<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
--></style>
</head>
<body class='hmmessage'>
I'm getting these SELinux security alerts on my Fedora 12. I don't know if it's a misconfiguration or a real threat. Does anyone know what it means? I've been getting the first alert from the time I installed the distro, but haven't come up with a pattern yet. They have always been the same until today - I received a new alert, which follows the first one.<br><br>I'll be executing some of the commands suggested on the alerts once I have a better idea of what's happening.<br><br>Thanks,<br><br>John.<br><br><br>{Alert 1}<br>Summary:<br><br>SELinux is preventing /usr/sbin/NetworkManager "create" access on<br>NetworkManager.state.R4GQ8U.<br><br>Detailed Description:<br><br>SELinux denied access requested by NetworkManager. It is not expected that this<br>access is required by NetworkManager and this access may signal an intrusion<br>attempt. It is also possible that the specific version or configuration of the<br>application is causing it to require additional access.<br><br>Allowing Access:<br><br>You can generate a local policy module to allow this access - see FAQ<br>(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug<br>report.<br><br>Additional Information:<br><br>Source Context system_u:system_r:NetworkManager_t:s0<br>Target Context system_u:object_r:var_lib_t:s0<br>Target Objects NetworkManager.state.R4GQ8U [ file ]<br>Source NetworkManager<br>Source Path /usr/sbin/NetworkManager<br>Port <Unknown><br>Host <hostname><br>Source RPM Packages NetworkManager-0.7.998-2.git20100106.fc12<br>Target RPM Packages <br>Policy RPM selinux-policy-3.6.32-78.fc12<br>Selinux Enabled True<br>Policy Type targeted<br>Enforcing Mode Enforcing<br>Plugin Name catchall<br>Host Name <hostname><br>Platform Linux <hostname> 2.6.32.7-37.fc12.x86_64 #1 SMP Fri<br> Jan 29 14:19:39 UTC 2010 x86_64 x86_64<br>Alert Count 1<br>First Seen Sun 21 Feb 2010 05:42:11 AM EST<br>Last Seen Sun 21 Feb 2010 05:42:11 AM EST<br>Local ID bbe2d9d8-17c5-4dd0-b99b-971acd50d151<br>Line Numbers <br><br>Raw Audit Messages <br><br>node=<hostname> type=AVC msg=audit(1266748931.439:6): avc: denied { create } for pid=1148 comm="NetworkManager" name="NetworkManager.state.R4GQ8U" scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=file<br><br>node=<hostname> type=SYSCALL msg=audit(1266748931.439:6): arch=c000003e syscall=2 success=no exit=-13 a0=22c2170 a1=c2 a2=1b6 a3=4d6b726f7774654e items=0 ppid=1147 pid=1148 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="NetworkManager" exe="/usr/sbin/NetworkManager" subj=system_u:system_r:NetworkManager_t:s0 key=(null)<br><br>{Alert 2}<br><br>Summary:<br><br>SELinux is preventing access to files with the label, file_t.<br><br>Detailed Description:<br><br>SELinux permission checks on files labeled file_t are being denied. file_t is<br>the context the SELinux kernel gives to files that do not have a label. This<br>indicates a serious labeling problem. No files on an SELinux box should ever be<br>labeled file_t. If you have just added a disk drive to the system you can<br>relabel it using the restorecon command. For example if you saved the home<br>directory from a previous installation that did not use SELinux, 'restorecon -R<br>-v /home' will fix the labels. Otherwise you should relabel the entire file<br>system.<br><br>Allowing Access:<br><br>You can execute the following command as root to relabel your computer system:<br>"touch /.autorelabel; reboot"<br><br>Additional Information:<br><br>Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023<br>Target Context system_u:object_r:file_t:s0<br>Target Objects /home/john [ dir ]<br>Source gdm-simple-gree<br>Source Path /usr/libexec/gdm-simple-greeter<br>Port <Unknown><br>Host apollo<br>Source RPM Packages gdm-2.28.2-1.fc12<br>Target RPM Packages <br>Policy RPM selinux-policy-3.6.32-89.fc12<br>Selinux Enabled True<br>Policy Type targeted<br>Enforcing Mode Enforcing<br>Plugin Name file<br>Host Name apollo<br>Platform Linux apollo 2.6.32.7-37.fc12.x86_64 #1 SMP Fri<br> Jan 29 14:19:39 UTC 2010 x86_64 x86_64<br>Alert Count 281<br>First Seen Sun 21 Feb 2010 05:42:32 AM EST<br>Last Seen Mon 15 Mar 2010 10:12:19 AM EDT<br>Local ID 76dd86e3-aa08-4fd1-a645-cfa884cc8337<br>Line Numbers <br><br>Raw Audit Messages <br><br>node=apollo type=AVC msg=audit(1268662339.365:28903): avc: denied { read } for pid=1813 comm="gdm-simple-gree" name="john" dev=sda6 ino=6422529 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=dir<br><br>node=apollo type=SYSCALL msg=audit(1268662339.365:28903): arch=c000003e syscall=254 success=no exit=-13 a0=12 a1=27f0180 a2=1002fce a3=1 items=0 ppid=1742 pid=1813 auid=4294967295 uid=42 gid=475 euid=42 suid=42 fsuid=42 egid=475 sgid=475 fsgid=475 tty=(none) ses=4294967295 comm="gdm-simple-gree" exe="/usr/libexec/gdm-simple-greeter" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)<br><br><br><br> </body>
</html>