Page 1 of 1

Denied an untrusted non system library binary

Posted: Tue May 13, 2014 8:59 am
by kram
Hello,

I recently upgraded ASL and I picked up loads of these messages in the logs.

Code: Select all

Denied an untrusted non system library binary from hooking an application.

kernel: grsec: denied exec of usermode helper binary /usr/libexec/abrt-hook-ccpp located outside of /sbin and system library paths
Any Suggestions?

asl -v

Atomic Secured Linux, version 4.0-10.el6.art: CentOS 6 (SUPPORTED)
Copyright Atomicorp 2005-2014
All Rights Reserved.

Extended Version Information:

ASL_VERSION 4.0-10
APPINV_VERSION 201402101531
CLAMAV_VERSION 201405120949
GEOMAP_VERSION 201405121720
GRSEC_VERSION 0
MODSEC_VERSION 201405121429
OSSEC_VERSION 201405091000
WAF_DELAYED_VERSION 0
KERNEL_VERSION 0

Re: Denied an untrusted non system library binary

Posted: Tue May 13, 2014 9:12 am
by kram
I just found another post in the forum by Michael Shinn.

Thats coming from Redhats abrt daemon, which you probably dont need to have running. If you want to disable it, run these commands as root:

service abrt-ccpp stop
service abrtd stop
service abrt-oops stop
chkconfig --del abrtd
chkconfig --del abrt-ccpp
chkconfig --del abrt-oops
_________________
Michael Shinn

Re: Denied an untrusted non system library binary

Posted: Tue May 13, 2014 11:05 am
by prupert
kram wrote:I just found another post in the forum by Michael Shinn.

Thats coming from Redhats abrt daemon, which you probably dont need to have running. If you want to disable it, run these commands as root:

service abrt-ccpp stop
service abrtd stop
service abrt-oops stop
chkconfig --del abrtd
chkconfig --del abrt-ccpp
chkconfig --del abrt-oops
In stead of 'chkconfig --del <servicename>' it is better to use 'chkconfig <servicename> off'.

If you want to remove the service, you might just as well remove the abrt packages altogether via yum in stead of making custom file-level manipulations that might be reversed in the future.

Re: Denied an untrusted non system library binary

Posted: Wed May 14, 2014 5:15 pm
by kram
Thanks prupert,

everything seems fine now.