Attachment 583927 Details for Bug 814471 – AVC deniel

AVC deniel

avc (text/plain), 2.76 KB, created by Karolis Dauzickas on 2012-05-11 20:36:56 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Karolis Dauzickas

Created: 2012-05-11 20:36:56 UTC

Size: 2.76 KB

patch

obsolete

>SELinux is preventing system-config-s from open access on the chr_file urandom.
>
>*****  Plugin catchall_boolean (47.5 confidence) suggests  *******************
>
>If you want to allow users to login using a sssd server
>Then you must tell SELinux about this by enabling the 'authlogin_nsswitch_use_ldap'boolean.
>Do
>setsebool -P authlogin_nsswitch_use_ldap 1
>
>*****  Plugin catchall_boolean (47.5 confidence) suggests  *******************
>
>If you want to enable reading of urandom for all domains.
>Then you must tell SELinux about this by enabling the 'global_ssp'boolean.
>Do
>setsebool -P global_ssp 1
>
>*****  Plugin catchall (6.38 confidence) suggests  ***************************
>
>If you believe that system-config-s should be allowed open access on the urandom chr_file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep system-config-s /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                system_u:system_r:sambagui_t:s0-s0:c0.c1023
>Target Context                system_u:object_r:urandom_device_t:s0
>Target Objects                urandom [ chr_file ]
>Source                        system-config-s
>Source Path                   system-config-s
>Port                          <Unknown>
>Host                          mothership
>Source RPM Packages           
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.10.0-84.fc16.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     mothership
>Platform                      Linux mothership 3.3.4-3.fc16.i686 #1 SMP Thu May
>                              3 15:01:22 UTC 2012 i686 i686
>Alert Count                   1
>First Seen                    Fri 11 May 2012 09:25:45 PM IST
>Last Seen                     Fri 11 May 2012 09:25:45 PM IST
>Local ID                      2f76e328-f757-49e8-992c-d2e5c88def17
>
>Raw Audit Messages
>type=AVC msg=audit(1336767945.68:118): avc:  denied  { open } for  pid=3314 comm="system-config-s" name="urandom" dev="devtmpfs" ino=1033 scontext=system_u:system_r:sambagui_t:s0-s0:c0.c1023 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file
>
>
>Hash: system-config-s,sambagui_t,urandom_device_t,chr_file,open
>
>audit2allow
>
>#============= sambagui_t ==============
>#!!!! This avc can be allowed using one of the these booleans:
>#     authlogin_nsswitch_use_ldap, global_ssp
>
>allow sambagui_t urandom_device_t:chr_file open;
>
>audit2allow -R
>
>#============= sambagui_t ==============
>#!!!! This avc can be allowed using one of the these booleans:
>#     authlogin_nsswitch_use_ldap, global_ssp
>
>allow sambagui_t urandom_device_t:chr_file open;
>
>

Actions: View

Attachments on bug 814471: 583927