XACE: tclass malformed

XACE: tclass malformed

[Dominick Grift]

[-- Attachment #1: Type: text/plain, Size: 720 bytes --]

Some XACE avc denials end up in /var/log/messages as opposed to /var/log/audit/audit.log. These particular XACE avc denials appear with a malformed tclass field:

Example:

Sep 10 17:50:31 notebook3 Xephyr: Can't send to audit system: USER_AVC avc:  denied  { get_property } for request=X11:GetProperty comm=/usr/bin/xterm resid=102 restype=WINDOW scontext=dgrift_u:dgrift_r:sandbox_x_client_t:s0:c29,c36 tcontext=dgrift_u:object_r:sandbox_xserver_t:s0:c29,c36 tclass=x_drawable#012: exe="/usr/bin/Xephyr" sauid=0 hostname=? addr=? terminal=?

note the: tclass=x_drawable#012:

I believe this may be the reason why these avc denials end up in /var/log/messages instead of /var/log/audit/audit.log , but i am not sure.



[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]

Re: XACE: tclass malformed

[Eamon Walsh]

On 09/10/2009 12:03 PM, Dominick Grift wrote:
> Some XACE avc denials end up in /var/log/messages as opposed to /var/log/audit/audit.log. These particular XACE avc denials appear with a malformed tclass field:
>
> Example:
>
> Sep 10 17:50:31 notebook3 Xephyr: Can't send to audit system: USER_AVC avc:  denied  { get_property } for request=X11:GetProperty comm=/usr/bin/xterm resid=102 restype=WINDOW scontext=dgrift_u:dgrift_r:sandbox_x_client_t:s0:c29,c36 tcontext=dgrift_u:object_r:sandbox_xserver_t:s0:c29,c36 tclass=x_drawable#012: exe="/usr/bin/Xephyr" sauid=0 hostname=? addr=? terminal=?
>
> note the: tclass=x_drawable#012:
>
> I believe this may be the reason why these avc denials end up in /var/log/messages instead of /var/log/audit/audit.log , but i am not sure.
>
>    

Can you take a look in /var/log/Xorg.0.log.  The same avc's are printed 
there, please let me know if the message is malformed in the Xorg.0.log 
file as well.



-- 
Eamon Walsh<ewalsh@tycho.nsa.gov>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: XACE: tclass malformed

[Dominick Grift]

[-- Attachment #1: Type: text/plain, Size: 1733 bytes --]

On Thu, Sep 10, 2009 at 04:29:07PM -0400, Eamon Walsh wrote:
> On 09/10/2009 12:03 PM, Dominick Grift wrote:
>> Some XACE avc denials end up in /var/log/messages as opposed to /var/log/audit/audit.log. These particular XACE avc denials appear with a malformed tclass field:
>>
>> Example:
>>
>> Sep 10 17:50:31 notebook3 Xephyr: Can't send to audit system: USER_AVC avc:  denied  { get_property } for request=X11:GetProperty comm=/usr/bin/xterm resid=102 restype=WINDOW scontext=dgrift_u:dgrift_r:sandbox_x_client_t:s0:c29,c36 tcontext=dgrift_u:object_r:sandbox_xserver_t:s0:c29,c36 tclass=x_drawable#012: exe="/usr/bin/Xephyr" sauid=0 hostname=? addr=? terminal=?
>>
>> note the: tclass=x_drawable#012:
>>
>> I believe this may be the reason why these avc denials end up in /var/log/messages instead of /var/log/audit/audit.log , but i am not sure.
>>
>>    
>
> Can you take a look in /var/log/Xorg.0.log.  The same avc's are printed  
> there, please let me know if the message is malformed in the Xorg.0.log  
> file as well.

I cannot find that particular AVC denial in /var/log/Xorg.0.log at all. It does have the AVC denials that end up in /var/log/audit/audit.log though. These have correct tclasses. For example:

[root@notebook3 Desktop]# cat /var/log/Xorg.0.log | grep X11:GetProperty | less | tail -n1
(WW) avc:  denied  { read } for request=X11:GetProperty comm=/usr/bin/xdpyinfo property=RESOURCE_MANAGER scontext=dgrift_u:dgrift_r:sandbox_x_t:s0:c170,c220 tcontext=system_u:object_r:info_xproperty_t:s0 tclass=x_property

So It seems that the avc denials that have malformed tclasses are not in there at all.`
>
>
>
> -- 
> Eamon Walsh<ewalsh@tycho.nsa.gov>
> National Security Agency
>

[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]

Re: XACE: tclass malformed

[Eamon Walsh]

On 09/10/2009 04:36 PM, Dominick Grift wrote:
> On Thu, Sep 10, 2009 at 04:29:07PM -0400, Eamon Walsh wrote:
>    
>> On 09/10/2009 12:03 PM, Dominick Grift wrote:
>>      
>>> Some XACE avc denials end up in /var/log/messages as opposed to /var/log/audit/audit.log. These particular XACE avc denials appear with a malformed tclass field:
>>>
>>> Example:
>>>
>>> Sep 10 17:50:31 notebook3 Xephyr: Can't send to audit system: USER_AVC avc:  denied  { get_property } for request=X11:GetProperty comm=/usr/bin/xterm resid=102 restype=WINDOW scontext=dgrift_u:dgrift_r:sandbox_x_client_t:s0:c29,c36 tcontext=dgrift_u:object_r:sandbox_xserver_t:s0:c29,c36 tclass=x_drawable#012: exe="/usr/bin/Xephyr" sauid=0 hostname=? addr=? terminal=?
>>>
>>> note the: tclass=x_drawable#012:
>>>
>>> I believe this may be the reason why these avc denials end up in /var/log/messages instead of /var/log/audit/audit.log , but i am not sure.
>>>
>>>        


I'm seeing malformed messages in /var/log/messages (with the #012) that 
have nothing to do with XACE.  So I think this is an audit bug.


-- 
Eamon Walsh<ewalsh@tycho.nsa.gov>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.