Re: [RFC] Obtaining PATH entry without audit userland
On Thu, 10 Jan 2008 19:32:04 -0500
Steve Grubb wrote:
On Thursday 10 January 2008 19:27:18 Yuichi Nakamura wrote:
> One example of AVC message in 2.6.24.rc1 is below.
> #Type is broken for testing, do not warry about that :)
> audit(946684824.060:5): avc: denied { read } for pid=796 comm="httpd"
> name="index.html" dev=sda1 ino=61906 scontext=system_u:system_r:httpd_t
> tcontext=system_u:object_r:etc_shadow_t tclass=file audit(946684824.060:5):
> arch=2a syscall=5 per=800000 success=yes exit=5 a0=48d490 a1=0 a2=1b6
> a3=1b6 items=1 ppid=795 pid=796 auid=4294967295 uid=99 gid=99 euid=99
> suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) comm="httpd"
> exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t key=(null)
How can we recreate the problem so that we can see what is going on?
Here is how to recreate on Fedora 8 PC.
(1) Check /etc/audit/audit.rules, and make sure no rules are registered.
If registered, remove them and reboot.
(2) Break security context to generate AVC message, and generate AVC.
# chcon -t shadow_t /etc/httpd/conf/httpd.conf
# /etc/init.d/httpd start
(3) It should fail, and following AVC message appears
--
# ausearch -m AVC
time->Fri Jan 11 09:58:55 2008
type=SYSCALL msg=audit(1200013135.944:60): arch=40000003 syscall=5 success=no exit=-13
a0=b999c158 a1=8000 a2=1b6 a3=8000 items=0 ppid=2586 pid=2587 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 comm="httpd"
exe="/usr/sbin/httpd" subj=root:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1200013135.944:60): avc: denied { read } for pid=2587
comm="httpd" name="httpd.conf" dev=dm-0 ino=1109270
scontext=root:system_r:httpd_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file
---
"name" is httpd.conf.
(4) Register dummy audit rule and generate AVC message again.
---
# auditctl -a exit,always -S chdir -F obj_type=dummy_t
# /etc/init.d/httpd start
# ausearch -m AVC
time->Fri Jan 11 10:03:46 2008
type=PATH msg=audit(1200013426.905:65): item=0 name="/etc/httpd/conf/httpd.conf"
inode=1109270 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00
obj=system_u:object_r:shadow_t:s0
type=CWD msg=audit(1200013426.905:65): cwd="/root"
type=SYSCALL msg=audit(1200013426.905:65): arch=40000003 syscall=5 success=no exit=-13
a0=b913f158 a1=8000 a2=1b6 a3=8000 items=1 ppid=2612 pid=2613 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 comm="httpd"
exe="/usr/sbin/httpd" subj=root:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1200013426.905:65): avc: denied { read } for pid=2613
comm="httpd" name="httpd.conf" dev=dm-0 ino=1109270
scontext=root:system_r:httpd_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file
---
In type=PATH, full path name "/etc/httpd/conf/httpd.conf" appeared.
Regards,
--
Yuichi Nakamura
Hitachi Software Engineering Co., Ltd.
Japan SELinux Users Group(JSELUG): http://www.selinux.gr.jp/
SELinux Policy Editor: http://seedit.sourceforge.net/