From mboxrd@z Thu Jan  1 00:00:00 1970
From: "Camilo Y. Campo" <camilo@br.ibm.com>
Subject: Re: audit in /selinux directory
Date: Wed, 14 Mar 2007 01:10:47 -0300
Message-ID: <1173845448.5936.6.camel@cyc>
References: <1173468692.10746.11.camel@cyc>
	<200703091523.48070.sgrubb@redhat.com>
	<1173474798.3241.144.camel@moss-spartans.epoch.ncsc.mil>
	<1173475049.3241.146.camel@moss-spartans.epoch.ncsc.mil>
	<1173475552.3241.148.camel@moss-spartans.epoch.ncsc.mil>
Reply-To: camilo@br.ibm.com
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <1173475552.3241.148.camel@moss-spartans.epoch.ncsc.mil>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Stephen Smalley <sds@tycho.nsa.gov>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Fri, 2007-03-09 at 16:25 -0500, Stephen Smalley wrote:
> On Fri, 2007-03-09 at 16:17 -0500, Stephen Smalley wrote:
> > On Fri, 2007-03-09 at 16:13 -0500, Stephen Smalley wrote:
> > > On Fri, 2007-03-09 at 15:23 -0500, Steve Grubb wrote:
> > > > On Friday 09 March 2007 14:31, Camilo Y. Campo wrote:
> > > > > The cat command failed and audit is saying "success". A bit strange for
> > > > > me. Could anybody clarify this point for me, please?
> > > > 
> > > > It works correctly for me:
> > > > 
> > > > fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
> > > > open("/selinux/disable", O_RDONLY|O_LARGEFILE) = -1 EACCES (Permission denied)
> > > 
> > > You got EACCES rather than EINVAL, so your test didn't reach the same
> > > point in the code path.  Try it as root (and with appropriate SELinux
> > > role/domain if under -strict or -mls).
> > 
> > I tried it, and the open succeeds, but the read fails with -EINVAL
> > because the underlying pseudo file doesn't implement a read method at
> > all for that node.  So the audit is only capturing the open, which was
> > successful.
> 
> And since one has to be root to open it at all, and root has
> dac_read_search, you can bypass the DAC mode on it at open time.
> So...not a bug?

For me this seems a bug... if I can't audit a denied access in a watched
file...

Camilo Y. Campo