Re: audit in /selinux directory

["Camilo Y. Campo" <camilo@br.ibm.com>]

On Fri, 2007-03-09 at 16:25 -0500, Stephen Smalley wrote:
> On Fri, 2007-03-09 at 16:17 -0500, Stephen Smalley wrote:
> > On Fri, 2007-03-09 at 16:13 -0500, Stephen Smalley wrote:
> > > On Fri, 2007-03-09 at 15:23 -0500, Steve Grubb wrote:
> > > > On Friday 09 March 2007 14:31, Camilo Y. Campo wrote:
> > > > > The cat command failed and audit is saying "success". A bit strange for
> > > > > me. Could anybody clarify this point for me, please?
> > > > 
> > > > It works correctly for me:
> > > > 
> > > > fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
> > > > open("/selinux/disable", O_RDONLY|O_LARGEFILE) = -1 EACCES (Permission denied)
> > > 
> > > You got EACCES rather than EINVAL, so your test didn't reach the same
> > > point in the code path.  Try it as root (and with appropriate SELinux
> > > role/domain if under -strict or -mls).
> > 
> > I tried it, and the open succeeds, but the read fails with -EINVAL
> > because the underlying pseudo file doesn't implement a read method at
> > all for that node.  So the audit is only capturing the open, which was
> > successful.
> 
> And since one has to be root to open it at all, and root has
> dac_read_search, you can bypass the DAC mode on it at open time.
> So...not a bug?

For me this seems a bug... if I can't audit a denied access in a watched
file...

Camilo Y. Campo