Kernel woes

Kernel woes

[Unix Admin]

Greetings all. After a recent reboot to one of my servers, the kernel 
began showing the following errors:

[root@odin logs]# uname -a
Linux odin 2.6.9-11.ELsmp #1 SMP Wed Jun 8 17:54:20 CDT 2005 i686 i686 
i386 GNU/Linux

Oct 17 09:01:05 odin kernel: post_create:  setxattr failed, rc=28 
(dev=sda1 ino=8339458)
Oct 17 09:05:33 odin kernel: post_create:  setxattr failed, rc=28 
(dev=sda1 ino=8339457)
Oct 17 09:05:33 odin kernel: post_create:  setxattr failed, rc=28 
(dev=sda1 ino=8339458)
Oct 17 09:06:57 odin kernel: post_create:  setxattr failed, rc=28 
(dev=sda1 ino=8339457)
Oct 17 09:06:57 odin kernel: post_create:  setxattr failed, rc=28 
(dev=sda1 ino=8339458)

Oct 17 09:01:05 odin kernel: audit(1129554065.524:0): avc:  denied  { 
write } for  pid=527 comm=httpd name=log dev=tmpfs ino=271982 
scontext=root:system_r:httpd_t tcontext=root:object_r:device_t 
tclass=sock_file
Oct 17 09:05:33 odin kernel: audit(1129554333.429:0): avc:  denied  { 
write } for  pid=522 comm=httpd name=log dev=tmpfs ino=271982 
scontext=root:system_r:httpd_t tcontext=root:object_r:device_t 
tclass=sock_file
Oct 17 09:06:21 odin kernel: audit(1129554381.723:0): avc:  denied  { 
write } for  pid=524 comm=httpd name=log dev=tmpfs ino=271982 
scontext=root:system_r:httpd_t tcontext=root:object_r:device_t 
tclass=sock_file
Oct 17 09:06:57 odin kernel: audit(1129554417.668:0): avc:  denied  { 
write } for  pid=527 comm=httpd name=log dev=tmpfs ino=271982 
scontext=root:system_r:httpd_t tcontext=root:object_r:device_t 
tclass=sock_file
Oct 17 09:17:10 odin kernel: audit(1129555030.530:0): avc:  denied  { 
write } for  pid=522 comm=httpd name=log dev=tmpfs ino=271982 
scontext=root:system_r:httpd_t tcontext=root:object_r:device_t 
tclass=sock_file
Oct 17 09:17:32 odin kernel: audit(1129555052.254:0): avc:  denied  { 
write } for  pid=525 comm=httpd name=log dev=tmpfs ino=271982 
scontext=root:system_r:httpd_t tcontext=root:object_r:device_t 
tclass=sock_file

No changes were made to anything but we had to recently reboot due to an 
IP collision. Any ideas on why this is happening, any pointers on where 
to check for perhaps permission errors?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Kernel woes

[Daniel J Walsh]

