Bug 1015313
| Summary: | SELinux is preventing /usr/bin/kmod from 'search' accesses on the directory /usr/lib/modules. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | nino.corsi |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 19 | CC: | dominick.grift, dwalsh, lvrabec, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i686 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:a6e92386f4430287cad628ea22d587bd03c183b33ce525e605b2ee8fc56652df | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-10-04 07:34:45 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Hi, You should use: "# restorecon /usr/bin/kmod". Because your /usr/bin/kmod has type firewalld_t instead of insmod_exec_t. |
Description of problem: SELinux is preventing /usr/bin/kmod from 'search' accesses on the directory /usr/lib/modules. ***** Plugin catchall (100. confidence) suggests *************************** If si crede che kmod dovrebbe avere possibilità di accesso search sui modules directory in modo predefinito. Then si dovrebbe riportare il problema come bug. E' possibile generare un modulo di politica locale per consentire questo accesso. Do consentire questo accesso per il momento eseguendo: # grep modprobe /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:firewalld_t:s0 Target Context system_u:object_r:modules_object_t:s0 Target Objects /usr/lib/modules [ dir ] Source modprobe Source Path /usr/bin/kmod Port <Sconosciuto> Host (removed) Source RPM Packages kmod-14-1.fc19.i686 Target RPM Packages Policy RPM selinux-policy-3.12.1-74.8.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.11.2-201.fc19.i686 #1 SMP Fri Sep 27 19:46:30 UTC 2013 i686 i686 Alert Count 7 First Seen 2013-10-03 18:45:44 CEST Last Seen 2013-10-03 23:58:56 CEST Local ID 21f7441e-35ca-48e7-899a-0937628f6060 Raw Audit Messages type=AVC msg=audit(1380837536.239:193): avc: denied { search } for pid=806 comm="modprobe" name="modules" dev="dm-0" ino=394190 scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=dir type=SYSCALL msg=audit(1380837536.239:193): arch=i386 syscall=open success=no exit=EACCES a0=bff1fa3c a1=88000 a2=1b6 a3=8159238 items=0 ppid=544 pid=806 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=modprobe exe=/usr/bin/kmod subj=system_u:system_r:firewalld_t:s0 key=(null) Hash: modprobe,firewalld_t,modules_object_t,dir,search Additional info: reporter: libreport-2.1.7 hashmarkername: setroubleshoot kernel: 3.11.2-201.fc19.i686 type: libreport