selinux April 2008

selinux@lists.fedoraproject.org

30 participants
38 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

xinetd rsync --daemon problems
by Chuck Anderson 03 Jul '08

03 Jul '08

I'm using Fedora Core 6, and trying to start a rsync daemon via xinetd. The default configuration is: # default: off # description: The rsync server is a good addition to an ftp server, as it \ # allows crc checksumming etc. service rsync { disable = no socket_type = stream wait = no user = root server = /usr/bin/rsync server_args = --daemon log_on_failure += USERID } With this rsyncd.conf: motd file = /etc/rsyncd.motd pid file = /var/run/rsyncd.pid port = 873 uid = rsyncd gid = mirror use chroot = yes max connections = 10 log file = /var/log/rsyncd.log read only = yes hosts allow = 127.0.0.1, ::1, etc.... #hosts deny = 0.0.0.0/0, :: ignore nonreadable = yes transfer logging = yes timeout = 600 dont compress = * [fedora-linux-core] path = /srv/ftp/pub/fedora/linux/core comment = Fedora Linux Core [fedora-linux-core-updates] path = /srv/ftp/pub/fedora/linux/core/updates comment = Fedora Linux Core Updates [fedora-linux-extras] path = /srv/ftp/pub/fedora/linux/extras comment = Fedora Linux Extras [fedora-linux-core-test] path = /srv/ftp/pub/fedora/linux/core/test comment = Fedora Linux Core Test [fedora-linux-releases] path = /srv/ftp/pub/fedora/linux/releases comment = Fedora Linux Releases [fedora-linux-development] path = /srv/ftp/pub/fedora/linux/development comment = Fedora Linux Development [fedora-enchilada] path = /srv/ftp/pub/fedora comment = Fedora - The whole enchilada [fedora-linux-updates] path = /srv/ftp/pub/fedora/linux/updates comment = Fedora Linux Updates [fedora-web] path = /srv/ftp/pub/fedora/web comment = Web content for Fedora Linux mirrors I get these AVCs when running from xinetd and making a client connection that I don't get if I start the daemon directly via "rsync --daemon" as root: type=AVC msg=audit(1192132336.713:3464): avc: denied { lock } for pid=8488 comm="rsync" name="rsyncd.lock" dev=dm-4 ino=2064435 scontext=user_u:system_r:rsync_t:s0 tcontext=root:object_r:var_run_t:s0 tclass=file type=SYSCALL msg=audit(1192132336.713:3464): arch=40000003 syscall=221 success=no exit=-13 a0=4 a1=d a2=bff80730 a3=bff80730 items=0 ppid=8167 pid=8488 auid=10002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="rsync" exe="/usr/bin/rsync" subj=user_u:system_r:rsync_t:s0 key=(null) type=AVC_PATH msg=audit(1192132336.713:3464): path="/var/run/rsyncd.lock" type=AVC msg=audit(1192132400.044:3465): avc: denied { bind } for pid=8499 comm="rsync" scontext=user_u:system_r:rsync_t:s0 tcontext=user_u:system_r:rsync_t:s0 tclass=netlink_route_socket type=SYSCALL msg=audit(1192132400.044:3465): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bf8f4674 a2=4df50ff4 a3=3 items=0 ppid=8167 pid=8499 auid=10002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="rsync" exe="/usr/bin/rsync" subj=user_u:system_r:rsync_t:s0 key=(null) I tried creating and loading a policy module: # grep "rsync" /var/log/audit/audit.log | audit2allow -M rsyncd # semodule -i rsyncd.pp Here is rsyncd.te: module rsyncd 1.0; require { type var_run_t; type rsync_t; class netlink_route_socket create; class file { read write }; } #============= rsync_t ============== allow rsync_t self:netlink_route_socket create; allow rsync_t var_run_t:file { read write }; But I still get these AVCs: type=AVC msg=audit(1192139751.238:3586): avc: denied { bind } for pid=9311 comm="rsync" scontext=user_u:system_r:rsync_t:s0 tcontext=user_u:system_r:rsync_t:s0 tclass=netlink_route_socket type=SYSCALL msg=audit(1192139751.238:3586): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bfbb6144 a2=4df50ff4 a3=3 items=0 ppid=8732 pid=9311 auid=10002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="rsync" exe="/usr/bin/rsync" subj=user_u:system_r:rsync_t:s0 key=(null) Additionally, when using xinetd I don't ever get any log messages in /var/log/rsyncd.log like I do when I run "rsync --daemon" directly: 2007/10/11 17:08:01 [8613] rsyncd version 2.6.9 starting, listening on port 873 2007/10/11 17:08:13 [8616] connect from dustpuppy.wpi.edu (2001:468:616:8c9:213:72ff:fe74:da15) 2007/10/11 17:08:13 [8616] rsync on fedora-enchilada/linux/ from dustpuppy.wpi.edu (2001:468:616:8c9:213:72ff:fe74:da15) 2007/10/11 21:08:13 [8616] building file list 2007/10/11 21:08:13 [8616] sent 1629 bytes received 106 bytes total size 19

