Bug 1004809
| Summary: | SELinux is preventing /usr/libexec/kde4/polkit-kde-authentication-agent-1 from 'getattr' accesses on the directory /usr/share/config. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Juan Orti <jorti> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 19 | CC: | dominick.grift, dwalsh, lvrabec, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:07d35ec98d15550fd6382c8f244f9d14bf190ed8dbf1d3893b0319abe29a789d | ||
| Fixed In Version: | selinux-policy-3.12.1-74.2.fc19 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-09-12 01:53:41 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
a2f32121db7ab15668430bf6b63d8922947876c7 fixes this in git. back ported. selinux-policy-3.12.1-74.2.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-74.2.fc19 Package selinux-policy-3.12.1-74.2.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-74.2.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-16231/selinux-policy-3.12.1-74.2.fc19 then log in and leave karma (feedback). selinux-policy-3.12.1-74.2.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: I have changed my user to staff_u, changed my home dir with "chcon -R -u staff_u /home/juan" and logged in KDE SELinux is preventing /usr/libexec/kde4/polkit-kde-authentication-agent-1 from 'getattr' accesses on the directory /usr/share/config. ***** Plugin catchall (100. confidence) suggests *************************** If cree que de manera predeterminada, polkit-kde-authentication-agent-1 debería permitir acceso getattr sobre config directory. Then debería reportar esto como un error. Puede generar un módulo de política local para permitir este acceso. Do permita el acceso momentáneamente executando: # grep polkit-kde-auth /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context staff_u:staff_r:policykit_auth_t:s0-s0:c0.c1023 Target Context system_u:object_r:config_usr_t:s0 Target Objects /usr/share/config [ dir ] Source polkit-kde-auth Source Path /usr/libexec/kde4/polkit-kde-authentication- agent-1 Port <Desconocido> Host (removed) Source RPM Packages polkit-kde-0.99.1-1.20130311git.fc19.x86_64 Target RPM Packages kde-filesystem-4-45.fc19.x86_64 Policy RPM selinux-policy-3.12.1-73.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.10.10-200.fc19.x86_64 #1 SMP Thu Aug 29 19:05:45 UTC 2013 x86_64 x86_64 Alert Count 6 First Seen 2013-09-04 23:44:37 CEST Last Seen 2013-09-05 16:17:11 CEST Local ID 43aff884-15bc-4106-927a-b30b36e9628f Raw Audit Messages type=AVC msg=audit(1378390631.574:604): avc: denied { getattr } for pid=2569 comm="polkit-kde-auth" path="/usr/share/config" dev="sda3" ino=32319 scontext=staff_u:staff_r:policykit_auth_t:s0-s0:c0.c1023 tcontext=system_u:object_r:config_usr_t:s0 tclass=dir type=SYSCALL msg=audit(1378390631.574:604): arch=x86_64 syscall=stat success=no exit=EACCES a0=167a398 a1=7fff035d69c0 a2=7fff035d69c0 a3=4 items=0 ppid=2538 pid=2569 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=4 tty=(none) comm=polkit-kde-auth exe=/usr/libexec/kde4/polkit-kde-authentication-agent-1 subj=staff_u:staff_r:policykit_auth_t:s0-s0:c0.c1023 key=(null) Hash: polkit-kde-auth,policykit_auth_t,config_usr_t,dir,getattr Additional info: reporter: libreport-2.1.6 hashmarkername: setroubleshoot kernel: 3.10.10-200.fc19.x86_64 type: libreport