| Summary: | SELinux is preventing /usr/bin/kdm (deleted) from 'entrypoint' accesses on the file /usr/bin/systemctl. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | kitmaxter |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 19 | CC: | dominick.grift, dwalsh, kitmaxter, lvrabec, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:acbfcc95ba0f9213979a74cb34fb0d5600613496326e2ae9d398fad07dd272b3 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-12-16 09:43:43 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
*** Bug 1043289 has been marked as a duplicate of this bug. *** Does everything work correctly? It is caused by a bad update and will go away with the next boot. Yes, indeed no alert after boot and kdm started without errors. |
Description of problem: SELinux is preventing /usr/bin/kdm (deleted) from 'entrypoint' accesses on the file /usr/bin/systemctl. ***** Plugin catchall (100. confidence) suggests *************************** If якщо ви вважаєте, що kdm (deleted) має бути надано типовий доступ entrypoint до systemctl file. Then вам слід повідомити про цю помилку як про ваду. Ви можете створити модуль локальних правил для надання подібного доступу. Do надайте доступ за допомогою команд: # grep kdm /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:systemd_systemctl_exec_t:s0 Target Objects /usr/bin/systemctl [ file ] Source kdm Source Path /usr/bin/kdm (deleted) Port <Невідомо> Host (removed) Source RPM Packages Target RPM Packages systemd-204-17.fc19.x86_64 Policy RPM selinux-policy-3.12.1-74.13.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.11.6-200.fc19.x86_64 #1 SMP Fri Oct 18 22:34:18 UTC 2013 x86_64 x86_64 Alert Count 1 First Seen 2013-11-23 23:32:54 EET Last Seen 2013-11-23 23:32:54 EET Local ID 09441134-ed1e-4d5e-ad35-9fde3f1bb77b Raw Audit Messages type=AVC msg=audit(1385242374.717:28706): avc: denied { entrypoint } for pid=3331 comm="kdm" path="/usr/bin/systemctl" dev="sda2" ino=7478635 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_systemctl_exec_t:s0 tclass=file type=SYSCALL msg=audit(1385242374.717:28706): arch=x86_64 syscall=execve success=no exit=EACCES a0=7f83c7316ea0 a1=7f83c73142f0 a2=0 a3=8 items=0 ppid=531 pid=3331 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=kdm exe=2F7573722F62696E2F6B646D202864656C6574656429 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) Hash: kdm,xdm_t,systemd_systemctl_exec_t,file,entrypoint Additional info: reporter: libreport-2.1.9 hashmarkername: setroubleshoot kernel: 3.11.10-200.fc19.x86_64 type: libreport