Bug 1056991
| Summary: | SELinux is preventing /usr/bin/gnome-shell from 'read' accesses on the lnk_file /usr/bin/tor-browser. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | ale ritty <aleritty> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 20 | CC: | dominick.grift, dwalsh, lvrabec, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:23473d90d41986e63b6bf3711d9d8c62435d0da217765bb408a228de01617b74 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-01-23 10:35:24 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 1056831 *** # /sbin/restorecon -v /usr/bin/tor-browser |
Description of problem: Simply install tor-browser SELinux is preventing /usr/bin/gnome-shell from 'read' accesses on the lnk_file /usr/bin/tor-browser. ***** Plugin restorecon (99.5 confidence) suggests ************************ If si desidera sistemare l'etichetta. L'etichetta predefinita di /usr/bin/tor-browser dovrebbe essere bin_t. Then è possibile avviare restorecon. Do # /sbin/restorecon -v /usr/bin/tor-browser ***** Plugin catchall (1.49 confidence) suggests ************************** If si crede che gnome-shell dovrebbe avere possibilità di accesso read sui tor-browser lnk_file in modo predefinito. Then si dovrebbe riportare il problema come bug. E' possibile generare un modulo di politica locale per consentire questo accesso. Do consentire questo accesso per il momento eseguendo: # grep gnome-shell /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context unconfined_u:object_r:user_tmp_t:s0 Target Objects /usr/bin/tor-browser [ lnk_file ] Source gnome-shell Source Path /usr/bin/gnome-shell Port <Unknown> Host (removed) Source RPM Packages gnome-shell-3.10.2.1-3.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-117.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 3.12.8-300.fc20.x86_64 #1 SMP Thu Jan 16 01:07:50 UTC 2014 x86_64 x86_64 Alert Count 8 First Seen 2014-01-19 17:01:55 CET Last Seen 2014-01-23 10:59:36 CET Local ID 6c97f317-9379-4737-97d8-f936c362123f Raw Audit Messages type=AVC msg=audit(1390471176.171:345): avc: denied { read } for pid=1074 comm="gnome-shell" name="tor-browser" dev="sda1" ino=807593 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=lnk_file type=SYSCALL msg=audit(1390471176.171:345): arch=x86_64 syscall=access success=no exit=EACCES a0=34366f9 a1=1 a2=8 a3=7fff920a6d20 items=0 ppid=1017 pid=1074 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 ses=4294967295 tty=(none) comm=gnome-shell exe=/usr/bin/gnome-shell subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) Hash: gnome-shell,xdm_t,user_tmp_t,lnk_file,read Additional info: reporter: libreport-2.1.11 hashmarkername: setroubleshoot kernel: 3.12.8-300.fc20.x86_64 type: libreport