On Fri, 14 Nov 2008 18:02:33 -0800 (PST) Antonio Olivares <olivares14031@xxxxxxxxx> wrote: > --- On Fri, 11/14/08, Daniel J Walsh <dwalsh@xxxxxxxxxx> wrote: > > > From: Daniel J Walsh <dwalsh@xxxxxxxxxx> > > Subject: Re: SELinux is preventing gdm-binary (xdm_t) "unlink" > > to ... and npviewer To: olivares14031@xxxxxxxxx > > Cc: fedora-selinux-list@xxxxxxxxxx > > Date: Friday, November 14, 2008, 6:08 AM > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > Antonio Olivares wrote: > > > Dear selinux experts, > > > > > > running fedora 10 preview updated to latest packages > > > > > > [olivares@riohigh2 ~]$ uname -r > > > 2.6.27.5-101.fc10.i686 > > > [olivares@riohigh2 ~]$ rpm -qa selinux* > > > selinux-policy-3.5.13-18.fc10.noarch > > > selinux-policy-targeted-3.5.13-18.fc10.noarch > > > > > > > > > Summary: > > > > > > SELinux is preventing gdm-binary (xdm_t) > > "unlink" to > > > ./force-display-on-active-vt (var_spool_t). > > > > > > Detailed Description: > > > > > > SELinux is preventing gdm-binary (xdm_t) > > "unlink" to > > > ./force-display-on-active-vt (var_spool_t). The > > SELinux type var_spool_t, is a > > > generic type for all files in the directory and very > > few processes (SELinux > > > Domains) are allowed to write to this SELinux type. > > This type of denial usual > > > indicates a mislabeled file. By default a file created > > in a directory has the > > > gets the context of the parent directory, but SELinux > > policy has rules about the > > > creation of directories, that say if a process running > > in one SELinux Domain > > > (D1) creates a file in a directory with a particular > > SELinux File Context (F1) > > > the file gets a different File Context (F2). The > > policy usually allows the > > > SELinux Domain (D1) the ability to write, unlink, and > > append on (F2). But if for > > > some reason a file (./force-display-on-active-vt) was > > created with the wrong > > > context, this domain will be denied. The usual > > solution to this problem is to > > > reset the file context on the target file, restorecon > > -v > > > './force-display-on-active-vt'. If the file > > context does not change from > > > var_spool_t, then this is probably a bug in policy. > > Please file a bug report > > > (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) > > against the selinux-policy > > > package. If it does change, you can try your > > application again to see if it > > > works. The file context could have been mislabeled by > > editing the file or moving > > > the file from a different directory, if the file keeps > > getting mislabeled, check > > > the init scripts to see if they are doing something to > > mislabel the file. > > > > > > Allowing Access: > > > > > > You can attempt to fix file context by executing > > restorecon -v > > > './force-display-on-active-vt' > > > > > > Fix Command: > > > > > > restorecon './force-display-on-active-vt' > > > > > > Additional Information: > > > > > > Source Context > > system_u:system_r:xdm_t:s0-s0:c0.c1023 > > > Target Context > > system_u:object_r:var_spool_t:s0 > > > Target Objects > > ./force-display-on-active-vt [ file ] > > > Source gdm-binary > > > Source Path /usr/sbin/gdm-binary > > > Port <Unknown> > > > Host riohigh2 > > > Source RPM Packages gdm-2.24.0-12.fc10 > > > Target RPM Packages > > > Policy RPM > > selinux-policy-3.5.13-18.fc10 > > > Selinux Enabled True > > > Policy Type targeted > > > MLS Enabled True > > > Enforcing Mode Enforcing > > > Plugin Name mislabeled_file > > > Host Name riohigh2 > > > Platform Linux riohigh2 > > 2.6.27.5-94.fc10.i686 #1 SMP Mon > > > Nov 10 15:51:55 EST 2008 > > i686 athlon > > > Alert Count 17 > > > First Seen Mon 03 Nov 2008 07:08:33 > > AM CST > > > Last Seen Thu 13 Nov 2008 04:21:21 > > PM CST > > > Local ID > > a66adf6c-89d5-4d90-83ca-f34c94bb4d45 > > > Line Numbers > > > > > > Raw Audit Messages > > > > > > node=riohigh2 type=AVC msg=audit(1226614881.881:36): > > avc: denied { unlink } for pid=2090 > > comm="gdm-binary" > > name="force-display-on-active-vt" dev=sda6 > > ino=190494 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 > > tcontext=system_u:object_r:var_spool_t:s0 tclass=file > > > > > > node=riohigh2 type=SYSCALL > > msg=audit(1226614881.881:36): arch=40000003 syscall=10 > > success=no exit=-13 a0=8063b84 a1=0 a2=4f86dc a3=9940400 > > items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0 > > suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) > > ses=4294967295 comm="gdm-binary" > > exe="/usr/sbin/gdm-binary" > > subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) > > > > > > > > THe question here is which process created this file? > > force-display-on-active-vt > > > > > > > > > > > Summary: > > > > > > SELinux is preventing the npviewer.bin from using > > potentially mislabeled files > > > > > (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer). > > > > > > Detailed Description: > > > > > > SELinux has denied npviewer.bin access to potentially > > mislabeled file(s) > > > > > (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer). > > This means that > > > SELinux will not allow npviewer.bin to use these > > files. It is common for users > > > to edit files in their home directory or tmp > > directories and then move (mv) them > > > to system directories. The problem is that the files > > end up with the wrong file > > > context which confined applications are not allowed to > > access. > > > > > > Allowing Access: > > > > > > If you want npviewer.bin to access this files, you > > need to relabel them using > > > restorecon -v > > '/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer'. > > > You might want to relabel the entire directory using > > restorecon -R -v '<Unknown>'. > > > > > > Additional Information: > > > > > > Source Context > > unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102 > > > 3 > > > Target Context > > unconfined_u:object_r:user_home_t:s0 > > > Target Objects > > /home/olivares/.icedteaplugin/icedtea-plugin-to- > > > appletviewer [ fifo_file > > ] > > > Source npviewer.bin > > > Source Path > > /usr/lib/nspluginwrapper/npviewer.bin > > > Port <Unknown> > > > Host riohigh2 > > > Source RPM Packages > > nspluginwrapper-1.1.2-4.fc10 > > > Target RPM Packages > > > Policy RPM > > selinux-policy-3.5.13-18.fc10 > > > Selinux Enabled True > > > Policy Type targeted > > > MLS Enabled True > > > Enforcing Mode Enforcing > > > Plugin Name home_tmp_bad_labels > > > Host Name riohigh2 > > > Platform Linux riohigh2 > > 2.6.27.5-101.fc10.i686 #1 SMP Wed > > > Nov 12 00:50:43 EST 2008 > > i686 athlon > > > Alert Count 4 > > > First Seen Thu 13 Nov 2008 06:31:50 > > PM CST > > > Last Seen Thu 13 Nov 2008 06:31:55 > > PM CST > > > Local ID > > 81d406be-b7e4-4bf4-a8c7-f12b7c36ee27 > > > Line Numbers > > > > > > Raw Audit Messages > > > > > > node=riohigh2 type=AVC msg=audit(1226622715.909:38): > > avc: denied { write } for pid=4732 > > comm="npviewer.bin" > > path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" > > dev=sda6 ino=263881 > > scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 > > tcontext=unconfined_u:object_r:user_home_t:s0 > > tclass=fifo_file > > > > > > node=riohigh2 type=AVC msg=audit(1226622715.909:38): > > avc: denied { read } for pid=4732 > > comm="npviewer.bin" > > path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" > > dev=sda6 ino=263847 > > scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 > > tcontext=unconfined_u:object_r:user_home_t:s0 > > tclass=fifo_file > > > > > > node=riohigh2 type=SYSCALL > > msg=audit(1226622715.909:38): arch=40000003 syscall=11 > > success=yes exit=0 a0=9e70d28 a1=9e71d40 a2=9e72210 a3=0 > > items=0 ppid=3572 pid=4732 auid=500 uid=500 gid=500 euid=500 > > suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) > > ses=1 comm="npviewer.bin" > > exe="/usr/lib/nspluginwrapper/npviewer.bin" > > subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 > > key=(null) > > > > > > > > > > > > Has someone else encountered these before and what > > should I do about them? > > > > > > Thanks, > > > > > > Antonio > > > > > > > > > > > > > > > -- > > > fedora-selinux-list mailing list > > > fedora-selinux-list@xxxxxxxxxx > > > > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > > If you change the context of this directory to > > > > chcon -R -t nsplugin_home_t ~/.icedteaplugin > > > > You should eliminate this avc. I will change the layout in > > selinux-policy-3.5.13-21.fc10 > > -----BEGIN PGP SIGNATURE----- > > Version: GnuPG v1.4.9 (GNU/Linux) > > Comment: Using GnuPG with Fedora - > > http://enigmail.mozdev.org > > > > iEYEARECAAYFAkkdhmcACgkQrlYvE4MpobMjuwCZAZh4YDlxJW30wanjBHUZ15CF > > EL0AoNjcjHePhXKzyHjPSc4Ed/WaYnXE > > =m4dV > > -----END PGP SIGNATURE----- > > I tried the chcon command and this is what happened > > Nov 14 20:00:05 localhost kernel: type=1400 > audit(1226714405.352:155): avc: denied { write } for pid=5155 > comm="npviewer.bin" > path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" > dev=dm-0 ino=7734395 > scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 > tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 > 20:00:05 localhost kernel: type=1400 audit(1226714405.352:156): avc: > denied { read } for pid=5155 comm="npviewer.bin" > path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" > dev=dm-0 ino=7734394 > scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 > tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 > 20:00:05 localhost kernel: type=1400 audit(1226714405.388:157): avc: > denied { write } for pid=5159 comm="npviewer.bin" > path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" > dev=dm-0 ino=7734395 > scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 > tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 > 20:00:05 localhost kernel: type=1400 audit(1226714405.388:158): avc: > denied { read } for pid=5159 comm="npviewer.bin" > path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" > dev=dm-0 ino=7734394 > scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 > tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 > 20:00:15 localhost kernel: type=1400 audit(1226714415.618:159): avc: > denied { write } for pid=5166 comm="npviewer.bin" > path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" > dev=dm-0 ino=7734395 > scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 > tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 > 20:00:15 localhost kernel: type=1400 audit(1226714415.618:160): avc: > denied { read } for pid=5166 comm="npviewer.bin" > path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" > dev=dm-0 ino=7734394 > scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 > tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 > 20:00:15 localhost kernel: type=1400 audit(1226714415.654:161): avc: > denied { write } for pid=5169 comm="npviewer.bin" > path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" > dev=dm-0 ino=7734395 > scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 > tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 > 20:00:15 localhost kernel: type=1400 audit(1226714415.654:162): avc: > denied { read } for pid=5169 comm="npviewer.bin" > path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" > dev=dm-0 ino=7734394 > scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 > tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 > 20:00:22 localhost kernel: type=1400 audit(1226714422.242:163): avc: > denied { write } for pid=5176 comm="npviewer.bin" > path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" > dev=dm-0 ino=7734395 > scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 > tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 > 20:00:22 localhost kernel: type=1400 audit(1226714422.242:164): avc: > denied { read } for pid=5176 comm="npviewer.bin" > path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" > dev=dm-0 ino=7734394 > scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 > tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 > 20:00:22 localhost kernel: type=1400 audit(1226714422.279:165): avc: > denied { write } for pid=5179 comm="npviewer.bin" > path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" > dev=dm-0 ino=7734395 > scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 > tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 > 20:00:22 localhost kernel: type=1400 audit(1226714422.279:166): avc: > denied { read } for pid=5179 comm="npviewer.bin" > path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" > dev=dm-0 ino=7734394 > scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 > tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file ^C > [root@localhost ~]# chcon -R -t nsplugin_home_t ~/.icedteaplugin > chcon: cannot access `/root/.icedteaplugin': No such file or > directory The SELinux denials are for the "olivares" user, not "root". So you need to run the chcon command as user olivares. Paul. -- fedora-selinux-list mailing list fedora-selinux-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-selinux-list
