SELinux kernel bug avc.c:888

[mattwood2000]

Has anyone seen this before? I get this on boot...I resolved it before by disabling SELinux AVC support, but now problem is back...even though AVC support is still disabled. I changed something in the kernel which may have caused this, but I don't know what. Any ideas? Running on hardened gentoo 2.6.28-r9.

Thanks, Matt.

[mattwood2000]

So This seems to be related to networking somehow. If I remove both of my network cards either physically or in the kernel, then the kernel boots and I can log in. I've tried each network card individually and I still get the same problem. This is really strange. Any ideas?

Thanks, Matt.

[burningcf]

as posted in matts bugreport, we encounter the same problem here.

enabling avc statistics support seems to help, but networking will remain very unstable:
opening SSH connection crashes the system,
sometimes there are random kernel panics...

if anyone has time to help, we would all be very thankful!

[Crimjob]

I'm in the same boat. Works fine on live CD, and works fine with latest Gentoo-Sources (2.6.30-R4 I believe?), but does not work with 2.6.28-hardened-r9.

I thought it was a VIA / Realtek driver issue, replaced both my cards with Intel's, but no change.

I find it really strange because I initially got the panic after I switched my tree to hardened and re-merged my system, everything was okay, but then I tried to SSH to the box (the monitor I use with this box is shot), and received the kernel panic. Upon every boot after that, I received the kernel panic. I completely rebuilt the system from scratch using hardened sources, but still same kernel panic.

I have a feeling it may be an option in the kernel that is negatively impacting all network drivers, but I have no real idea where to begin here.
_________________
"Who are you to judge the life I live? I know I'm not perfect and I don't live to be, but before you start pointing fingers... make sure your hands are clean." ~Bob Marley

[Crimjob]

In an effort to be more pro-active, I've made my self 1000% more stumped.

I built 3 kernels for testing purposes and created appropriate boot entries for grub for them.

My Old Kernel: e100, SELinux (Hardened), NetFilter (NAT) >> Kernel Panic
Kernel Test 1: No e100 drivers selected, SELinux and NetFilter selected >> Kernel Panic
Kernel Test 2: No NetFilter, e100 Drivers and SELinux selected >> Booted fine
Kernel Test 3: No SELinux, e100 Drivers and NetFilter selected >> Booted fine

So it seems pretty obvious to me that there's something wrong with NetFilter and SELinux working together, as one can work fine without the other.

I'm going to kick off another thread in kernel and hardware since my issue may be different...
_________________
"Who are you to judge the life I live? I know I'm not perfect and I don't live to be, but before you start pointing fingers... make sure your hands are clean." ~Bob Marley

[Hu]

The most obvious interaction between SELinux and Netfilter is in NETWORK_SECMARK. Does disabling that avoid the problem?

Also, can you test whether a non-hardened kernel of the same release panics when using SELinux, Netfilter, and your network card?

[Crimjob]

I will try disabling that and get back to you asap.

I have no idea how to get my hands on the 2.6.28-r9 gentoo-sources kernel. I'm reasonably new to Gentoo. As far as I knew, the primary reason for using the hardened kernel was for SELinux support, but I'm more so following recommendations from experienced users, when I should be learning the differences my self.
_________________
"Who are you to judge the life I live? I know I'm not perfect and I don't live to be, but before you start pointing fingers... make sure your hands are clean." ~Bob Marley

[Crimjob]

Kernel is in the process of rebuilding (dual P3 CPU, a little slow). This is again n00b speculation (I know how to troubleshoot, but gentoo is new to me). Could this have anything to do with "Connection tracking security mark support" being disabled by defualt when SELinux's network secmark is enabled by default?

If I leave this disabled, even though there seems to be an older method in place if this is not enabled, will there be any repercussion to not using this for routing purposes? As if this works for me, I'm satisfied with the workaround until further notices or I have a chance to figure out if I actually can use this to my advantage.
_________________
"Who are you to judge the life I live? I know I'm not perfect and I don't live to be, but before you start pointing fingers... make sure your hands are clean." ~Bob Marley

[Crimjob]

Scratch that. Removing network secmark still results in kernel panic. I'm able to read the line above the kernel panic line that states something else that may be of info:

EIP: [<c0b0f8f8>] avc_has_perm_noaudit+0x19/0x366 SS:ESP 0068:f66f37c8

pretty close to the above error.

Could this have something to do with SELinux's AVC Permissions?
_________________
"Who are you to judge the life I live? I know I'm not perfect and I don't live to be, but before you start pointing fingers... make sure your hands are clean." ~Bob Marley

[Crimjob]

I also disabled AVC support and no change...
_________________
"Who are you to judge the life I live? I know I'm not perfect and I don't live to be, but before you start pointing fingers... make sure your hands are clean." ~Bob Marley

[Crimjob]

Enable Connection tracking security mark support and secmark tracking in NetFilter, seems to have worked so far for me. (note this is with default selinux enabled along with avc etc.)
_________________
"Who are you to judge the life I live? I know I'm not perfect and I don't live to be, but before you start pointing fingers... make sure your hands are clean." ~Bob Marley

[Hu]