2 2

Sendmail milters in Fedora 8
by Paul Howarth 03 Jun '08

03 Jun '08

Since upgrading my mail server from Fedora 7 to Fedora 8, I've come across some problems with the sockets used for communication between sendmail and two of the "milter" plugins I'm using with it, namely milter-regex and spamass-milter. It's very likely that other milters will have similar issues. The sockets used are created when the milter starts, as follows: milter-regex: /var/spool/milter-regex/sock (var_spool_t, inherited from parent directory) spamass-milter: /var/run/spamass-milter/spamass-milter.sock (spamd_var_run_t, in policy) These are pretty well the upstream locations, though I'm open to moving the milter-regex socket from /var/spool to /var/run or elsewhere for consistency. Since moving to Fedora 8, I've had to add the following to local policy to get these milters working: allow sendmail_t spamd_var_run_t:dir { search getattr }; allow sendmail_t spamd_var_run_t:sock_file { getattr write }; allow sendmail_t var_spool_t:sock_file { getattr write }; allow sendmail_t initrc_t:unix_stream_socket { read write connectto }; The last of these is the strangest, and relates to Bug #425958 (https://bugzilla.redhat.com/show_bug.cgi?id=425958). Whilst the socket file itself has the context listed above, the unix domain socket that sendmail connects to is still initrc_t, as can be seen from the output of "netstat -lpZ": ... unix 2 [ ACC ] STREAM LISTENING 14142 5853/spamass-milter system_u:system_r:initrc_t:s0 /var/run/spamass-milter/spamass-milter.sock unix 2 [ ACC ] STREAM LISTENING 13794 5779/milter-regex system_u:system_r:initrc_t:s0 /var/spool/milter-regex/sock ... So, my questions are: 1. Why are the sockets still initrc_t? 2. Is this a kernel issue or a userspace issue that should be fixed in the milters? 3. Should there be a standard place for milter sockets to live, and if so, where? 4. How come this worked OK in Fedora 7 and previous releases? Paul.

2 13

Fedora buildsys and SELinux
by Karsten Wade 15 May '08

15 May '08

As announced on fedora-devel-list[1], we'd like to come to a resolution (consensus, actions) on the challenges we have with SELinux in the Fedora build system. I expect the following: * All the parties are here now needed to figure this out * Someone better than me is going to reply with specifics about what is not working in the buildsys * We all agree it's pretty important to get this figured out in a good way One example of a project blocking on this work is the Fedora spin server. We would have to put a non-SELinux secured server in the loop somewhere for the actual spin building, and any way we do that is going to be hacky and whacky. The main problem I see outside of the technical issues is a marketing one. Fedora's infrastructure is a set of open tools that anyone can download and make work themselves. We know that people do that. Fedora Infrastructure is a feature producer; just as Fedora Docs supplies a full-course documentation toolchain, so does Infrastructure supply a full-course FLOSS project toolset.[2] We do *not* want to be explaining that a new feature doesn't work with SELinux. At the very minimum, we have been consistent about the value of SELinux in Fedora, and to ship something as a Fedora feature that cannot run under SELinux ... well, that would be bad. This is why other Fedora folks are asking the Fedora SELinux team to take this off the backburner. Thanks - Karsten [1] https://www.redhat.com/archives/fedora-devel-list/2008-April/msg01064.html [2] Yep, that's right; Fedora Infrastructure is a feature of Fedora. For example, the new grid project 'Fedora Sleepwalker' is looking to get integrated into firstboot or some kind of JoinBuddy. When that happens, adding your install to the Fedora Sleepwalker grid is going to be touted as a major feature for that release. -- Karsten Wade, Sr. Developer Community Mgr. Dev Fu : http://developer.redhatmagazine.com Fedora : http://quaid.fedorapeople.org gpg key : AD0E0C41

13 50

Starting stunnel from xinetd
by Ian Pilcher 04 May '08

04 May '08

Running fully updated Fedora 8, trying to start stunnel from xinetd, and getting a couple of denials: type=AVC msg=audit(1205149512.996:2338): avc: denied { write } for pid=14322 comm="stunnel" name="random_seed" dev=md1 ino=819429 scontext=unconfined_u:system_r:stunnel_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:stunnel_etc_t:s0 tclass=file type=AVC msg=audit(1205149512.998:2339): avc: denied { name_bind } for pid=14322 comm="stunnel" src=2873 scontext=unconfined_u:system_r:stunnel_t:s0-s0:c0.c1023 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket Aren't these things that stunnel should be expected to do? -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com ========================================================================

2 9

postfix with maildir delivery
by freeslkr 02 May '08

02 May '08

Hello, I'm trying out SELinux on Fedora 8 in permissive mode. I get AVCs everytime postfix delivers mail to the maildir directories. It looks like postfix doesn't have permission to create files. For example, from /var/log/messages: SELinux is preventing local (postfix_local_t) "link" to ./1208923427.P3686.myhost (mail_spool_t) from /var/log/audit/audit.log: type=AVC msg=audit(1208923427.350:95): avc: denied { link } for pid=3686 comm="local" name="1208923427.P3686.myhost" dev=dm-3 ino=819271 scontext=system_u:system_r:postfix_local_t:s0 tcontext=system_u:object_r:mail_spool_t:s0 tclass=file type=SYSCALL msg=audit(1208923427.350:95): arch=c000003e syscall=86 success=yes exit=0 a0=2aaaaad599c0 a1=2aaaaad59ba0 a2=0 a3=0 items=0 ppid=2371 pid=3686 auid=4294967295 uid=0 gid=0 euid=1000 suid=0 fsuid=1000 egid=1000 sgid=0 fsgid=1000 tty=(none) comm="local" exe="/usr/libexec/postfix/local" subj=system_u:system_r:postfix_local_t:s0 key=(null) Is my interpretation correct. If so, is it likely that this could be corrected in a future policy version? Thank you for you help

