On Thu, Feb 20, 2014 at 10:15:54AM +0100, Laurent Bigonville wrote: > Could you please attach the AVC denials to the bug.
Sure, here you are -- this was taken in permissive mode obviously. The
openssh-server command referred to in the first ssh-related denial is
/etc/network/if-up.d/openssh-server (there's only one other file by
that name on the system, and that's nonexecutable under /etc/ufw/).
type=AVC msg=audit(1392875609.055:17): avc: denied { getattr } for pid=2746
comm="rndc" path="/etc/bind/rndc.key" dev="sda5" ino=76857
scontext=system_u:system_r:udev_t:s0-s0:c0.c1023
tcontext=system_u:object_r:dnssec_t:s0 tclass=file
type=AVC msg=audit(1392875609.055:18): avc: denied { read } for pid=2746
comm="rndc" name="rndc.key" dev="sda5" ino=76857
scontext=system_u:system_r:udev_t:s0-s0:c0.c1023
tcontext=system_u:object_r:dnssec_t:s0 tclass=file
type=AVC msg=audit(1392875609.055:18): avc: denied { open } for pid=2746
comm="rndc" path="/etc/bind/rndc.key" dev="sda5" ino=76857
scontext=system_u:system_r:udev_t:s0-s0:c0.c1023
tcontext=system_u:object_r:dnssec_t:s0 tclass=file
type=AVC msg=audit(1392875609.055:19): avc: denied { node_bind } for
pid=2748 comm="rndc" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023
tcontext=system_u:object_r:node_t:s0 tclass=tcp_socket
type=AVC msg=audit(1392875609.055:20): avc: denied { name_connect } for
pid=2748 comm="rndc" dest=953 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023
tcontext=system_u:object_r:rndc_port_t:s0 tclass=tcp_socket
...
type=AVC msg=audit(1392875609.071:21): avc: denied { getattr } for pid=2759
comm="openssh-server" path="/run/sshd.pid" dev="tmpfs" ino=4801
scontext=system_u:system_r:udev_t:s0-s0:c0.c1023
tcontext=system_u:object_r:sshd_var_run_t:s0 tclass=file
type=AVC msg=audit(1392875609.071:22): avc: denied { read } for pid=2761
comm="cat" name="sshd.pid" dev="tmpfs" ino=4801
scontext=system_u:system_r:udev_t:s0-s0:c0.c1023
tcontext=system_u:object_r:sshd_var_run_t:s0 tclass=file
type=AVC msg=audit(1392875609.071:22): avc: denied { open } for pid=2761
comm="cat" path="/run/sshd.pid" dev="tmpfs" ino=4801
scontext=system_u:system_r:udev_t:s0-s0:c0.c1023
tcontext=system_u:object_r:sshd_var_run_t:s0 tclass=file
type=AVC msg=audit(1392875609.087:23): avc: denied { getattr } for pid=2779
comm="ssh" path="/run/sshd" dev="tmpfs" ino=7810
scontext=system_u:system_r:udev_t:s0-s0:c0.c1023
tcontext=system_u:object_r:sshd_var_run_t:s0 tclass=dir
type=AVC msg=audit(1392875609.091:24): avc: denied { read } for pid=2784
comm="sshd" name="ssh_host_rsa_key" dev="sda5" ino=60118
scontext=system_u:system_r:udev_t:s0-s0:c0.c1023
tcontext=system_u:object_r:sshd_key_t:s0 tclass=file
type=AVC msg=audit(1392875609.091:24): avc: denied { open } for pid=2784
comm="sshd" path="/etc/ssh/ssh_host_rsa_key" dev="sda5" ino=60118
scontext=system_u:system_r:udev_t:s0-s0:c0.c1023
tcontext=system_u:object_r:sshd_key_t:s0 tclass=file
[and so forth until one runs out of disk or patience]
--
Devin \ aqua(at)devin.com, IRC:Requiem; http://www.devin.com
Carraway \ 4096R/9197B5F9: 9C64 37CD 1B7B 029D 0933 49EA 1E52 7672 9197 B5F9
signature.asc
Description: Digital signature
