Re: SELinux is preventing gdm-binary (xdm_t) "unlink" to ... and npviewer

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Antonio Olivares wrote:
> --- On Fri, 11/14/08, Daniel J Walsh <dwalsh@xxxxxxxxxx> wrote:
> 
>> From: Daniel J Walsh <dwalsh@xxxxxxxxxx>
>> Subject: Re: SELinux is preventing gdm-binary (xdm_t) "unlink" to ... and npviewer
>> To: olivares14031@xxxxxxxxx
>> Cc: fedora-selinux-list@xxxxxxxxxx
>> Date: Friday, November 14, 2008, 6:08 AM
> Antonio Olivares wrote:
>>>> Dear selinux experts, 
>>>>
>>>> running fedora 10 preview updated to latest packages 
>>>>
>>>> [olivares@riohigh2 ~]$ uname -r
>>>> 2.6.27.5-101.fc10.i686
>>>> [olivares@riohigh2 ~]$ rpm -qa selinux*
>>>> selinux-policy-3.5.13-18.fc10.noarch
>>>> selinux-policy-targeted-3.5.13-18.fc10.noarch
>>>>
>>>>
>>>> Summary:
>>>>
>>>> SELinux is preventing gdm-binary (xdm_t)
> "unlink" to
>>>> ./force-display-on-active-vt (var_spool_t).
>>>>
>>>> Detailed Description:
>>>>
>>>> SELinux is preventing gdm-binary (xdm_t)
> "unlink" to
>>>> ./force-display-on-active-vt (var_spool_t). The
> SELinux type var_spool_t, is a
>>>> generic type for all files in the directory and very
> few processes (SELinux
>>>> Domains) are allowed to write to this SELinux type.
> This type of denial usual
>>>> indicates a mislabeled file. By default a file created
> in a directory has the
>>>> gets the context of the parent directory, but SELinux
> policy has rules about the
>>>> creation of directories, that say if a process running
> in one SELinux Domain
>>>> (D1) creates a file in a directory with a particular
> SELinux File Context (F1)
>>>> the file gets a different File Context (F2). The
> policy usually allows the
>>>> SELinux Domain (D1) the ability to write, unlink, and
> append on (F2). But if for
>>>> some reason a file (./force-display-on-active-vt) was
> created with the wrong
>>>> context, this domain will be denied. The usual
> solution to this problem is to
>>>> reset the file context on the target file, restorecon
> -v
>>>> './force-display-on-active-vt'. If the file
> context does not change from
>>>> var_spool_t, then this is probably a bug in policy.
> Please file a bug report
>>>> (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
> against the selinux-policy
>>>> package. If it does change, you can try your
> application again to see if it
>>>> works. The file context could have been mislabeled by
> editing the file or moving
>>>> the file from a different directory, if the file keeps
> getting mislabeled, check
>>>> the init scripts to see if they are doing something to
> mislabel the file.
>>>> Allowing Access:
>>>>
>>>> You can attempt to fix file context by executing
> restorecon -v
>>>> './force-display-on-active-vt'
>>>>
>>>> Fix Command:
>>>>
>>>> restorecon './force-display-on-active-vt'
>>>>
>>>> Additional Information:
>>>>
>>>> Source Context               
> system_u:system_r:xdm_t:s0-s0:c0.c1023
>>>> Target Context               
> system_u:object_r:var_spool_t:s0
>>>> Target Objects               
> ./force-display-on-active-vt [ file ]
>>>> Source                        gdm-binary
>>>> Source Path                   /usr/sbin/gdm-binary
>>>> Port                          <Unknown>
>>>> Host                          riohigh2
>>>> Source RPM Packages           gdm-2.24.0-12.fc10
>>>> Target RPM Packages           
>>>> Policy RPM                   
> selinux-policy-3.5.13-18.fc10
>>>> Selinux Enabled               True
>>>> Policy Type                   targeted
>>>> MLS Enabled                   True
>>>> Enforcing Mode                Enforcing
>>>> Plugin Name                   mislabeled_file
>>>> Host Name                     riohigh2
>>>> Platform                      Linux riohigh2
> 2.6.27.5-94.fc10.i686 #1 SMP Mon
>>>>                               Nov 10 15:51:55 EST 2008
> i686 athlon
>>>> Alert Count                   17
>>>> First Seen                    Mon 03 Nov 2008 07:08:33
> AM CST
>>>> Last Seen                     Thu 13 Nov 2008 04:21:21
> PM CST
>>>> Local ID                     
> a66adf6c-89d5-4d90-83ca-f34c94bb4d45
>>>> Line Numbers                  
>>>>
>>>> Raw Audit Messages            
>>>>
>>>> node=riohigh2 type=AVC msg=audit(1226614881.881:36):
> avc:  denied  { unlink } for  pid=2090
> comm="gdm-binary"
> name="force-display-on-active-vt" dev=sda6
> ino=190494 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
> tcontext=system_u:object_r:var_spool_t:s0 tclass=file
