Bug 1023937

Does bug 666185 look like the same problem to you?

It does look the same, yes.  But I also do not have /tmp linked to my ~/tmp.  I do have $TMPDIR set to ~/tmp though.

Description of problem:
1.  Attempted to print from qpdfview (via cups), which failed.
2.  SELinux detected an error.
3.  Created a new local policy, per the error report.

Note: there was also a failure to allow cups-pk-helper-mechanism to write to a temporary file.

Additional info:
reporter:       libreport-2.1.8
hashmarkername: setroubleshoot
kernel:         3.11.6-200.fc19.x86_64
type:           libreport

(In reply to Dale Snell from comment #3)
> 3.  Created a new local policy, per the error report.

Can you paste the commands you used to create the policy?  Thanks!

Sure thing:

"grep cups-pk-helper- /var/log/audit/audit.log | audit2allow -M local_cups_Policy".

If it helps, my $TMPDIR is set to $HOME/.tmp.

Oops, forgot to add the second line:

"semodule -i local_cups_Policy.pp"

So what was in local_cups_Policy.pp then?  And/Or perhaps what was the output of:

grep cups-pk-helper- /var/log/audit/audit.log

Okay, here you are, the output of

grep cups-pk-helper- /var/log/audit/audit.log

type=AVC msg=audit(1383246773.813:697): avc:  denied  { read } for  pid=3297 comm="cups-pk-helper-" name="tmpK5Wgkz" dev="dm-8" ino=1477148 scontext=system_u:system_r:cupsd_config_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
type=SYSCALL msg=audit(1383246773.813:697): arch=c000003e syscall=2 success=no exit=-13 a0=f95910 a1=0 a2=ffffffffffffffff a3=3e2ee1b2e0 items=0 ppid=1 pid=3297 auid=4294967295 uid=0 gid=0 euid=1000 suid=0 fsuid=1000 egid=1000 sgid=0 fsgid=1000 ses=4294967295 tty=(none) comm="cups-pk-helper-" exe="/usr/libexec/cups-pk-helper-mechanism" subj=system_u:system_r:cupsd_config_t:s0-s0:c0.c1023 key=(null)


Here are the contents of local_cups_Policy.te (.pp to follow as an attachment)

module local_cups_Policy 1.0;

require {
        type user_home_t;
        type cupsd_config_t;
        class file read;
}

#============= cupsd_config_t ==============
allow cupsd_config_t user_home_t:file read;

Created attachment 818073 [details]
The file /root/local_cups_Policy.pp

So, I got this one again.  I don't think I really should need to have to create local policy.  SELinux should have sufficient policy built-in to handle this.

You want me to allow a  confined domain to read random content in users homedirectories?  Because you changed where tmp content is stored?

(In reply to Daniel Walsh from comment #11)
> You want me to allow a  confined domain to read random content in users
> homedirectories?

I think you are putting words in my mouth.  Of course I never suggested that entire home directories should be readible, but allowing access to ~/tmp is not any more unreasonable than allowing the same access in /tmp.

>  Because you changed where tmp content is stored?

Yes.  Because I don't want to have to manage consumption (by users) of my root filesystems.  If they want to fill up their $HOME with files, temporary or otherwise, then that is their resource to do that with.

I have no problem labeling ~/tmp dirorectory as user_tmp_t, probably not a bad idea.  Been a while since this bug was commented on.

3301303252216f80fb1dc2e7148c26507905a155 fixes this in git.  Basically labels ~/.tmp and ~/tmp as user_tmp_t.

backported to F20,F19.

selinux-policy-3.12.1-74.30.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-74.30.fc19

Package selinux-policy-3.12.1-74.30.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-74.30.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-16276/selinux-policy-3.12.1-74.30.fc19
then log in and leave karma (feedback).

selinux-policy-3.12.1-74.30.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.