Bug 1034314
| Summary: | SELinux is preventing /usr/sbin/userdel from 'rmdir' accesses on the directory minetest. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Igor Gnatenko <ignatenko> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 20 | CC: | dominick.grift, dwalsh, ignatenko, lvrabec, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:e9e5e853b71d7b8b6918dc5adb95a620f20d90b0a23410cf2e83d2debe9f0d20 | ||
| Fixed In Version: | selinux-policy-3.12.1-105.fc20 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-12-14 02:54:04 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Where does the minetest package come from? (In reply to Daniel Walsh from comment #1) > Where does the minetest package come from? This is my package (I'm maintainer of minetest). I've deleted minetest. After this, I've tried `userdel -r minetest` and got SELinux AVC Did you just execute userdel from the command line or from an init script or from a post install of an RPM? (In reply to Daniel Walsh from comment #3) > Did you just execute userdel from the command line or from an init script or > from a post install of an RPM? from terminal home for minetest user is /var/lib/minetest My configuration: / on /dev/fedora_pc/root /home on /dev/fedora_pc/home Please update to the latest policy yum -y update I believe this problem has been fixed. (In reply to Daniel Walsh from comment #6) > Please update to the latest policy > > yum -y update > > I believe this problem has been fixed. I have updated packages ;) but after updating I've not rebooted. I will reboot soon and re-test selinux-policy-3.12.1-105.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-105.fc20 Package selinux-policy-3.12.1-105.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-105.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-22285/selinux-policy-3.12.1-105.fc20 then log in and leave karma (feedback). selinux-policy-3.12.1-105.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: SELinux is preventing /usr/sbin/userdel from 'rmdir' accesses on the directory minetest. ***** Plugin catchall_labels (83.8 confidence) suggests ******************* If you want to allow userdel to have rmdir access on the minetest directory Then you need to change the label on minetest Do # semanage fcontext -a -t FILE_TYPE 'minetest' where FILE_TYPE is one of the following: alsa_home_t, antivirus_home_t, audio_home_t, auth_home_t, cache_home_t, chrome_sandbox_home_t, config_home_t, data_home_t, dbus_home_t, fetchmail_home_t, gconf_home_t, git_user_content_t, gkeyringd_gnome_home_t, gnome_home_t, gpg_secret_t, gstreamer_home_t, home_bin_t, home_cert_t, httpd_user_content_t, httpd_user_htaccess_t, httpd_user_ra_content_t, httpd_user_rw_content_t, httpd_user_script_exec_t, icc_data_home_t, iceauth_home_t, irc_home_t, irc_tmp_t, irssi_home_t, kismet_home_t, krb5_home_t, local_login_home_t, mail_home_rw_t, mail_home_t, mail_spool_t, mandb_home_t, mozilla_home_t, mpd_home_t, mpd_user_data_t, mplayer_home_t, mysqld_home_t, openshift_cgroup_read_tmp_t, openshift_cron_tmp_t, openshift_rw_file_t, openshift_tmp_t, openshift_var_lib_t, polipo_cache_home_t, polipo_config_home_t, procmail_home_t, pulseaudio_home_t, rlogind_home_t, rssh_ro_t, rssh_rw_t, screen_home_t, selinux_config_t, selinux_login_config_t, semanage_store_t, semanage_tmp_t, smsd_var_lib_t, spamc_home_t, ssh_home_t, stapserver_var_lib_t, svirt_home_t, systemd_home_t, telepathy_cache_home_t, telepathy_data_home_t, telepathy_gabble_cache_home_t, telepathy_logger_cache_home_t, telepathy_logger_data_home_t, telepathy_mission_control_cache_home_t, telepathy_mission_control_data_home_t, telepathy_mission_control_home_t, telepathy_sunshine_home_t, thumb_home_t, tvtime_home_t, uml_ro_t, uml_rw_t, user_fonts_cache_t, user_fonts_config_t, user_fonts_t, user_home_dir_t, user_home_t, user_tmp_t, user_tmpfs_t, useradd_var_run_t, virt_content_t, virt_home_t, vmware_conf_t, vmware_file_t, wine_home_t, wireshark_home_t, xauth_home_t, xdm_home_t. Then execute: restorecon -v 'minetest' ***** Plugin catchall (17.1 confidence) suggests ************************** If you believe that userdel should be allowed rmdir access on the minetest directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep userdel /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023 Target Context system_u:object_r:var_lib_t:s0 Target Objects minetest [ dir ] Source userdel Source Path /usr/sbin/userdel Port <Unknown> Host (removed) Source RPM Packages shadow-utils-4.1.5.1-8.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-90.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.11.8-300.fc20.x86_64 #1 SMP Wed Nov 13 16:34:27 UTC 2013 x86_64 x86_64 Alert Count 1 First Seen 2013-11-25 19:14:53 MSK Last Seen 2013-11-25 19:14:53 MSK Local ID 27f77c97-dd7c-4f63-9d46-28cac73cebde Raw Audit Messages type=AVC msg=audit(1385392493.3:1140): avc: denied { rmdir } for pid=6933 comm="userdel" name="minetest" dev="dm-1" ino=1837163 scontext=unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir type=SYSCALL msg=audit(1385392493.3:1140): arch=x86_64 syscall=rmdir success=no exit=EACCES a0=7fb05b3165b0 a1=1 a2=54d0 a3=d items=0 ppid=6932 pid=6933 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=1 tty=pts0 comm=userdel exe=/usr/sbin/userdel subj=unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023 key=(null) Hash: userdel,useradd_t,var_lib_t,dir,rmdir Additional info: reporter: libreport-2.1.9 hashmarkername: setroubleshoot kernel: 3.11.8-300.fc20.x86_64 type: libreport