>>>> node=riohigh2 type=SYSCALL
> msg=audit(1226614881.881:36): arch=40000003 syscall=10
> success=no exit=-13 a0=8063b84 a1=0 a2=4f86dc a3=9940400
> items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0
> suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
> ses=4294967295 comm="gdm-binary"
> exe="/usr/sbin/gdm-binary"
> subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>>>>
> THe question here is which process created this file?
> force-display-on-active-vt
> 
>>>>
>>>> Summary:
>>>>
>>>> SELinux is preventing the npviewer.bin from using
> potentially mislabeled files
> (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer).
>>>> Detailed Description:
>>>>
>>>> SELinux has denied npviewer.bin access to potentially
> mislabeled file(s)
> (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer).
> This means that
>>>> SELinux will not allow npviewer.bin to use these
> files. It is common for users
>>>> to edit files in their home directory or tmp
> directories and then move (mv) them
>>>> to system directories. The problem is that the files
> end up with the wrong file
>>>> context which confined applications are not allowed to
> access.
>>>> Allowing Access:
>>>>
>>>> If you want npviewer.bin to access this files, you
> need to relabel them using
>>>> restorecon -v
> '/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer'.
>>>> You might want to relabel the entire directory using
> restorecon -R -v '<Unknown>'.
>>>> Additional Information:
>>>>
>>>> Source Context               
> unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102
>>>>                               3
>>>> Target Context               
> unconfined_u:object_r:user_home_t:s0
>>>> Target Objects               
> /home/olivares/.icedteaplugin/icedtea-plugin-to-
>>>>                               appletviewer [ fifo_file
> ]
>>>> Source                        npviewer.bin
>>>> Source Path                  
> /usr/lib/nspluginwrapper/npviewer.bin
>>>> Port                          <Unknown>
>>>> Host                          riohigh2
>>>> Source RPM Packages          
> nspluginwrapper-1.1.2-4.fc10
>>>> Target RPM Packages           
>>>> Policy RPM                   
> selinux-policy-3.5.13-18.fc10
>>>> Selinux Enabled               True
>>>> Policy Type                   targeted
>>>> MLS Enabled                   True
>>>> Enforcing Mode                Enforcing
>>>> Plugin Name                   home_tmp_bad_labels
>>>> Host Name                     riohigh2
>>>> Platform                      Linux riohigh2
> 2.6.27.5-101.fc10.i686 #1 SMP Wed
>>>>                               Nov 12 00:50:43 EST 2008
> i686 athlon
>>>> Alert Count                   4
>>>> First Seen                    Thu 13 Nov 2008 06:31:50
> PM CST
>>>> Last Seen                     Thu 13 Nov 2008 06:31:55
> PM CST
>>>> Local ID                     
> 81d406be-b7e4-4bf4-a8c7-f12b7c36ee27
>>>> Line Numbers                  
>>>>
>>>> Raw Audit Messages            
>>>>
>>>> node=riohigh2 type=AVC msg=audit(1226622715.909:38):
> avc:  denied  { write } for  pid=4732
> comm="npviewer.bin"
> path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer"
> dev=sda6 ino=263881
> scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:user_home_t:s0
> tclass=fifo_file
>>>> node=riohigh2 type=AVC msg=audit(1226622715.909:38):
> avc:  denied  { read } for  pid=4732
> comm="npviewer.bin"
> path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin"
> dev=sda6 ino=263847
> scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:user_home_t:s0
> tclass=fifo_file
>>>> node=riohigh2 type=SYSCALL
> msg=audit(1226622715.909:38): arch=40000003 syscall=11
> success=yes exit=0 a0=9e70d28 a1=9e71d40 a2=9e72210 a3=0
> items=0 ppid=3572 pid=4732 auid=500 uid=500 gid=500 euid=500
> suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none)
> ses=1 comm="npviewer.bin"
> exe="/usr/lib/nspluginwrapper/npviewer.bin"
> subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> key=(null)
>>>>
>>>>
>>>> Has someone else encountered these before and what
> should I do about them?
>>>> Thanks,
>>>>
>>>> Antonio 
>>>>
>>>>
>>>>       
>>>>
>>>> --
>>>> fedora-selinux-list mailing list
>>>> fedora-selinux-list@xxxxxxxxxx
>>>>
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
> If you change the context of this directory to
> 
> chcon -R -t nsplugin_home_t ~/.icedteaplugin
> 
> You should eliminate this avc.  I will change the layout in
> selinux-policy-3.5.13-21.fc10

