selinux freaking out about cifs share

selinux freaking out about cifs share

[Lucas Emery]

Someone on #selinux suggested I post this issue I'm having to the list, so here goes.

I've got pages and pages of the following error in /var/log/messages:

SELinux is preventing httpd (httpd_t) "0x100000" to 'somefile' (httpd_sys_content_t).

The files in question are on a remote cifs share.  SELinux context on all files is httpd_sys_content_t.

Output of sealert follows:

Summary:

SELinux is preventing httpd (httpd_t) "0x100000" to 'somefile'
(httpd_sys_content_t).

Additional Information:

Source Context                root:system_r:httpd_t
Target Context                system_u:object_r:httpd_sys_content_t
Target Objects                'blah' [ file ]
Source                        httpd
Source Path                   /usr/sbin/httpd
Port                          <Unknown>
Host                          localhost
Source RPM Packages           httpd-2.2.3-11.el5_1.centos.3
Target RPM Packages
Policy RPM                    selinux-policy-2.4.6-137.1.el5
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall_file
Host Name                     localhost
Platform                      Linux localhost 2.6.18-92.1.6.el5 #1 SMP Wed
Jun 25
                             13:49:24 EDT 2008 i686 i686
Alert Count                   43
First Seen                    Mon Aug  4 11:10:09 2008
Last Seen                     Wed Aug  6 11:25:14 2008
Local ID                      4f544c6a-2eb9-4025-8bcf-f4c4383f26d2
Line Numbers

Raw Audit Messages

host=localhost type=AVC msg=audit(1218036314.997:95776): avc:  denied  {
0x100000 } for  pid=10564 comm="httpd" name="241" dev=cifs ino=7278187
scontext=root:system_r:httpd_t:s0
tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file

host=localhost type=SYSCALL msg=audit(1218036314.997:95776): arch=40000003
syscall=195 success=no exit=-13 a0=9bc1a10 a1=bfa580bc a2=333ff4 a3=8170
items=0 ppid=10496 pid=10564 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48
egid=48 sgid=48 fsgid=48 tty=(none) ses=511 comm="httpd"
exe="/usr/sbin/httpd" subj=root:system_r:httpd_t:s0 key=(null)

I'm running CIFS module version 1.50cRH

Red Hat thinks this is a kernel bug and I have filed a bug report with them.

I can temporarily fix the problem with a reboot, but that's  treating the symptom and not the cause, and this is a production box so random reboots are not really a workable solution.

Thanks,

Lucas

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: selinux freaking out about cifs share

[Justin Mattock]

On Wed, Aug 6, 2008 at 11:49 AM, Lucas Emery <lucas@rowdy.com> wrote:
> Someone on #selinux suggested I post this issue I'm having to the list, so here goes.
>
> I've got pages and pages of the following error in /var/log/messages:
>
> SELinux is preventing httpd (httpd_t) "0x100000" to 'somefile' (httpd_sys_content_t).
>
> The files in question are on a remote cifs share.  SELinux context on all files is httpd_sys_content_t.
>
> Output of sealert follows:
>
> Summary:
>
> SELinux is preventing httpd (httpd_t) "0x100000" to 'somefile'
> (httpd_sys_content_t).
>
> Additional Information:
>
> Source Context                root:system_r:httpd_t
> Target Context                system_u:object_r:httpd_sys_content_t
> Target Objects                'blah' [ file ]
> Source                        httpd
> Source Path                   /usr/sbin/httpd
> Port                          <Unknown>
> Host                          localhost
> Source RPM Packages           httpd-2.2.3-11.el5_1.centos.3
> Target RPM Packages
> Policy RPM                    selinux-policy-2.4.6-137.1.el5
> Selinux Enabled               True
> Policy Type                   targeted
> MLS Enabled                   True
> Enforcing Mode                Enforcing
> Plugin Name                   catchall_file
> Host Name                     localhost
> Platform                      Linux localhost 2.6.18-92.1.6.el5 #1 SMP Wed
> Jun 25
>                             13:49:24 EDT 2008 i686 i686
> Alert Count                   43
> First Seen                    Mon Aug  4 11:10:09 2008
> Last Seen                     Wed Aug  6 11:25:14 2008
> Local ID                      4f544c6a-2eb9-4025-8bcf-f4c4383f26d2
> Line Numbers
>
> Raw Audit Messages
>
> host=localhost type=AVC msg=audit(1218036314.997:95776): avc:  denied  {
> 0x100000 } for  pid=10564 comm="httpd" name="241" dev=cifs ino=7278187
> scontext=root:system_r:httpd_t:s0
> tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
>
> host=localhost type=SYSCALL msg=audit(1218036314.997:95776): arch=40000003
> syscall=195 success=no exit=-13 a0=9bc1a10 a1=bfa580bc a2=333ff4 a3=8170
> items=0 ppid=10496 pid=10564 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48
> egid=48 sgid=48 fsgid=48 tty=(none) ses=511 comm="httpd"
> exe="/usr/sbin/httpd" subj=root:system_r:httpd_t:s0 key=(null)
>
> I'm running CIFS module version 1.50cRH
>
> Red Hat thinks this is a kernel bug and I have filed a bug report with them.
>
> I can temporarily fix the problem with a reboot, but that's  treating the symptom and not the cause, and this is a production box so random reboots are not really a workable solution.
>
> Thanks,
>
> Lucas
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
>