3 7

Portuguese documentation available
by Jeronimo Zucco 26 Apr '08

26 Apr '08

I wrote some documentation about selinux in portuguese. If you want to read it, please access: http://jczucco.googlepages.com/selinux.html -- Jeronimo Zucco LPIC-1 Linux Professional Institute Certified http://jczucco.blogspot.com --------------------------------------- Essa mensagem foi enviada pelo UCS Mail

1 0

port numbers for sctp support?
by Chuck Anderson 22 Apr '08

22 Apr '08

Is sctp support planned? #semanage port -a -t ssh_sctp_port_t -p sctp 22 /usr/sbin/semanage: Protocol udp or tcp is required

3 4

Re: Fail2ban and SELinux
by max 22 Apr '08

22 Apr '08

On Thu, Apr 17, 2008 at 1:37 PM, max bianco <maximilianbianco(a)gmail.com> wrote: > > On Thu, Apr 17, 2008 at 1:22 PM, max bianco <maximilianbianco(a)gmail.com> wrote: > > > > On Thu, Apr 17, 2008 at 11:25 AM, Daniel J Walsh <dwalsh(a)redhat.com> wrote: > > > > > > -----BEGIN PGP SIGNED MESSAGE----- > > > Hash: SHA1 > > > > > > max bianco wrote: > > > > On Wed, Apr 16, 2008 at 8:37 AM, Daniel J Walsh <dwalsh(a)redhat.com> wrote: > > > >> -----BEGIN PGP SIGNED MESSAGE----- > > > >> Hash: SHA1 > > > >> > > > >> > > > >> > > > >> max wrote: > > > >> > Daniel J Walsh wrote: > > > >> >> -----BEGIN PGP SIGNED MESSAGE----- > > > >> >> Hash: SHA1 > > > >> >> > > > >> >> max bianco wrote: > > > >> >>> I recently installed fail2ban on my F8 box. I don't allow remote > > > >> >>> access to my box but it had been mentioned recently so I decided to > > > >> >>> test it out. I installed it a few days ago but didn't do anything with > > > >> >>> it till last night. I had forgotten about it but I was perusing log > > > >> >>> files and saw 21 AVC's related it to it. I pulled up my services gui > > > >> >>> and sure enough it wasn't running. I tried to start it and got > > > >> >>> denied(it wouldn't start from a terminal at all, complaining that the > > > >> >>> service is unrecognized). No problem , i expected as much when I saw > > > >> >>> the AVC's in my log files but I always try things more than once so I > > > >> >>> tried to start it a second time and this time and every time after it > > > >> >>> started without generating a denial. Is this because I manually > > > >> >>> started the service? That doesn't make sense because then it would > > > >> >>> have worked the first time as well but it didn't. I see that there is > > > >> >>> a policy module for fail2ban but if the module is in place then > > > >> >>> shouldn't it have run without issues? Why 21 AVC's and then its > > > >> >>> working? I am learning my way around SELinux but I don't feel > > > >> >>> comfortable enough to troubleshoot this problem correctly, so where do > > > >> >>> I start? > > > >> >>> > > > >> >>> Max > > > >> >>> > > > >> >>> -- > > > >> >>> fedora-selinux-list mailing list > > > >> >>> fedora-selinux-list(a)redhat.com > > > >> >>> https://www.redhat.com/mailman/listinfo/fedora-selinux-list > > > >> >> Was there a policy upgrade during this time? Problem might have been > > > >> >> fixed. > > > >> >> > > > >> > The time between my first manual attempt to start fail2ban,which > > > >> > generated an SELinux Denial, and the second, which started the service, > > > >> > was about 30 seconds. I checked the logs again today this is a portion > > > >> > of the output from yesterday and today : > > > >> > > > > >> >> Apr 14 23:24:32 localhost setroubleshoot: [program.ERROR] > > > >> >> setroubleshoot generated AVC, exiting to avoid recursion, > > > >> >> context=system_u:system_r:setroubleshootd_t:s0, AVC > > > >> >> scontext=system_u:system_r:setroubleshootd_t:s0 > > > >> >> Apr 14 23:24:32 localhost setroubleshoot: [program.ERROR] audit > > > >> >> event#012host=localhost.localdomain type=AVC > > > >> >> msg=audit(1208229871.594:256): avc: denied { write } for pid=2530 > > > >> >> comm="setroubleshootd" name="rpm" dev=dm-0 ino=229382 > > > >> >> scontext=system_u:system_r:setroubleshootd_t:s0 > > > >> >> tcontext=system_u:object_r:rpm_var_lib_t:s0 > > > >> >> tclass=dir#012#012host=localhost.localdomain type=SYSCALL > > > >> >> msg=audit(1208229871.594:256): arch=c000003e syscall=21 success=no > > > >> >> exit=-13 a0=eaf2f0 a1=2 a2=0 a3=0 items=0 ppid=1 pid=2530 > > > >> >> auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 > > > >> >> fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python" > > > >> >> subj=system_u:system_r:setroubleshootd_t:s0 key=(null) > > > >> >> Apr 14 23:24:32 localhost setroubleshoot: [program.ERROR] > > > >> >> setroubleshoot generated AVC, exiting to avoid recursion, > > > >> >> context=system_u:system_r:setroubleshootd_t:s0, AVC > > > >> >> scontext=system_u:system_r:setroubleshootd_t:s0 > > > >> >> Apr 14 23:24:32 localhost setroubleshoot: [program.ERROR] audit > > > >> >> event#012host=localhost.localdomain type=AVC > > > >> >> msg=audit(1208229871.595:257): avc: denied { write } for pid=2530 > > > >> >> comm="setroubleshootd" name="rpm" dev=dm-0 ino=229382 > > > >> >> scontext=system_u:system_r:setroubleshootd_t:s0 > > > >> >> tcontext=system_u:object_r:rpm_var_lib_t:s0 > > > >> >> tclass=dir#012#012host=localhost.localdomain type=SYSCALL > > > >> >> msg=audit(1208229871.595:257): arch=c000003e syscall=21 success=no > > > >> >> exit=-13 a0=d684a0 a1=2 a2=0 a3=0 items=0 ppid=1 pid=2530 > > > >> >> auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 > > > >> >> fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python" > > > >> >> subj=system_u:system_r:setroubleshootd_t:s0 key=(null) > > > >> >> Apr 15 17:26:32 localhost setroubleshoot: SELinux is preventing > > > >> >> fail2ban-server (fail2ban_t) "getattr" to / (security_t). For complete > > > >> >> SELinux messages. run sealert -l fe77e9af-a0e1-442b-a176-08f2db381144 > > > >> >> Apr 15 17:26:36 localhost setroubleshoot: SELinux is preventing > > > >> >> fail2ban-server (fail2ban_t) "read" to ./config (selinux_config_t). > > > >> >> For complete SELinux messages. run sealert -l > > > >> >> 99f22448-5c31-4a6f-8f55-02f7404fba5d > > > >> >> Apr 15 17:26:36 localhost setroubleshoot: SELinux is preventing > > > >> >> fail2ban-server (fail2ban_t) "search" to / (security_t). For complete > > > >> >> SELinux messages. run sealert -l 85b915f3-5a0b-4a2b-9bf1-c3a88bdd5951 > > > >> >> Apr 15 17:26:36 localhost setroubleshoot: SELinux is preventing > > > >> >> fail2ban-server (fail2ban_t) "search" to / (security_t). For complete > > > >> >> SELinux messages. run sealert -l 85b915f3-5a0b-4a2b-9bf1-c3a88bdd5951 > > > >> >> Apr 15 17:26:37 localhost setroubleshoot: [program.ERROR] > > > >> >> setroubleshoot generated AVC, exiting to avoid recursion, > > > >> >> context=system_u:system_r:setroubleshootd_t:s0, AVC > > > >> >> scontext=system_u:system_r:setroubleshootd_t:s0 > > > >> >> Apr 15 17:26:37 localhost setroubleshoot: SELinux is preventing > > > >> >> iptables (iptables_t) "read write" to socket (fail2ban_t). For > > > >> >> complete SELinux messages. run sealert -l > > > >> >> 6cb9955a-b9cf-470c-87d1-e72bfa4b1fe2 > > > >> >> Apr 15 17:26:37 localhost setroubleshoot: [program.ERROR] audit > > > >> >> event#012host=localhost.localdomain type=AVC > > > >> >> msg=audit(1208294790.920:161): avc: denied { write } for pid=2506 > > > >> >> comm="setroubleshootd" name="rpm" dev=dm-0 ino=229382 > > > >> >> scontext=system_u:system_r:setroubleshootd_t:s0 > > > >> >> tcontext=system_u:object_r:rpm_var_lib_t:s0 > > > >> >> tclass=dir#012#012host=localhost.localdomain type=SYSCALL > > > >> >> msg=audit(1208294790.920:161): arch=c000003e syscall=21 success=no > > > >> >> exit=-13 a0=dbf500 a1=2 a2=0 a3=0 items=0 ppid=1 pid=2506 > > > >> >> auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 > > > >> >> fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python" > > > >> >> subj=system_u:system_r:setroubleshootd_t:s0 key=(null) > > > >> > > > > >> > At this point Fail2ban reports it is running .That is only a small > > > >> > portion of what is generated but maybe it can give you an idea. > > > >> > Subsequently SETroubleshoot crashes, specifically it says: connection > > > >> > lost /var/run/setroubleshoot/setroubleshoot_server. The other thing is > > > >> > that I stopped the fail2ban service and rebooted but SETroubleshoot is > > > >> > still crashing, it will generate an AVC when I try to run it then all > > > >> > the output is lost before I can read the AVC. As i have been flipping > > > >> > back and forth typing this, checking logs, restarting > > > >> > SETroubleshoot(about six or seven times now), SETroubleshoot is now up > > > >> > and running like nothing happened. Now that SETroubleshoot is running I > > > >> > expected to find additional AVC's from today but the last one is from > > > >> > yesterday concerning fail2ban. The Alert Count should show 22 not 21 > > > >> > like it does (if we count the one I got the first time i tried to start > > > >> > fail2ban manually) > > > >> > > > > >> > This is the AVC i was getting from Fail2ban before all this ....stuff > > > >> > went haywire on me. > > > >> > > > > >> > > > > >> > Summary: > > > >> > > > > >> > SELinux is preventing fail2ban-server (fail2ban_t) "connectto" to > > > >> > > > > >> > 002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > >> > > > > >> > (rpm_t). > > > >> > > > > >> > Detailed Description: > > > >> > > > > >> > SELinux denied access requested by fail2ban-server. It is not expected > > > >> > that this > > > >> > access is required by fail2ban-server and this access may signal an > > > >> > intrusion > > > >> > attempt. It is also possible that the specific version or configuration > > > >> > of the > > > >> > application is causing it to require additional access. > > > >> > > > > >> > Allowing Access: > > > >> > > > > >> > You can generate a local policy module to allow this access - see FAQ > > > >> > (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can > > > >> > disable > > > >> > SELinux protection altogether. Disabling SELinux protection is not > > > >> > recommended. > > > >> > Please file a bug report > > > >> > (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) > > > >> > against this package. > > > >> > > > > >> > Additional Information: > > > >> > > > > >> > Source Context system_u:system_r:fail2ban_t:s0 > > > >> > Target Context system_u:system_r:rpm_t:s0 > > > >> > Target Objects 002F746D702F66616D2D726F6F742D00000000000000000000 > > > >> > > > > >> > 00000000000000000000000000000000000000000000000000 > > > >> > > > > >> > 00000000000000000000000000000000000000000000000000 > > > >> > > > > >> > 00000000000000000000000000000000000000000000000000 > > > >> > 0000000000000000 [ unix_stream_socket ] > > > >> > Source fail2ban-server > > > >> > Source Path /usr/bin/python > > > >> > Port <Unknown> > > > >> > Host localhost.localdomain > > > >> > Source RPM Packages python-2.5.1-15.fc8 > > > >> > Target RPM Packages > > > >> > Policy RPM selinux-policy-3.0.8-95.fc8 > > > >> > Selinux Enabled True > > > >> > Policy Type targeted > > > >> > MLS Enabled True > > > >> > Enforcing Mode Enforcing > > > >> > Plugin Name catchall > > > >> > Host Name localhost.localdomain > > > >> > Platform Linux localhost.localdomain > > > >> > 2.6.24.4-64.fc8 #1 SMP > > > >> > Sat Mar 29 09:15:49 EDT 2008 x86_64 x86_64 > > > >> > Alert Count 21 > > > >> > First Seen Mon 14 Apr 2008 10:38:42 PM EDT > > > >> > Last Seen Mon 14 Apr 2008 10:38:43 PM EDT > > > >> > Local ID 13bee4e4-ca74-488b-a4df-15f5bf78987f > > > >> > Line Numbers > > > >> > > > > >> > Raw Audit Messages > > > >> > > > > >> > host=localhost.localdomain type=AVC msg=audit(1208227123.34:107): avc: > > > >> > denied { connectto } for pid=6314 comm="fail2ban-server" > > > >> > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > >> > scontext=system_u:system_r:fail2ban_t:s0 > > > >> > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > >> > > > > >> > host=localhost.localdomain type=SYSCALL msg=audit(1208227123.34:107): > > > >> > arch=c000003e syscall=42 success=no exit=-13 a0=6 a1=7fffe5116700 a2=6e > > > >> > a3=0 items=0 ppid=1 pid=6314 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 > > > >> > egid=0 sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" > > > >> > exe="/usr/bin/python" subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > >> > > > > >> > > > > >> > Now that I have SETroubleshoot running i tried the sealert command > > > >> > suggested in the log files : > > > >> > > > > >> > [root@localhost log]# sealert -l 6cb9955a-b9cf-470c-87d1-e72bfa4b1fe2 > > > >> > failed to connect to server: Connection refused > > > >> > [root@localhost log]# sealert -l 6cb9955a-b9cf-470c-87d1-e72bfa4b1fe2 > > > >> > query_alerts error (1003): id (6cb9955a-b9cf-470c-87d1-e72bfa4b1fe2) not > > > >> > found > > > >> > > > > >> > Ran it twice, second time it worked. > > > >> > I hope i'm not confusing anyone , i'll repost the order of events if > > > >> > need be. I hesitate to file a bug when it could just be me making rookie > > > >> > mistakes. I will try to reproduce again tomorrow on this box and my > > > >> > other F8 to see what I can see but if you have any advice it would be > > > >> > gratefully received. > > > >> > > > > >> > > > > >> > Max > > > >> > > > > >> Please send me your /var/log/audit/audit.log > > > >> > > > >> -----BEGIN PGP SIGNATURE----- > > > >> Version: GnuPG v1.4.9 (GNU/Linux) > > > >> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org > > > >> > > > >> iEYEARECAAYFAkgF8xsACgkQrlYvE4MpobN1owCdEbzCCIj7piE2fFt+PgK/nnEW > > > >> GtgAnRk1OXQzWbBAelxUsa5xR/P5QX6c > > > >> =ayhr > > > >> -----END PGP SIGNATURE----- > > > >> > > > > Looks like several drafts of my mail hit the list, sorry about that > > > > but I had to revise once setroubleshoot started working. Strange, i'll > > > > have to look into it later or maybe its just gmail or thunderbird(time > > > > to fire up wireshark!!). Anyway I'll send the audit.log from that box > > > > once I get back to it. Different F8 box(i686), installed fail2ban, > > > > started service and generated AVC(almost identical) but SETroubleshoot > > > > doesn't crash like it does on the x86_64 box at least not so far. All > > > > of the following is from the i686 box , a portion of audit.log follows > > > > this AVC: > > > > > > > > > > > > Summary: > > > > > > > > SELinux is preventing fail2ban-server (fail2ban_t) "connectto" to > > > > 002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > (rpm_t). > > > > > > > > Detailed Description: > > > > > > > > SELinux denied access requested by fail2ban-server. It is not expected that this > > > > access is required by fail2ban-server and this access may signal an intrusion > > > > attempt. It is also possible that the specific version or configuration of the > > > > application is causing it to require additional access. > > > > > > > > Allowing Access: > > > > > > > > You can generate a local policy module to allow this access - see FAQ > > > > (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable > > > > SELinux protection altogether. Disabling SELinux protection is not recommended. > > > > Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) > > > > against this package. > > > > > > > > Additional Information: > > > > > > > > Source Context system_u:system_r:fail2ban_t > > > > Target Context system_u:system_r:rpm_t > > > > Target Objects 002F746D702F66616D2D726F6F742D00000000000000000000 > > > > 00000000000000000000000000000000000000000000000000 > > > > 00000000000000000000000000000000000000000000000000 > > > > 00000000000000000000000000000000000000000000000000 > > > > 0000000000000000 [ unix_stream_socket ] > > > > Source fail2ban-server > > > > Source Path /usr/bin/python > > > > Port <Unknown> > > > > Host localhost.localdomain > > > > Source RPM Packages python-2.5.1-15.fc8 > > > > Target RPM Packages > > > > Policy RPM selinux-policy-3.0.8-95.fc8 > > > > Selinux Enabled True > > > > Policy Type targeted > > > > MLS Enabled True > > > > Enforcing Mode Enforcing > > > > Plugin Name catchall > > > > Host Name localhost.localdomain > > > > Platform Linux localhost.localdomain 2.6.24.4-64.fc8 #1 SMP > > > > Sat Mar 