Attachment 601347 Details for Bug 844494 – File: description

File: description

description (text/plain), 4.19 KB, created by Markus Schulze on 2012-07-30 22:19:50 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Markus Schulze

Created: 2012-07-30 22:19:50 UTC

Size: 4.19 KB

patch

obsolete

>SELinux is preventing /bin/bash from 'write' accesses on the directory ffgtk.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If sie denken, dass bash standardmÃ¤ssig erlaubt sein sollte, write Zugriff auf ffgtk directory zu erhalten.
>Then sie sollten dies als Fehler melden.
>Um diesen Zugriff zu erlauben, kÃ¶nnen Sie ein lokales Richtlinien-Modul erstellen.
>Do
>zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausfÃ¼hren:
># grep ffgtk-cups /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                system_u:system_r:cupsd_t:s0-s0:c0.c1023
>Target Context                unconfined_u:object_r:var_spool_t:s0
>Target Objects                ffgtk [ dir ]
>Source                        ffgtk-cups
>Source Path                   /bin/bash
>Port                          <Unbekannt>
>Host                          (removed)
>Source RPM Packages           bash-4.2.28-1.fc16.i686
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.10.0-90.fc16.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     (removed)
>Platform                      Linux (removed) 3.3.8-1.fc16.i686 #1 SMP
>                              Mon Jun 4 21:30:50 UTC 2012 i686 i686
>Alert Count                   4
>First Seen                    Mo 30 Jul 2012 23:50:32 CEST
>Last Seen                     Di 31 Jul 2012 00:16:24 CEST
>Local ID                      c9ad514e-2321-47e7-8bfe-5f8444dc79e5
>
>Raw Audit Messages
>type=AVC msg=audit(1343686584.520:214): avc:  denied  { write } for  pid=6960 comm="ffgtk-cups" name="ffgtk" dev="dm-1" ino=542847 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_spool_t:s0 tclass=dir
>
>
>type=AVC msg=audit(1343686584.520:214): avc:  denied  { add_name } for  pid=6960 comm="ffgtk-cups" name="schulze-Fax-ID62" scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_spool_t:s0 tclass=dir
>
>
>type=AVC msg=audit(1343686584.520:214): avc:  denied  { create } for  pid=6960 comm="ffgtk-cups" name="schulze-Fax-ID62" scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
>
>
>type=AVC msg=audit(1343686584.520:214): avc:  denied  { write open } for  pid=6960 comm="ffgtk-cups" name="schulze-Fax-ID62" dev="dm-1" ino=543296 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1343686584.520:214): arch=i386 syscall=open success=yes exit=EIO a0=87f1080 a1=8241 a2=1b6 a3=0 items=0 ppid=6958 pid=6960 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm=ffgtk-cups exe=/bin/bash subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>
>Hash: ffgtk-cups,cupsd_t,var_spool_t,dir,write
>
>audit2allow
>
>#============= cupsd_t ==============
>#!!!! The source type 'cupsd_t' can write to a 'dir' of the following types:
># var_lock_t, tmp_t, var_t, cupsd_rw_etc_t, cupsd_tmp_t, cupsd_etc_t, cupsd_log_t, var_run_t, var_log_t, cupsd_var_run_t, pcscd_var_run_t, print_spool_t, cupsd_interface_t, tmp_t, root_t, krb5_host_rcache_t
>
>allow cupsd_t var_spool_t:dir { write add_name };
>#!!!! The source type 'cupsd_t' can write to a 'file' of the following types:
># cupsd_rw_etc_t, cupsd_tmp_t, cupsd_log_t, cupsd_lock_t, cupsd_var_run_t, pcscd_var_run_t, print_spool_t, cupsd_interface_t, root_t, krb5_host_rcache_t
>
>allow cupsd_t var_spool_t:file { write create open };
>
>audit2allow -R
>
>#============= cupsd_t ==============
>#!!!! The source type 'cupsd_t' can write to a 'dir' of the following types:
># var_lock_t, tmp_t, var_t, cupsd_rw_etc_t, cupsd_tmp_t, cupsd_etc_t, cupsd_log_t, var_run_t, var_log_t, cupsd_var_run_t, pcscd_var_run_t, print_spool_t, cupsd_interface_t, tmp_t, root_t, krb5_host_rcache_t
>
>allow cupsd_t var_spool_t:dir { write add_name };
>#!!!! The source type 'cupsd_t' can write to a 'file' of the following types:
># cupsd_rw_etc_t, cupsd_tmp_t, cupsd_log_t, cupsd_lock_t, cupsd_var_run_t, pcscd_var_run_t, print_spool_t, cupsd_interface_t, root_t, krb5_host_rcache_t
>
>allow cupsd_t var_spool_t:file { write create open };
>

Actions: View

Attachments on bug 844494: 601347