Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.

Bug 162016

Summary: selinux breaks tcpdump -r /tmp/file
Product: [Fedora] Fedora Reporter: Bradley <bbaetz>
Component: selinux-policy-targetedAssignee: Daniel Walsh <dwalsh>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 4   
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: 1.25.1-7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2005-08-19 07:57:23 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Bradley 2005-06-29 04:59:07 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050524 Fedora/1.0.4-4 Firefox/1.0.4

Description of problem:
tcpdump -r fails to work. tcpdump prints:

tcpdump: /tmp/test.trc: Permission denied

and syslog has:

Jun 29 14:53:56 bradley kernel: audit(1120020836.683:11): avc:  denied  { read
} for  pid=7026 comm="tcpdump" name=test.trc dev=dm-0 ino=9306184 scontext=user_u:system_r:netutils_t tcontext=user_u:object_r:tmp_t tclass=file

Version-Release number of selected component (if applicable):
selinux-policy-targeted-1.23.18-12

How reproducible:
Always

Steps to Reproduce:
1. touch /tmp/test.trc
2. /usr/sbin/tcpdump -r /tmp/test.trc
  

Actual Results:  Errors above

Expected Results:  tcpdump should have displayed the file contents if it was valid

Additional info:

[bbaetz@bradley ~]$ ls -l /tmp/test.trc
-rw-rw-r--  1 bbaetz bbaetz 0 Jun 29 14:53 /tmp/test.trc
[bbaetz@bradley ~]$ ls -Z /tmp/test.trc
-rw-rw-r--  bbaetz   bbaetz   user_u:object_r:tmp_t            /tmp/test.trc

If I try a file in /home/<user> rather than /tmp, I get:

Jun 29 14:57:10 bradley kernel: audit(1120021030.373:14): avc:  denied  { search } for  pid=7064 comm="tcpdump" name=home dev=dm-0 ino=7634945 scontext=root:system_r:netutils_t tcontext=system_u:object_r:home_root_t tclass=dir

instead.

ethereal doesn't have this problem

Comment 1 Daniel Walsh 2005-07-11 18:21:13 UTC
Fixed in selinux-policy-targeted-1.25.1-7