Choosing A Webhost:
A web hosting service is a type of Internet hosting service that allows individuals and organizations to provide their own website accessible via the World Wide Web. Web hosts are companies that provide space on a server they own for use by their clients as well as providing Internet connectivity, typically in a data center. Web hosts can also provide data center space and connectivity to the Internet for servers they do not own to be located in their data center, called colocation. more...
|
Re: SELinux AVCs with swap stored in LVM volume: msg#00174
|
Subject: |
Re: SELinux AVCs with swap stored in LVM volume |
On Sun, 2005-10-30 at 11:11 +0200, Felipe Alfaro Solana wrote:
> Hello,
>
> I'm running Fedora Core RawHhide and I'm seeing lots of SELinux AVCs
> during boot, related to my swap stored in a LVM volume:
>
> audit(1130670344.636:4): avc: denied { read } for pid=919
> comm="restorecon" name="VolGroup00-Swap" dev=tmpfs ino=653
> scontext=system_u:system_r:restorecon_t:s0
> tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>
> audit(1130670345.668:5): avc: denied { use } for pid=932
> comm="fsck" name="VolGroup00-Swap" dev=tmpfs ino=653
> scontext=system_u:system_r:fsadm_t:s0
> tcontext=system_u:system_r:kernel_t:s0 tclass=fd
This implies that a process that ran before the initial policy load
by /sbin/init (hence a "kernel_t" file descriptor) opened the device
(hence a "fixed_disk_device_t" block device file) and failed to ever
close it (or mark it close-on-exec), thereby leaking it to all
descendants. Already bugzilla'd:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=165912
Dan, James - looks like this could just be a bug in lvm? Should be filed
against it?
--
Stephen Smalley
National Security Agency
|
| |