29 09:54:46 EDT 2008 i686 athlon > > > > Alert Count 26 > > > > First Seen Wed 16 Apr 2008 08:39:06 AM EDT > > > > Last Seen Wed 16 Apr 2008 08:39:08 AM EDT > > > > Local ID ede0cda2-138a-4222-936b-289297d95cee > > > > Line Numbers > > > > > > > > Raw Audit Messages > > > > > > > > host=localhost.localdomain type=AVC msg=audit(1208349548.205:47): avc: > > > > denied { connectto } for pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > > > > > host=localhost.localdomain type=SYSCALL msg=audit(1208349548.205:47): > > > > arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfefa2b0 > > > > a2=165110 a3=b7f9602c items=0 ppid=1 pid=3045 auid=500 uid=0 gid=0 > > > > euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) > > > > comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > > > > > > > > > > > > > > > > > > > > > > > > > I am posting a portion of the audit.log relating to fail2ban as the > > > > entire log is quite large. If you want the whole thing unedited then I > > > > will attach it. I think this should be more than enough, i didn't > > > > parse it , just a simple copy and paste. I don't know what you may or > > > > may not find relevant here so it goes from a couple of entries before > > > > fail2ban is mentioned and a few after the last mention of fail2ban. > > > > Most of the entries look identical and end in key=(null) maybe i could > > > > just dismiss it but i take all the AVC's seriously until I know > > > > better: > > > > > > > > > > > > type=USER_START msg=audit(1208349505.423:21): user pid=2891 uid=500 > > > > auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 > > > > msg='op=PAM:session_open acct=root exe="/usr/sbin/userhelper" > > > > (hostname=?, addr=?, terminal=? res=success)' > > > > type=AVC msg=audit(1208349546.967:22): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349546.967:22): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349546.976:23): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349546.976:23): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.028:24): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.028:24): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.080:25): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.080:25): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.132:26): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.132:26): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.184:27): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.184:27): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.236:28): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.236:28): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.288:29): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.288:29): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.341:30): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.341:30): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.393:31): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.393:31): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.445:32): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.445:32): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.497:33): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.497:33): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.549:34): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.549:34): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.601:35): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.601:35): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.651:36): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.651:36): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.702:37): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.702:37): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.752:38): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.752:38): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.803:39): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.803:39): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.853:40): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.853:40): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.904:41): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.904:41): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349547.954:42): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349547.954:42): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349548.004:43): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349548.004:43): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349548.054:44): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349548.054:44): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349548.105:45): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349548.105:45): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349548.155:46): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349548.155:46): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=AVC msg=audit(1208349548.205:47): avc: denied { connectto } for > > > > pid=3045 comm="fail2ban-server" > > > > path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 > > > > scontext=system_u:system_r:fail2ban_t:s0 > > > > tcontext=system_u:system_r:rpm_t:s0 tclass=unix_stream_socket > > > > type=SYSCALL msg=audit(1208349548.205:47): arch=40000003 syscall=102 > > > > success=no exit=-13 a0=3 a1=bfefa2b0 a2=165110 a3=b7f9602c