27 Mar 2012 16:07
Problem with sockets and ACL
Lorenzo Marcantonio <l.marcantonio <at> logossrl.com>
2012-03-27 14:07:21 GMT
2012-03-27 14:07:21 GMT
I've just upgraded from 1.4.4 to 1.4.6 (using the 3.1.5 prepatched kernel)
Most of the things work, except an issue with sockets (both udevd and
dbus-daemon trigger it, other programs like syslog-ng, dont);
udevd says: error initializing udevd socket and logs in this way:
Tue Mar 27 15:57:13 2012 :<6>0000000513|rsbac_adf_request(): request BIND, pid 30317, ppid 28618,
prog_name udevd, prog_file /sbin/udevd, uid 0, audit uid 1000, target_type IPC, tid AnonUnix-ID 72455,
attr sock_type, value DGRAM, result NOT_GRANTED by ACL
dbus-daemon instead goes this way: Failed to start message bus: Failed to bind socket
"/tmp/dbus-4gAhH9BkiE": Operation not permitted
Tue Mar 27 15:58:23 2012 :<6>0000000514|rsbac_adf_request(): request BIND, pid 30557, ppid 30556,
prog_name dbus-daemon, prog_file /usr/stow/dbus-1.4.1/bin/dbus-daemon, uid 1000, target_type
IPC, tid AnonUnix-ID 66250, attr sock_type, value STREAM, result NOT_GRANTED by ACL
The strange thing is that I never touched IPC ACL and other socket based
applications work... even syslog-ng (which uses /dev/log)
A strace of udev gives:
socket(PF_FILE, SOCK_DGRAM, 0) = 5
fcntl64(5, F_GETFL) = 0x2 (flags O_RDWR)
fcntl64(5, F_SETFL, O_RDWR|O_NONBLOCK) = 0
fcntl64(5, F_GETFD) = 0
fcntl64(5, F_SETFD, FD_CLOEXEC) = 0
capget(0x20080522, 0, NULL) = 0
capget(0x20080522, 0, {CAP_SYS_ADMIN,
(Continue reading)
RSS Feed