-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 03/21/2012 07:28 AM, Marko Vojinovic wrote:
>
> Hi folks!
>
> // This is a repost from the KDE mailing list, with the hope that
> more eyes will see it here... //
>
> After the yum update, both before and after the restart of the
> system (there was a new kernel as well), my timezone setting is
> wrong (again) --- it is set to Lisbon (GMT), which was my previous
> setting, rather than Belgrade (GMT+1) which was my current setting
> (prior to update). AFAIK, this should not happen unless I ask for
> the timezone change.
>
> Second, when I open systemsettings to change the timezone, after
> clicking "apply" and giving the root password, the timezone change
> fails, and SELinux gives an alert:
>
> ===== long quote ===== SELinux is preventing
> /usr/libexec/kde4/kcmdatetimehelper from using the dac_override
> capability.
>
> ***** Plugin dac_override (91.4 confidence) suggests
> ***********************
>
> If you want to help identify if domain needs this access or you
> have a file with the wrong permissions on your system Then turn on
> full auditing to get path information about the offending file and
> generate the error again. Do
>
> Turn on full auditing # auditctl -w /etc/shadow -p w Try to
> recreate AVC. Then execute # ausearch -m avc -ts recent If you see
> PATH record check ownership/permissions on file, and fix it,
> otherwise report as a bugzilla.
>
> ***** Plugin catchall (9.59 confidence) suggests
> ***************************
>
> If you believe that kcmdatetimehelper should have the dac_override
> capability by default. Then you should report this as a bug. You
> can generate a local policy module to allow this access. Do allow
> this access for now by executing: # grep kcmdatetimehelp
> /var/log/audit/audit.log | audit2allow -M mypol # semodule -i
> mypol.pp
>
> Additional Information: Source Context
> system_u:system_r:gnomeclock_t:s0-s0:c0.c1023 Target Context
> system_u:system_r:gnomeclock_t:s0-s0:c0.c1023 Target Objects
> [ capability ] Source kcmdatetimehelp Source
> Path /usr/libexec/kde4/kcmdatetimehelper Port
> <Unknown> Host Yoda Source RPM Packages
> kde-workspace-4.8.1-6.fc16.x86_64 Target RPM Packages Policy RPM
> selinux-policy-3.10.0-75.fc16.noarch Selinux Enabled
> True Policy Type targeted Enforcing Mode
> Enforcing Host Name Yoda Platform
> Linux Yoda 3.2.10-3.fc16.x86_64 #1 SMP Thu Mar 15 19:39:46 UTC 2012
> x86_64 x86_64 Alert Count 1 First Seen
> Mon 19 Mar 2012 08:00:25 AM WET Last Seen Mon
> 19 Mar 2012 08:00:25 AM WET Local ID
> 6c829d68-d5d6-4696-b636-f6efa26b8b49
>
> Raw Audit Messages type=AVC msg=audit(1332144025.273:73): avc:
> denied { dac_override } for pid=2173 comm="kcmdatetimehelp"
> capability=1 scontext=system_u:system_r:gnomeclock_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:gnomeclock_t:s0-s0:c0.c1023
> tclass=capability
>
>
> type=SYSCALL msg=audit(1332144025.273:73): arch=x86_64
> syscall=access success=no exit=EACCES a0=1db33d8 a1=2 a2=200 a3=0
> items=0 ppid=1 pid=2173 auid=4294967295 uid=0 gid=0 euid=0 suid=0
> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
> comm=kcmdatetimehelp exe=/usr/libexec/kde4/kcmdatetimehelper
> subj=system_u:system_r:gnomeclock_t:s0-s0:c0.c1023 key=(null)
>
> Hash:
> kcmdatetimehelp,gnomeclock_t,gnomeclock_t,capability,dac_override
>
> audit2allow
>
> #============= gnomeclock_t ============== allow gnomeclock_t
> self:capability dac_override;
>
> audit2allow -R
>
> #============= gnomeclock_t ============== allow gnomeclock_t
> self:capability dac_override;
>
> ===== end of long quote =====
>
> Somehow I feel that I am not supposed to tweak SELinux policy in
> order to change my timezone setting. In the past I would put
> SELinux into permissive mode, change the timezone, and then
> re-enforce SELinux. But the issue keeps reappearing, so I don't
> believe that this is the right solution.
>
> Ideas?
>
> Best, :-) Marko
>
>
dac_overrride means that you have a process running as root trying to
modify a file that is not owned by root. Usually this means you have
a file with the incorrect ownership.
Now the audit log did not give you the full path, but you can get it
by following the instructions detailed here.
http://danwalsh.livejournal.com/34903.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk9p0UMACgkQrlYvE4MpobPobgCfaaXlRCLyNTm37Q3Q4cx752o8
y/UAnA7PDTOpOOs3cWS1Ap7oXqB1Uft0
=MPKZ
-----END PGP SIGNATURE-----
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
