Bug 1052177
| Summary: | SELinux is preventing /usr/bin/tar from using the chown capability. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Juan Orti <jorti> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 20 | CC: | dominick.grift, dwalsh, lvrabec, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.12.1-116.fc20 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-01-16 07:13:55 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
commit 4a7f97cb040632affbd5d5991507cf754e481ee4
Author: Miroslav Grepl <mgrepl>
Date: Mon Jan 13 14:35:29 2014 +0100
Add also chown cap for abrt_upload_watch_t. It already has dac_override
selinux-policy-3.12.1-116.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-116.fc20 Package selinux-policy-3.12.1-116.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-116.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-0806/selinux-policy-3.12.1-116.fc20 then log in and leave karma (feedback). selinux-policy-3.12.1-116.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: I've configured the service abrt-upload-watch to receive abrt crashes from remote servers. When it tries to untar them, I get this errors. It tries to set the uid 25 (named) which is not installed in this server. SELinux is preventing /usr/bin/tar from using the chown capability. ***** Plugin catchall (100. confidence) suggests ************************** If cree que tar debería tener la capacidad de chown de forma predeterminada. Then debería reportar esto como un error. Puede generar un módulo de política local para permitir este acceso. Do permita el acceso momentáneamente executando: # grep tar /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:abrt_upload_watch_t:s0 Target Context system_u:system_r:abrt_upload_watch_t:s0 Target Objects [ capability ] Source tar Source Path /usr/bin/tar Port <Unknown> Host <removed> Source RPM Packages tar-1.26-30.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-106.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name <removed> Platform Linux <removed> 3.12.6-300.fc20.x86_64 #1 SMP Mon Dec 23 16:44:31 UTC 2013 x86_64 x86_64 Alert Count 4 First Seen 2014-01-13 13:43:30 CET Last Seen 2014-01-13 13:43:30 CET Local ID 7a683cce-3722-40c1-8230-e24b5d05b296 Raw Audit Messages type=AVC msg=audit(1389617010.884:4222): avc: denied { chown } for pid=1639 comm="tar" capability=0 scontext=system_u:system_r:abrt_upload_watch_t:s0 tcontext=system_u:system_r:abrt_upload_watch_t:s0 tclass=capability type=SYSCALL msg=audit(1389617010.884:4222): arch=x86_64 syscall=fchown success=no exit=EPERM a0=4 a1=19 a2=ad a3=1ff items=0 ppid=1636 pid=1639 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=tar exe=/usr/bin/tar subj=system_u:system_r:abrt_upload_watch_t:s0 key=(null) Hash: tar,abrt_upload_watch_t,abrt_upload_watch_t,capability,chown