Attachment 306437 Details for Bug 448031 – Sample setroubleshooter alert

Sample setroubleshooter alert

selinux_alert_places.sqlite-journal.txt (text/plain), 2.56 KB, created by Michael Wiktowy on 2008-05-23 01:58:44 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Michael Wiktowy

Created: 2008-05-23 01:58:44 UTC

Size: 2.56 KB

patch

obsolete

>
>Summary:
>
>SELinux is preventing firefox from creating a file with a context of unlabeled_t
>on a filesystem.
>
>Detailed Description:
>
>SELinux is preventing firefox from creating a file with a context of unlabeled_t
>on a filesystem. Usually this happens when you ask the cp command to maintain
>the context of a file when copying between file systems, "cp -a" for example.
>Not all file contexts should be maintained between the file systems. For
>example, a read-only file type like iso9660_t should not be placed on a r/w
>system. "cp -P" might be a better solution, as this will adopt the default file
>context for the destination.
>
>Allowing Access:
>
>Use a command like "cp -P" to preserve all permissions except SELinux context.
>
>Additional Information:
>
>Source Context                unconfined_u:object_r:unlabeled_t
>Target Context                system_u:object_r:fs_t
>Target Objects                places.sqlite-journal [ filesystem ]
>Source                        firefox
>Source Path                   /usr/lib/firefox-3.0b5/firefox
>Port                          <Unknown>
>Host                          localhost.localdomain
>Source RPM Packages           firefox-3.0-0.60.beta5.fc9
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.3.1-51.fc9
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   filesystem_associate
>Host Name                     localhost.localdomain
>Platform                      Linux localhost.localdomain 2.6.25.3-18.fc9.i686
>                              #1 SMP Tue May 13 05:38:53 EDT 2008 i686 athlon
>Alert Count                   64
>First Seen                    Thu 22 May 2008 08:06:19 PM EDT
>Last Seen                     Thu 22 May 2008 08:49:43 PM EDT
>Local ID                      4984d6d0-f791-4d1d-a485-779e33cdd5c9
>Line Numbers                  
>
>Raw Audit Messages            
>
>host=localhost.localdomain type=AVC msg=audit(1211503783.200:60): avc:  denied  { associate } for  pid=4055 comm="firefox" name="places.sqlite-journal" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem
>
>host=localhost.localdomain type=SYSCALL msg=audit(1211503783.200:60): arch=40000003 syscall=5 success=no exit=-13 a0=a32419e a1=80c2 a2=1a4 a3=80c2 items=0 ppid=4041 pid=4055 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="firefox" exe="/usr/lib/firefox-3.0b5/firefox" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>
>

Actions: View

Attachments on bug 448031: 306437