freebsd security - Jun 2006 - mac_bsdextended log information

Hey everyone, 

I'm hoping someone can point me in the right direction. I'm running a
6.1 box with mac_bsdextended compiled. I've created my ugidfw rules, and all
seems well in the universe.

I've got rules set up so the web process uid 80 and gid 80 can only read uid
1010 and gid 1010 owned files. When the web server tries to do something else,
it throws an error such as:

<authpriv.emerg> www kernel: mac_bsdextended: 80:80 request 256 on 0:0
failed.

So the question is, what file did the www process try to muck with? It is a root
owned file, and it is important that it want to act on it. Security problem, or
benign problem? Who knows without being able to know what the file is. A look at
the source code implies that the "request 256" means that the web
process tried to read the vnode numbered 256. Is that accurate?
If it is, how do I go about associating vnode numbers to files, so I have a hope
of troubleshooting these errors.

Searching seems to turn up no tool or easy way to get this vnode -> file
information. Help!

Jeff

On Thu, 2006-06-01 at 14:40 -0700, Jeff wrote:
> Hey everyone, 
> 
> I'm hoping someone can point me in the right direction. I'm running
a 6.1 box with mac_bsdextended compiled. I've created my ugidfw rules, and
all seems well in the universe.
> 
> I've got rules set up so the web process uid 80 and gid 80 can only
read uid 1010 and gid 1010 owned files. When the web server tries to do
something else, it throws an error such as:
> 
> <authpriv.emerg> www kernel: mac_bsdextended: 80:80 request 256 on
0:0 failed.
> 
> So the question is, what file did the www process try to muck with? It is a
root owned file, and it is important that it want to act on it. Security
problem, or benign problem? Who knows without being able to know what the file
is. A look at the source code implies that the "request 256" means
that the web process tried to read the vnode numbered 256. Is that accurate?
> If it is, how do I go about associating vnode numbers to files, so I have a
hope of troubleshooting these errors.
> 
There are many legitimate reasons for a webserver to open root owned
files. Looking up users in the password database would be my first
guess. Maybe you shoud consider changing your rules to some more fine
grained ones?
> Searching seems to turn up no tool or easy way to get this vnode -> file
information. Help!
Try:

$ find -inum 256 /
> 
> Jeff
> 
Cheers,

m.
> _______________________________________________
> freebsd-security@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to
"freebsd-security-unsubscribe@freebsd.org"
-- 
Kenyeres M?rton <mkenyeres@konvergencia.hu>