Hi,
just done my weekly update and I noticed the following AVCs occurred
that suggest something missing in the portage policy?
type=PROCTITLE msg=audit(1479900756.052:3548):
proctitle=6370002D61002D2D7265666C696E6B3D6175746F002F7661722F746D702F706F72746167652F6465762D707974686F6E2F70797061782D302E392E322F696D6167652F5F707974686F6E322E372F2E002F7661722F746D702F706F72746167652F6465762D707974686F6E2F70797061782D302E392E322F696D6167652F2F
type=PATH msg=audit(1479900756.052:3548): item=0
name="/var/tmp/portage/dev-python/pypax-0.9.2/image/." inode=1182893
dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00
obj=staff_u:object_r:portage_tmp_t nametype=NORMAL
type=CWD msg=audit(1479900756.052:3548):
cwd="/var/tmp/portage/dev-python/pypax-0.9.2/work/elfix-0.9.2/scripts"
type=SYSCALL msg=audit(1479900756.052:3548): arch=c000003e syscall=189
success=yes exit=0 a0=44b69d9c40 a1=36fe2f5a763 a2=44b69d9df0 a3=1f
items=1 ppid=21441 pid=21661 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm="cp"
exe="/bin/cp" subj=staff_u:sysadm_r:portage_sandbox_t key=(null)
type=AVC msg=audit(1479900756.052:3548): avc: denied { relabelto }
for pid=21661 comm="cp" name="image" dev="dm-0" ino=1182893
scontext=staff_u:sysadm_r:portage_sandbox_t
tcontext=staff_u:object_r:portage_tmp_t tclass=dir permissive=1
type=AVC msg=audit(1479900756.052:3548): avc: denied { relabelfrom }
for pid=21661 comm="cp" name="image" dev="dm-0" ino=1182893
scontext=staff_u:sysadm_r:portage_sandbox_t
tcontext=staff_u:object_r:portage_tmp_t tclass=dir permissive=1
I checked the policy for source=portage_sandbox_t and
target=portage_tmp_t and it is:
# sesearch -s portage_sandbox_t -t portage_tmp_t -Ad
Found 5 semantic av rules:
allow portage_sandbox_t portage_tmp_t : lnk_file { ioctl read write
create getattr setattr lock unlink link rename } ;
allow portage_sandbox_t portage_tmp_t : dir { ioctl read write
create getattr setattr lock unlink link rename add_name remove_name
reparent search rmdir open } ;
allow portage_sandbox_t portage_tmp_t : fifo_file { ioctl read write
create getattr setattr lock append unlink link rename open } ;
allow portage_sandbox_t portage_tmp_t : file { ioctl read write
create getattr setattr lock relabelfrom relabelto append unlink link
rename execute execute_no_trans open } ;
allow portage_sandbox_t portage_tmp_t : sock_file { ioctl read write
create getattr setattr lock append unlink link rename open } ;
It looks to me like portage was trying to relabelto/from a directory but
these ops are only allowed for files?
I also spotted AVCs involving directory access to portage_tmpfs_t (and
sandbox as the source), such as:
type=PROCTITLE msg=audit(1479900586.938:3542):
proctitle=707974686F6E322E37002F7573722F6C696236342F707974686F6E322E372F736974652D7061636B616765732F696E636C7564655F7365727665722F696E636C7564655F7365727665722E7079002D2D706F7274002F746D702F6469737463632D70756D702E656B6A3330372F736F636B6574002D2D7069645F66696C65002F
type=PATH msg=audit(1479900586.938:3542): item=1
name="/dev/shm/tmpgk84Lo.include_server-16244-1" inode=1246573 dev=00:13
mode=040700 ouid=250 ogid=250 rdev=00:00
obj=staff_u:object_r:portage_tmpfs_t nametype=DELETE
type=PATH msg=audit(1479900586.938:3542): item=0 name="/dev/shm/"
inode=8351 dev=00:13 mode=041777 ouid=0 ogid=0 rdev=00:00
obj=system_u:object_r:tmpfs_t nametype=PARENT
type=CWD msg=audit(1479900586.938:3542):
cwd="/var/tmp/portage/dev-python/cffi-1.5.2/work/cffi-1.5.2"
type=SYSCALL msg=audit(1479900586.938:3542): arch=c000003e syscall=84
success=yes exit=0 a0=3a6d7c7770 a1=0 a2=0 a3=36b items=2 ppid=1
pid=16244 auid=4294967295 uid=250 gid=250 euid=250 suid=250 fsuid=250
egid=250 sgid=250 fsgid=250 tty=pts0 ses=4294967295 comm="python2.7"
exe="/usr/bin/python2.7" subj=staff_u:sysadm_r:portage_sandbox_t key=(null)
type=AVC msg=audit(1479900586.938:3542): avc: denied { rmdir } for
pid=16244 comm="python2.7" name="tmpgk84Lo.include_server-16244-1"
dev="tmpfs" ino=1246573 scontext=staff_u:sysadm_r:portage_sandbox_t
tcontext=staff_u:object_r:portage_tmpfs_t tclass=dir permissive=1
And a similar AVC for creating the same directory.
Is this likely to be a policy gap or have I done something wrong or
failed to do something I should have. I cannot provide more details
about what was happening at the time, other than in the audit snippets
above - it was the middle of a lengthy update process.
Thanks,
Robert Sharp
