ping and the /tmp directory

ping and the /tmp directory

[Clarkson, Mike R (US SSA)]

Does the ping utility normally read/write to the /tmp directory?

I've got a domain that uses ping in the ping_t domain, using the
netutils_domtrans_ping interface, and I'm getting the following from
audit2allow:

allow ping_t tmp_t:file { read write getattr ioctl };

Thanks



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: ping and the /tmp directory

[Joe Nall]

On Jul 14, 2008, at 11:10 AM, Clarkson, Mike R (US SSA) wrote:

> Does the ping utility normally read/write to the /tmp directory?
>
> I've got a domain that uses ping in the ping_t domain, using the
> netutils_domtrans_ping interface, and I'm getting the following from
> audit2allow:
>
> allow ping_t tmp_t:file { read write getattr ioctl };

Is stdout of the parent process being redirected to a tmp file?

joe



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: ping and the /tmp directory

[Clarkson, Mike R (US SSA)]

No

> -----Original Message-----
> From: Joe Nall [mailto:joe@nall.com]
> Sent: Monday, July 14, 2008 9:43 AM
> To: Clarkson, Mike R (US SSA)
> Cc: selinux@tycho.nsa.gov
> Subject: Re: ping and the /tmp directory
> 
> 
> On Jul 14, 2008, at 11:10 AM, Clarkson, Mike R (US SSA) wrote:
> 
> > Does the ping utility normally read/write to the /tmp directory?
> >
> > I've got a domain that uses ping in the ping_t domain, using the
> > netutils_domtrans_ping interface, and I'm getting the following from
> > audit2allow:
> >
> > allow ping_t tmp_t:file { read write getattr ioctl };
> 
> Is stdout of the parent process being redirected to a tmp file?
> 
> joe
> 




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: ping and the /tmp directory

[Tom London]

On Mon, Jul 14, 2008 at 9:10 AM, Clarkson, Mike R (US SSA)
<mike.clarkson@baesystems.com> wrote:
> Does the ping utility normally read/write to the /tmp directory?
>
> I've got a domain that uses ping in the ping_t domain, using the
> netutils_domtrans_ping interface, and I'm getting the following from
> audit2allow:
>
> allow ping_t tmp_t:file { read write getattr ioctl };
>
> Thanks
>

Do you have nscd running? If I remember right, some versions saved
nscd state in /tmp somewhere.

tom
-- 
Tom London

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: ping and the /tmp directory

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Clarkson, Mike R (US SSA) wrote:
> Does the ping utility normally read/write to the /tmp directory?
> 
> I've got a domain that uses ping in the ping_t domain, using the
> netutils_domtrans_ping interface, and I'm getting the following from
> audit2allow:
> 
> allow ping_t tmp_t:file { read write getattr ioctl };
> 
> Thanks
> 
> 
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
These situations are almost always leaked file descriptor.  The tool
that is domtrans  to ping is leaking or one of it's parents.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkh7swsACgkQrlYvE4MpobO0pACfSmDU4n1MlqbG28u/8J6Rj7v2
WWQAoM00W2onH9YGrd+8j3Rfw+IgcGzC
=QYQe
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.