getattr;
allow httpd_sys_script_t fsadm_t:dir { getattr search };
allow httpd_sys_script_t fsadm_t:file { read open };
allow httpd_sys_script_t ifconfig_t:dir { getattr search };
allow httpd_sys_script_t ifconfig_t:file { read open };
allow httpd_sys_script_t logrotate_t:dir { getattr search };
allow httpd_sys_script_t logrotate_t:file { read open };
allow httpd_sys_script_t logwatch_mail_t:dir { getattr search };
allow httpd_sys_script_t logwatch_mail_t:file { read open };
allow httpd_sys_script_t logwatch_t:dir { getattr search };
allow httpd_sys_script_t logwatch_t:file { read open };
allow httpd_sys_script_t postfix_local_t:dir { getattr search };
allow httpd_sys_script_t postfix_local_t:file { read open };
allow httpd_sys_script_t postfix_postdrop_t:dir { getattr search };
allow httpd_sys_script_t postfix_postdrop_t:file { read open };
allow httpd_sys_script_t postfix_smtpd_t:dir { getattr search };
allow httpd_sys_script_t postfix_smtpd_t:file { read open };
allow httpd_sys_script_t restorecond_t:dir { getattr search };
allow httpd_sys_script_t restorecond_t:file { read open };
allow httpd_sys_script_t rpm_script_t:dir { getattr search };
allow httpd_sys_script_t rpm_script_t:file { read open };
allow httpd_sys_script_t rpm_t:dir { getattr search };
allow httpd_sys_script_t rpm_t:file { read open };
allow httpd_sys_script_t system_cronjob_t:dir { getattr search };
allow httpd_sys_script_t system_cronjob_t:file { read open };
allow httpd_sys_script_t system_mail_t:dir { getattr search };
allow httpd_sys_script_t system_mail_t:file { read open };
allow httpd_sys_script_t unconfined_mount_t:dir { getattr search };
allow httpd_sys_script_t unconfined_mount_t:file { read open };
allow httpd_sys_script_t unconfined_sendmail_t:dir { getattr search };
allow httpd_sys_script_t unconfined_sendmail_t:file { read open };


This happens to be the one host that we have SELinux set to
permissive, due to the presence of the Passenger Apache module.  We
also use the Webmin web based system administration tool on that
system.

I would appreciate any insights at to what these messages mean; what
is causing them; and whether producing a local policy as suggested is
recommended.  It seems to me that building a custom policy for an
ephemeral /proc directory is a waste of time but I have been wrong
before.

-- 
***          E-Mail is NOT a SECURE channel          ***
James B. Byrne                mailto:ByrneJB at Harte-Lyne.ca
Harte & Lyne Limited          http://www.harte-lyne.ca
9 Brockley Drive              vox: +1 905 561 1241
Hamilton, Ontario             fax: +1 905 561 0757
Canada  L8E 3C3



More information about the refpolicy mailing list