items=0 > > > > ppid=1 pid=3045 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 > > > > sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" > > > > subj=system_u:system_r:fail2ban_t:s0 key=(null) > > > > type=USER_AUTH msg=audit(1208350171.618:48): user pid=3098 uid=500 > > > > auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 > > > > msg='op=PAM:authentication acct=root exe="/usr/sbin/userhelper" > > > > (hostname=?, addr=?, terminal=? res=success)' > > > > type=USER_ACCT msg=audit(1208350171.620:49): user pid=3098 uid=500 > > > > auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 > > > > msg='op=PAM:accounting acct=root exe="/usr/sbin/userhelper" > > > > (hostname=?, addr=?, terminal=? res=success)' > > > > type=USER_START msg=audit(1208350171.650:50): user pid=3098 uid=500 > > > > auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 > > > > msg='op=PAM:session_open acct=root exe="/usr/sbin/userhelper" > > > > (hostname=?, addr=?, terminal=? res=success)' > > > > type=USER_AUTH msg=audit(1208350461.693:51): user pid=3142 uid=500 > > > > auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 > > > > msg='op=PAM:authentication acct=root exe="/bin/su" (hostname=?, > > > > addr=?, terminal=pts/1 res=success)' > > > > type=USER_ACCT msg=audit(1208350461.697:52): user pid=3142 uid=500 > > > > auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 > > > > msg='op=PAM:accounting acct=root exe="/bin/su" (hostname=?, addr=?, > > > > terminal=pts/1 res=success)' > > > > type=USER_START msg=audit(1208350461.711:53): user pid=3142 uid=500 > > > > auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 > > > > msg='op=PAM:session_open acct=root exe="/bin/su" (hostname=?, addr=?, > > > > terminal=pts/1 res=success)' > > > > > > > > Thanks for the help, > > > > > > > This is either a leaked file descriptor or gam_server running as rpm_t. > > > > > > ps -eZ | grep rpm_t > > > > > > failtoban should not be trying to communicate with a service running > > > rpm_t. If you find gam_server running as rpm_t kill it and fail2ban > > > should work. > > > > > > > > [root@localhost ~]# ps -eZ | grep rpm_t > > system_u:system_r:rpm_t 2585 ? 00:00:00 yum-updatesd > > system_u:system_r:rpm_t 2587 ? 00:00:00 gam_server > > > > I'll kill the gam_server as you suggest. I will try same on x86_64 box > > to see if its the same problem. If its not then i will post the > > audit.log from it that I promised yesterday. Either way I'll post back > > once i get in front of other f8 box. > > > > Thanks again, > > > > Max > > > I'm not in front of the other box yet but I killed the other instance > of gam_server and reran the command. > > [root@localhost ~]# ps -eZ | grep rpm_t > system_u:system_r:rpm_t 2585 ? 00:00:00 yum-updatesd > system_u:system_r:rpm_t 4074 ? 00:00:00 gam_server > > it came back right away so I killed it again and rechecked several > times and now it appears to have finally died. > [root@localhost ~]# kill 4074 > > > [root@localhost ~]# ps -eZ | grep rpm_t > system_u:system_r:rpm_t 2585 ? 00:00:00 yum-updatesd > > > Max > Gmail is buggy for some reason. I' ll try and keep this coherent. On the i686 box, after I found and killed gam_server( i had to do it twice for it to stay dead) I then got a couple more AVC's (posting AVC's and observations follow): SELinux is preventing iptables (iptables_t) "read write" to socket (fail2ban_t). Detailed Description: SELinux denied access requested by iptables. It is not expected that this access is required by iptables and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:iptables_t Target Context system_u:system_r:fail2ban_t Target Objects socket [ unix_stream_socket ] Source iptables Source Path /sbin/iptables Port <Unknown> Host localhost.localdomain Source RPM Packages iptables-1.3.8-6.fc8 Target RPM Packages Policy RPM selinux-policy-3.0.8-95.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.24.4-64.fc8 #1 SMP Sat Mar 29 09:54:46 EDT 2008 i686 athlon Alert Count 12 First Seen Thu 17 Apr 2008 01:47:41 PM EDT Last Seen Thu 17 Apr 2008 02:19:47 PM EDT Local ID b0d85376-fbd1-48a7-8dff-65a0ff3c4148 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1208456387.335:77): avc: denied { read write } for pid=4622 comm="iptables" path="socket:[35210]" dev=sockfs ino=35210 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:system_r:fail2ban_t:s0 tclass=unix_stream_socket host=localhost.localdomain type=AVC msg=audit(1208456387.335:77): avc: denied { read write } for pid=4622 comm="iptables" path="socket:[35227]" dev=sockfs ino=35227 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:system_r:fail2ban_t:s0 tclass=unix_stream_socket host=localhost.localdomain type=AVC msg=audit(1208456387.335:77): avc: denied { read write } for pid=4622 comm="iptables" path="socket:[35683]" dev=sockfs ino=35683 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:system_r:fail2ban_t:s0 tclass=unix_stream_socket host=localhost.localdomain type=SYSCALL msg=audit(1208456387.335:77): arch=40000003 syscall=11 success=yes exit=0 a0=9a5af50 a1=9a5a998 a2=9a5afa8 a3=40 items=0 ppid=4571 pid=4622 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="iptables" exe="/sbin/iptables" subj=system_u:system_r:iptables_t:s0 key=(null) Ok. That one is about iptables. Soon as I started fail2ban , the log showed 3 AVC's as above. Stop Fail2ban and three more generated. Did it