I'm not an expert with SELinux, hopefully
somebody can jump in and give you the correct diagnosis,
but by just looking
at the avc's maybe you need to start
httpd in another domain, or role.
regards;


-- 
Justin P. Mattock

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: selinux freaking out about cifs share

[max]

Lucas Emery wrote:
> Someone on #selinux suggested I post this issue I'm having to the list, so here goes.
> 
> I've got pages and pages of the following error in /var/log/messages:
> 
> SELinux is preventing httpd (httpd_t) "0x100000" to 'somefile' (httpd_sys_content_t).
> 
> The files in question are on a remote cifs share.  SELinux context on all files is httpd_sys_content_t.
> 
> Output of sealert follows:
> 
> Summary:
> 
> SELinux is preventing httpd (httpd_t) "0x100000" to 'somefile'
> (httpd_sys_content_t).
> 
> Additional Information:
> 
> Source Context                root:system_r:httpd_t
> Target Context                system_u:object_r:httpd_sys_content_t
> Target Objects                'blah' [ file ]
> Source                        httpd
> Source Path                   /usr/sbin/httpd
> Port                          <Unknown>
> Host                          localhost
> Source RPM Packages           httpd-2.2.3-11.el5_1.centos.3
> Target RPM Packages
> Policy RPM                    selinux-policy-2.4.6-137.1.el5
> Selinux Enabled               True
> Policy Type                   targeted
> MLS Enabled                   True
> Enforcing Mode                Enforcing
> Plugin Name                   catchall_file
> Host Name                     localhost
> Platform                      Linux localhost 2.6.18-92.1.6.el5 #1 SMP Wed
> Jun 25
>                              13:49:24 EDT 2008 i686 i686
> Alert Count                   43
> First Seen                    Mon Aug  4 11:10:09 2008
> Last Seen                     Wed Aug  6 11:25:14 2008
> Local ID                      4f544c6a-2eb9-4025-8bcf-f4c4383f26d2
> Line Numbers
> 
> Raw Audit Messages
> 
> host=localhost type=AVC msg=audit(1218036314.997:95776): avc:  denied  {
> 0x100000 } for  pid=10564 comm="httpd" name="241" dev=cifs ino=7278187
> scontext=root:system_r:httpd_t:s0
> tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
> 
> host=localhost type=SYSCALL msg=audit(1218036314.997:95776): arch=40000003
> syscall=195 success=no exit=-13 a0=9bc1a10 a1=bfa580bc a2=333ff4 a3=8170
> items=0 ppid=10496 pid=10564 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48
> egid=48 sgid=48 fsgid=48 tty=(none) ses=511 comm="httpd"
> exe="/usr/sbin/httpd" subj=root:system_r:httpd_t:s0 key=(null)
> 
> I'm running CIFS module version 1.50cRH
> 
> Red Hat thinks this is a kernel bug and I have filed a bug report with them.
> 
> I can temporarily fix the problem with a reboot, but that's  treating the symptom and not the cause, and this is a production box so random reboots are not really a workable solution.
> 
> Thanks,
> 
> Lucas
> 

Looks like the same problem your having, have you seen this?

http://www.nsa.gov/selinux/list-archive/0606/thread_body10.cfm#15927


-Max


-- 
Fortune favors the *BOLD*

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.