Unix Admin wrote:
> Greetings all. After a recent reboot to one of my servers, the kernel 
> began showing the following errors:
>
> [root@odin logs]# uname -a
> Linux odin 2.6.9-11.ELsmp #1 SMP Wed Jun 8 17:54:20 CDT 2005 i686 i686 
> i386 GNU/Linux
>
> Oct 17 09:01:05 odin kernel: post_create:  setxattr failed, rc=28 
> (dev=sda1 ino=8339458)
> Oct 17 09:05:33 odin kernel: post_create:  setxattr failed, rc=28 
> (dev=sda1 ino=8339457)
> Oct 17 09:05:33 odin kernel: post_create:  setxattr failed, rc=28 
> (dev=sda1 ino=8339458)
> Oct 17 09:06:57 odin kernel: post_create:  setxattr failed, rc=28 
> (dev=sda1 ino=8339457)
> Oct 17 09:06:57 odin kernel: post_create:  setxattr failed, rc=28 
> (dev=sda1 ino=8339458)
>
> Oct 17 09:01:05 odin kernel: audit(1129554065.524:0): avc:  denied  { 
> write } for  pid=527 comm=httpd name=log dev=tmpfs ino=271982 
> scontext=root:system_r:httpd_t tcontext=root:object_r:device_t 
> tclass=sock_file
> Oct 17 09:05:33 odin kernel: audit(1129554333.429:0): avc:  denied  { 
> write } for  pid=522 comm=httpd name=log dev=tmpfs ino=271982 
> scontext=root:system_r:httpd_t tcontext=root:object_r:device_t 
> tclass=sock_file
> Oct 17 09:06:21 odin kernel: audit(1129554381.723:0): avc:  denied  { 
> write } for  pid=524 comm=httpd name=log dev=tmpfs ino=271982 
> scontext=root:system_r:httpd_t tcontext=root:object_r:device_t 
> tclass=sock_file
> Oct 17 09:06:57 odin kernel: audit(1129554417.668:0): avc:  denied  { 
> write } for  pid=527 comm=httpd name=log dev=tmpfs ino=271982 
> scontext=root:system_r:httpd_t tcontext=root:object_r:device_t 
> tclass=sock_file
> Oct 17 09:17:10 odin kernel: audit(1129555030.530:0): avc:  denied  { 
> write } for  pid=522 comm=httpd name=log dev=tmpfs ino=271982 
> scontext=root:system_r:httpd_t tcontext=root:object_r:device_t 
> tclass=sock_file
> Oct 17 09:17:32 odin kernel: audit(1129555052.254:0): avc:  denied  { 
> write } for  pid=525 comm=httpd name=log dev=tmpfs ino=271982 
> scontext=root:system_r:httpd_t tcontext=root:object_r:device_t 
> tclass=sock_file
>
> No changes were made to anything but we had to recently reboot due to 
> an IP collision. Any ideas on why this is happening, any pointers on 
> where to check for perhaps permission errors?
>
>
> -- 
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to 
> majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
restorecon  /dev/log

should fix this.  But how did it happen?  Are you using udev?

Dan

-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Kernel woes (summary)

[Unix Admin]

Daniel J Walsh wrote:

> restorecon  /dev/log
>
> should fix this.  But how did it happen?  Are you using udev?
>
> Dan
>
restorecon didn't work.

Oct 17 10:40:31 odin kernel: post_create:  setxattr failed, rc=28 
(dev=sda1 ino=8339468)
Oct 17 10:40:31 odin kernel: audit(1129560031.871:0): avc:  denied  { 
connectto } for  pid=3823 comm=httpd path=/dev/log 
scontext=root:system_r:httpd_t tcontext=user_u:system_r:unconfined_t 
tclass=unix_stream_socket

I removed mod_security rules to minimize any potential security errors. 
Checked my permissions for the apache directory, still no dice. Rebooted 
forced fsck (reboot -F) ...

Checked disk space and I notice two volumes were not mounted so I 
mounted them, removed unecessary files
and voila. Got it working. Thanks to Stephen Smalley at the National 
Security Agency for pointing out simple error numbers ;)

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Kernel woes

[Stephen Smalley]

On Mon, 2005-10-17 at 10:16 +0000, Unix Admin wrote:
> Greetings all. After a recent reboot to one of my servers, the kernel 
> began showing the following errors:
> 
> [root@odin logs]# uname -a
> Linux odin 2.6.9-11.ELsmp #1 SMP Wed Jun 8 17:54:20 CDT 2005 i686 i686 
> i386 GNU/Linux
> 
> Oct 17 09:01:05 odin kernel: post_create:  setxattr failed, rc=28 
> (dev=sda1 ino=8339458)

errno 28 is ENOSPC, i.e. the filesystem is out of space so it cannot set
the extended attribute on the newly created file properly.  This means
that sda1 is out of space.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.