> I tried the chcon command and this is what happened 

> Nov 14 20:00:05 localhost kernel: type=1400 audit(1226714405.352:155): avc:  denied  { write } for  pid=5155 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file                                                           
> Nov 14 20:00:05 localhost kernel: type=1400 audit(1226714405.352:156): avc:  denied  { read } for  pid=5155 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file                                                            
> Nov 14 20:00:05 localhost kernel: type=1400 audit(1226714405.388:157): avc:  denied  { write } for  pid=5159 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file                                                           
> Nov 14 20:00:05 localhost kernel: type=1400 audit(1226714405.388:158): avc:  denied  { read } for  pid=5159 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file                                                            
> Nov 14 20:00:15 localhost kernel: type=1400 audit(1226714415.618:159): avc:  denied  { write } for  pid=5166 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file                                                           
> Nov 14 20:00:15 localhost kernel: type=1400 audit(1226714415.618:160): avc:  denied  { read } for  pid=5166 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file                                                            
> Nov 14 20:00:15 localhost kernel: type=1400 audit(1226714415.654:161): avc:  denied  { write } for  pid=5169 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file                                                           
> Nov 14 20:00:15 localhost kernel: type=1400 audit(1226714415.654:162): avc:  denied  { read } for  pid=5169 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file                                                            
> Nov 14 20:00:22 localhost kernel: type=1400 audit(1226714422.242:163): avc:  denied  { write } for  pid=5176 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file                                                           
> Nov 14 20:00:22 localhost kernel: type=1400 audit(1226714422.242:164): avc:  denied  { read } for  pid=5176 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file                                                            
> Nov 14 20:00:22 localhost kernel: type=1400 audit(1226714422.279:165): avc:  denied  { write } for  pid=5179 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file                                                           
> Nov 14 20:00:22 localhost kernel: type=1400 audit(1226714422.279:166): avc:  denied  { read } for  pid=5179 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file                                                            
> ^C                                                                              
> [root@localhost ~]# chcon -R -t nsplugin_home_t ~/.icedteaplugin                
> chcon: cannot access `/root/.icedteaplugin': No such file or directory 

> Thanks,

> Antonio 



You need to do it on your homedir.

 chcon -R -t nsplugin_home_t /home/olivares/.icedteaplugin
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkkhi0YACgkQrlYvE4MpobO/oACg5NGTHl+/8iFrKemEsgRt7Lzj
rhAAn0Z/fS83Ae9J2XtyE9JBAC/vwsGo
=H1lb
-----END PGP SIGNATURE-----

--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Index of Archives]     [Fedora Users]     [Fedora Desktop]     [Big List of Linux Books]     [Yosemite News]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

  Powered by Linux