audit avc : denied

AlteRFirE · 01-05-2007, 08:52 AM

heya guys, i jsut installed fc5 fresh and im haveing this stuff print on my console.

Code:

audit(1168004861.283:4): avc:  denied  { read } for  pid=1562 comm="bash" name="libtermcap.so.2.0.8" dev=hda1 ino=161666 scontext=root:sysadm_r:hotplug_t:s0-s0:c0.c255 tcontext=system_u:object_r:file_t:s0 tclass=file
audit(1168004861.283:5): avc:  denied  { getattr } for  pid=1562 comm="bash" name="libtermcap.so.2.0.8" dev=hda1 ino=161666 scontext=root:sysadm_r:hotplug_t:s0-s0:c0.c255 tcontext=system_u:object_r:file_t:s0 tclass=file
audit(1168004861.283:6): avc:  denied  { execute } for  pid=1562 comm="bash" name="libtermcap.so.2.0.8" dev=hda1 ino=161666 scontext=root:sysadm_r:hotplug_t:s0-s0:c0.c255 tcontext=system_u:object_r:file_t:s0 tclass=file
audit(1168004861.287:7): avc:  denied  { ioctl } for  pid=1562 comm="bash" name="tty1" dev=tmpfs ino=892 scontext=root:sysadm_r:hotplug_t:s0-s0:c0.c255 tcontext=root:object_r:tty_device_t:s0 tclass=chr_file
audit(1168004861.339:8): avc:  denied  { execute_no_trans } for  pid=1564 comm="bash" name="grep" dev=hda1 ino=31438 scontext=root:sysadm_r:hotplug_t:s0-s0:c0.c255 tcontext=system_u:object_r:file_t:s0 tclass=file
audit(1168004861.519:9): avc:  denied  { read } for  pid=1562 comm="bash" name="profile.d" dev=hda1 ino=47138 scontext=root:sysadm_r:hotplug_t:s0-s0:c0.c255 tcontext=system_u:object_r:file_t:s0 tclass=dir
audit(1168004861.747:10): avc:  denied  { getattr } for  pid=1583 comm="consoletype" name="tty1" dev=tmpfs ino=892 scontext=root:sysadm_r:hotplug_t:s0-s0:c0.c255 tcontext=root:object_r:tty_device_t:s0 tclass=chr_file
audit(1168004861.763:11): avc:  denied  { ioctl } for  pid=1585 comm="unicode_start" name="unicode_start" dev=hda1 ino=31497 scontext=root:sysadm_r:hotplug_t:s0-s0:c0.c255 tcontext=system_u:object_r:file_t:s0 tclass=file

what is it and how do i stop it interfering with my work?
it happens when i start/stop everything
Its really annoying , and from my side, a little worrying because i don't know what it means
Pls help

nonfatalexec · 01-05-2007, 12:43 PM

I advise you to update your system then relabel the security contexts of your entire file system. The errors you are getting indicates that the commands (comm) bash, consoletype, unicode_start cannot do certain actions (ie read, getattr, execute) with certain files/directories.

Update your system by doing something like "yum update" as root.

Relabel the security context of your filesystem by doing the following:

Code:

touch /.autorelabel
reboot

For a full explanation of the errors you were getting with the security contexts, check out http://www.redhat.com/docs/manuals/e...tion-0055.html

For a full explanation of relabeling the security context, check out http://www.redhat.com/docs/manuals/e...tion-0068.html

AlteRFirE · 01-05-2007, 06:20 PM

how does this come to happen? i just reinstalled on really good gear just yesterday

nonfatalexec · 01-06-2007, 10:32 AM

This could happen if you have permanently set SELinux to permissive, rebooted, then set SELinux to enforcing, so that the security labels are lost and consequently all files are using the default security label. When I search on Google for "system_u: object_r: file_t", I found out that this security label is the default security (http://www.linuxtopia.org/online_boo...ntexts_07.html). There could be other reasons for this happening. It is also possible that the installer "forgot" to label the filesystem.