dmesg: reads /proc/version

PATCH New Miroslav Grepl 4 participants 6 messages Feb 18, 2011 – Feb 28, 2011

lore

Share & tools

lore

Miroslav Grepl

author

2011-02-18 16:00 UTC #0 lore raw

PATCH 1/1 dmesg: reads /proc/version

http://mgrepl.fedorapeople.org/F15/admin_dmesg.patch

* dmesg reads /proc/version
* dmesg needs to access to abrt files

Guido Trentalancia

2011-02-19 05:07 UTC #1 lore raw

PATCH 1/1 dmesg: reads /proc/version

Hello Miroslav !

Quoted 4 lines · Miroslav Grepl

http://mgrepl.fedorapeople.org/F15/admin_dmesg.patch
* dmesg reads /proc/version
* dmesg needs to access to abrt files

I couldn't find any reference in the source code for dmesg from util-linux-ng versions 2.18 and 2.19 about the fact that "dmesg reads /proc/version".

Nor I have any indication from the audit logs on the test system I am running that dmesg ever required that permission.

Only mount needs to stat() /proc/version.

So, where did you get that from ?

And I am not using abrt, but to be honest, I could not find any reference to abrt files access either.

Regards,

Guido

Miroslav Grepl

author

2011-02-21 15:14 UTC #2 lore raw

PATCH 1/1 dmesg: reads /proc/version

Quoted 11 lines · Guido Trentalancia

Hello Miroslav !
Quoted 4 lines · Miroslav Grepl
http://mgrepl.fedorapeople.org/F15/admin_dmesg.patch
* dmesg reads /proc/version
* dmesg needs to access to abrt files
I couldn't find any reference in the source code for dmesg from util-linux-ng versions 2.18 and 2.19 about the fact that "dmesg reads /proc/version".

Quoted 6 lines

Nor I have any indication from the audit logs on the test system I am running that dmesg ever required that permission.
Only mount needs to stat() /proc/version.
So, where did you get that from ?

There was a bug saying

type=AVC msg=audit(1293078612.406:8): avc: denied { read } for pid=2405 comm="dmesg" path="/proc/version" dev=proc ino=4026532016 scontext=system_u:system_r:dmesg_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file

Quoted 7 lines

And I am not using abrt, but to be honest, I could not find any reference to abrt files access either.
Regards,
Guido

Guido Trentalancia

2011-02-21 15:08 UTC #3 lore raw

PATCH 1/1 dmesg: reads /proc/version

Good afternoon Miroslav !

Quoted 17 lines · Miroslav Grepl

Quoted 16 lines · Guido Trentalancia
Hello Miroslav !
Quoted 4 lines · Miroslav Grepl
http://mgrepl.fedorapeople.org/F15/admin_dmesg.patch
* dmesg reads /proc/version
* dmesg needs to access to abrt files
I couldn't find any reference in the source code for dmesg from util-linux-ng versions 2.18 and 2.19 about the fact that "dmesg reads /proc/version".
Nor I have any indication from the audit logs on the test system I am running that dmesg ever required that permission.
Only mount needs to stat() /proc/version.

Quoted 7 lines

Quoted 1 line
So, where did you get that from ?
There was a bug saying
type=AVC msg=audit(1293078612.406:8): avc: denied { read } for pid=2405 comm="dmesg" path="/proc/version" dev=proc ino=4026532016 scontext=system_u:system_r:dmesg_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file

That's not a bug. It's an AVC denial. In other words, SELinux is preventing some sort of operation.

It still sounds very odd to me.

In any case, I got curious about this issue and I went looking at Fedora's package. Yes, F15 source package util-linux-2.19-1.fc15. I am quite sure that such operation is not in the source code for dmesg.

Look by yourself, the code is so short ! It's only about calls to klogctl().

Hope it helps. But let's quit this topic now, because I believe it is off-theme for this list.

Regards,

Guido

Daniel J Walsh

2011-02-21 15:33 UTC #4 lore raw

PATCH 1/1 dmesg: reads /proc/version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 43 lines · Guido Trentalancia

Good afternoon Miroslav !
Quoted 17 lines · Miroslav Grepl
Quoted 16 lines · Guido Trentalancia
Hello Miroslav !
Quoted 4 lines · Miroslav Grepl
http://mgrepl.fedorapeople.org/F15/admin_dmesg.patch
* dmesg reads /proc/version
* dmesg needs to access to abrt files
I couldn't find any reference in the source code for dmesg from util-linux-ng versions 2.18 and 2.19 about the fact that "dmesg reads /proc/version".
Nor I have any indication from the audit logs on the test system I am running that dmesg ever required that permission.
Only mount needs to stat() /proc/version.
Quoted 7 lines
Quoted 1 line
So, where did you get that from ?
There was a bug saying
type=AVC msg=audit(1293078612.406:8): avc: denied { read } for pid=2405 comm="dmesg" path="/proc/version" dev=proc ino=4026532016 scontext=system_u:system_r:dmesg_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file
That's not a bug. It's an AVC denial. In other words, SELinux is preventing some sort of operation.
It still sounds very odd to me.
In any case, I got curious about this issue and I went looking at Fedora's package. Yes, F15 source package util-linux-2.19-1.fc15. I am quite sure that such operation is not in the source code for dmesg.
Look by yourself, the code is so short ! It's only about calls to klogctl().
Hope it helps. But let's quit this topic now, because I believe it is off-theme for this list.

Quoted 8 lines

Regards,
Guido
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

There is a possiblity that the app/domain that executed dmesg, leaked an open file descriptor for read to dmesg, and that is being checked on exec. -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1ihbEACgkQrlYvE4MpobOEGgCgxoT+dRkO85ax4lb59k/u5/4I 9G8AoIW0OZRT/sesrsbYtHExJNkUWvoP
=7ufE
-----END PGP SIGNATURE-----

Christopher J. PeBenito

2011-02-28 14:43 UTC #5 lore raw

PATCH 1/1 dmesg: reads /proc/version

Quoted 38 lines · Daniel J Walsh

Quoted 36 lines · Guido Trentalancia
Good afternoon Miroslav !
Quoted 17 lines · Miroslav Grepl
Quoted 16 lines · Guido Trentalancia
Hello Miroslav !
Quoted 4 lines · Miroslav Grepl
http://mgrepl.fedorapeople.org/F15/admin_dmesg.patch
* dmesg reads /proc/version
* dmesg needs to access to abrt files
I couldn't find any reference in the source code for dmesg from util-linux-ng versions 2.18 and 2.19 about the fact that "dmesg reads /proc/version".
Nor I have any indication from the audit logs on the test system I am running that dmesg ever required that permission.
Only mount needs to stat() /proc/version.
Quoted 7 lines
Quoted 1 line
So, where did you get that from ?
There was a bug saying
type=AVC msg=audit(1293078612.406:8): avc: denied { read } for pid=2405 comm="dmesg" path="/proc/version" dev=proc ino=4026532016 scontext=system_u:system_r:dmesg_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file
That's not a bug. It's an AVC denial. In other words, SELinux is preventing some sort of operation.
It still sounds very odd to me.
In any case, I got curious about this issue and I went looking at Fedora's package. Yes, F15 source package util-linux-2.19-1.fc15. I am quite sure that such operation is not in the source code for dmesg.

Quoted 8 lines

Quoted 5 lines
Look by yourself, the code is so short ! It's only about calls to klogctl().
Hope it helps. But let's quit this topic now, because I believe it is off-theme for this list.
There is a possiblity that the app/domain that executed dmesg, leaked an open file descriptor for read to dmesg, and that is being checked on exec.

There is also the possibility that its a glibc thing.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com