Bug 1011686

Summary: SELinux is preventing /usr/libexec/kde4/kcmdatetimehelper from 'remove_name' accesses on the directory kcmclockrcMT1593.new.
Product: [Fedora] Fedora Reporter: Sean Ward <skillicorn>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 18CC: dominick.grift, dwalsh, lvrabec, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: i686   
OS: Unspecified   
Whiteboard: abrt_hash:51fba88a92f499571e3e7d30831b80fe9517983abef2a7da17b6cdaeede448bf
Fixed In Version: selinux-policy-3.11.1-106.fc18 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-10-24 00:56:45 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Sean Ward 2013-09-24 20:41:49 UTC
Description of problem:
Time wrong on reboot after package update. Attempted to reset time to automatic using Public Time Server and SELinux denied the process.
SELinux is preventing /usr/libexec/kde4/kcmdatetimehelper from 'remove_name' accesses on the directory kcmclockrcMT1593.new.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that kcmdatetimehelper should be allowed remove_name access on the kcmclockrcMT1593.new directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep kcmdatetimehelp /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
Target Context                system_u:object_r:config_usr_t:s0
Target Objects                kcmclockrcMT1593.new [ dir ]
Source                        kcmdatetimehelp
Source Path                   /usr/libexec/kde4/kcmdatetimehelper
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           kde-workspace-4.10.5-3.fc18.i686
Target RPM Packages           
Policy RPM                    selinux-policy-3.11.1-103.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 3.10.12-100.fc18.i686.PAE #1 SMP
                              Mon Sep 16 13:16:09 UTC 2013 i686 i686
Alert Count                   1
First Seen                    2013-09-24 16:35:00 EDT
Last Seen                     2013-09-24 16:35:00 EDT
Local ID                      baefaba8-92bc-4ae7-a368-fa47623d34cb

Raw Audit Messages
type=AVC msg=audit(1380054900.737:346): avc:  denied  { remove_name } for  pid=1593 comm="kcmdatetimehelp" name="kcmclockrcMT1593.new" dev="dm-1" ino=1573260 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:config_usr_t:s0 tclass=dir


type=AVC msg=audit(1380054900.737:346): avc:  denied  { rename } for  pid=1593 comm="kcmdatetimehelp" name="kcmclockrcMT1593.new" dev="dm-1" ino=1573260 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:config_usr_t:s0 tclass=file


type=AVC msg=audit(1380054900.737:346): avc:  denied  { unlink } for  pid=1593 comm="kcmdatetimehelp" name="kcmclockrc" dev="dm-1" ino=1573258 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:config_usr_t:s0 tclass=file


type=SYSCALL msg=audit(1380054900.737:346): arch=i386 syscall=rename success=yes exit=0 a0=9f7c560 a1=9f82798 a2=4a3ad060 a3=bfae5f24 items=0 ppid=1 pid=1593 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=kcmdatetimehelp exe=/usr/libexec/kde4/kcmdatetimehelper subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)

Hash: kcmdatetimehelp,system_dbusd_t,config_usr_t,dir,remove_name

audit2allow

#============= system_dbusd_t ==============
allow system_dbusd_t config_usr_t:dir remove_name;
allow system_dbusd_t config_usr_t:file { rename unlink };

audit2allow -R
require {
	type config_usr_t;
	type system_dbusd_t;
	class dir remove_name;
	class file { rename unlink };
}

#============= system_dbusd_t ==============
allow system_dbusd_t config_usr_t:dir remove_name;
allow system_dbusd_t config_usr_t:file { rename unlink };


Additional info:
reporter:       libreport-2.1.6
hashmarkername: setroubleshoot
kernel:         3.10.12-100.fc18.i686.PAE
type:           libreport

Comment 1 Miroslav Grepl 2013-09-30 15:00:37 UTC
If you execute

# chcon -t gnomeclock_exec_t /usr/libexec/kde4/kcmdatetimehelper

it will fix it for now.


commit ec082b657a1e57761664128c8518ad5a87cb42ff
Author: Miroslav Grepl <mgrepl>
Date:   Mon Sep 30 16:59:25 2013 +0200

    Fix labeling for /usr/libexec/kde4/kcmdatetimehelper

Comment 2 Fedora Update System 2013-10-08 21:23:33 UTC
selinux-policy-3.11.1-106.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-106.fc18

Comment 3 Fedora Update System 2013-10-10 00:57:03 UTC
Package selinux-policy-3.11.1-106.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-106.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-18622/selinux-policy-3.11.1-106.fc18
then log in and leave karma (feedback).

Comment 4 Fedora Update System 2013-10-24 00:56:45 UTC
selinux-policy-3.11.1-106.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.