twice to see if it was consistent. Started fail2ban twice, each time I started it generated 3 AVC's as above, same when I stopped it , generated 3 AVC's per instance. So 12 total. When I stopped Fail2ban, within a couple of minutes(can't be more exact didn't have a stop watch) saw a new AVC(only after it stops, observations follow AVC): Summary: SELinux is preventing gam_server (fail2ban_t) "getattr" to / (fs_t). Detailed Description: SELinux denied access requested by gam_server. It is not expected that this access is required by gam_server and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:fail2ban_t Target Context system_u:object_r:fs_t Target Objects / [ filesystem ] Source gam_server Source Path <Unknown> Port <Unknown> Host localhost.localdomain Source RPM Packages Target RPM Packages filesystem-2.4.11-1.fc8 Policy RPM selinux-policy-3.0.8-95.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.24.4-64.fc8 #1 SMP Sat Mar 29 09:54:46 EDT 2008 i686 athlon Alert Count 2 First Seen Thu 17 Apr 2008 01:52:02 PM EDT Last Seen Thu 17 Apr 2008 02:20:17 PM EDT Local ID 9ce8514d-7677-4bb5-a59d-f70c8e8c755f Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1208456417.400:78): avc: denied { getattr } for pid=4573 comm="gam_server" name="/" dev=dm-0 ino=2 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem Ok. After I stop Fail2ban i get one instance of this AVC related to gam_server. I started and stopped Fail2ban twice so two AVC's related to gam_server, once after each time I stop fail2ban. No I don't think anyone is stupid, just being clear for my sake and yours. Also ran : ps -eZ | grep rpm_t gam_server still dead. That was on i686 box. BTW had to kill gam_server twice on x86_64 box for it to stay dead, same as on i686. The x86_64 box is the same for the iptables AVC. Same ratio, 3 AVC's generated when starting fail2ban and 3 AVC's when stopping fail2ban. The difference is that the AVC generated after you stop fail2ban is related to sendmail(observations follow AVC): Summary: SELinux is preventing sendmail (system_mail_t) "read write" to socket (fail2ban_t). Detailed Description: SELinux denied access requested by sendmail. It is not expected that this access is required by sendmail and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:system_mail_t:s0 Target Context system_u:system_r:fail2ban_t:s0 Target Objects socket [ unix_stream_socket ] Source sendmail Source Path /usr/sbin/sendmail.sendmail Port <Unknown> Host localhost.localdomain Source RPM Packages sendmail-8.14.2-1.fc8 Target RPM Packages Policy RPM selinux-policy-3.0.8-95.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.24.4-64.fc8 #1 SMP Sat Mar 29 09:15:49 EDT 2008 x86_64 x86_64 Alert Count 2 First Seen Thu 17 Apr 2008 08:28:37 PM EDT Last Seen Thu 17 Apr 2008 08:30:34 PM EDT Local ID 10c3cca0-4bc2-4fcf-845a-0b0cc2793482 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1208478634.133:31): avc: denied { read write } for pid=3345 comm="sendmail" path="socket:[22805]" dev=sockfs ino=22805 scontext=system_u:system_r:system_mail_t:s0 tcontext=system_u:system_r:fail2ban_t:s0 tclass=unix_stream_socket host=localhost.localdomain type=AVC msg=audit(1208478634.133:31): avc: denied { read write } for pid=3345 comm="sendmail" path="socket:[22823]" dev=sockfs ino=22823 scontext=system_u:system_r:system_mail_t:s0 tcontext=system_u:system_r:fail2ban_t:s0 tclass=unix_stream_socket host=localhost.localdomain type=AVC msg=audit(1208478634.133:31): avc: denied { read write } for pid=3345 comm="sendmail" path="socket:[23071]" dev=sockfs ino=23071 scontext=system_u:system_r:system_mail_t:s0 tcontext=system_u:system_r:fail2ban_t:s0 tclass=unix_stream_socket host=localhost.localdomain type=SYSCALL msg=audit(1208478634.133:31): arch=c000003e syscall=59 success=yes exit=0 a0=8c9860 a1=8c98a0 a2=8c96f0 a3=37e81529f0 items=0 ppid=3343 pid=3345 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=51 sgid=51 fsgid=51 tty=(none) comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:system_mail_t:s0 key=(null) Checked processes on x86_64 no sendmail was or is running. Service isn't usually running and isn't now. Looks like a policy bug or both boxes have been tampered with, you tell me, Sulphur is here so they will get nuked soon enough. The sendmail bug may explain the strange behavior I have seen out of Thunderbird and Gmail but sendmail AVC is only generated on x86_64 box, which incidentally is where I saw wierd behavior out of Thunderbird but that may be separate issue, I don't think there is enough evidence yet to make that conclusion despite my feeling that it is related, i'll just have to keep my eyes peeled. I would file a bug report but I'd like to understand this first so I might suggest, even if I can't code, a fix but if you have to explain it ...the bug would end up being read by someone that subscribes to this list so.....let me know, I will file it if you ask me to. If logs, etc are needed I will supply them but if its a genuine bug it should be easily reproducible in under 30 minutes. I checked for processes running as fs_t and system_mail_t before, during, and after starting/stopping fail2ban on x86_64 box, I don't see anything. I feel like i am forgetting something, anyway let me know about the bug report or if you want more logs etc... Thanks, Max

4 8

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux April 2008