When ever someone is accessing my machine using telnet i am getting an alert from SELINUX
Code:
Summary:
SELinux prevented in.telnetd from using the terminal 6.
Detailed Description:
SELinux prevented in.telnetd from using the terminal 6. In most cases daemons do
not need to interact with the terminal, usually these avc messages can be
ignored. All of the confined daemons should have dontaudit rules around using
the terminal. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this selinux-policy.
If you would like to allow all daemons to interact with the terminal, you can
turn on the allow_daemons_use_tty boolean.
Allowing Access:
Changing the "allow_daemons_use_tty" boolean to true will allow this access:
"setsebool -P allow_daemons_use_tty=1."
The following command will allow this access:
setsebool -P allow_daemons_use_tty=1
Additional Information:
Source Context system_u:system_r:telnetd_t:s0-s0:c0.c1023
Target Context system_u:object_r:unconfined_devpts_t:s0
Target Objects 6 [ chr_file ]
Source in.telnetd
Source Path /usr/sbin/in.telnetd
Port <Unknown>
Host <somehost>
Source RPM Packages telnet-server-0.17-41.fc8
Target RPM Packages
Policy RPM selinux-policy-3.0.8-109.fc8
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name allow_daemons_use_tty
Host Name <somehost>
Platform Linux <somehost> 2.6.25.9-40.fc8 #1 SMP
Fri Jun 27 16:25:53 EDT 2008 i686 i686
Alert Count 36
First Seen Sun 07 Sep 2008 12:08:24 AM IST
Last Seen Wed 10 Sep 2008 04:47:53 PM IST
Local ID 8a6125dc-a418-4caa-bfbb-a2a2cab3bcf0
Line Numbers
Raw Audit Messages
host=andromeda.nitc.ac.in type=AVC msg=audit(1221045473.560:5507): avc: denied { setattr } for pid=3241 comm="in.telnetd" name="6" dev=devpts ino=8 scontext=system_u:system_r:telnetd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unconfined_devpts_t:s0 tclass=chr_file
host=andromeda.nitc.ac.in type=SYSCALL msg=audit(1221045473.560:5507): arch=40000003 syscall=212 success=no exit=-13 a0=b7f6d960 a1=0 a2=0 a3=b7f6d965 items=0 ppid=2097 pid=3241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="in.telnetd" exe="/usr/sbin/in.telnetd" subj=system_u:system_r:telnetd_t:s0-s0:c0.c1023 key=(null)
i have done the allow_access.... for allowing the user telnet login but still the alert is coming, although users are able to login successfully but still alerts are coming ...
Why is it so ?/