Re: Selinux attacks acroread again

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Paul Smith wrote:
On 4/13/06, Paul Howarth <paul@xxxxxxxxxxxx> wrote:
Try:

# grep -F 'avc:  denied' /var/log/audit/audit.log /var/log/messages

/var/log/messages:Apr 13 13:00:39 localhost kernel:
audit(1144929639.666:42): avc:  denied  { execmod } for  pid=6312
comm="acroread" name="libCoolType.so.5.01" dev=dm-0 ino=8258016
scontext=user_u:system_r:unconfined_t:s0
tcontext=system_u:object_r:lib_t:s0 tclass=file
/var/log/messages:Apr 13 13:00:54 localhost kernel:
audit(1144929654.489:43): avc:  denied  { execmod } for  pid=6385
comm="acroread" name="libcrypto.so.0.9.6" dev=dm-0 ino=8258037
scontext=user_u:system_r:unconfined_t:s0
tcontext=system_u:object_r:lib_t:s0 tclass=file

OK, so where are the files libCoolType.so.5.01 and libcrypto.so.0.9.6 on your system?

/usr/local/Adobe/Acrobat7.0/Reader/intellinux/lib ?

Does this help:

# chcon -t textrel_shlib_t \
/usr/local/Adobe/Acrobat7.0/Reader/intellinux/lib/*.so*

Paul.


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux