Bug 1246184
| Summary: | SELinux is preventing brprintconflsr3 from using the 'execmem' accesses on a process. | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | --Fox-- <fredred> | |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | |
| Status: | CLOSED EOL | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 22 | CC: | ambijat, dominick.grift, dwalsh, lvrabec, mgrepl, m.koshelev, pebolle, plautrba | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | x86_64 | |||
| OS: | Unspecified | |||
| Whiteboard: | abrt_hash:22b3dd6db8d10b90893b3aa887ed08093003d09faf341a90188e264986a37c7d | |||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1294592 (view as bug list) | Environment: | ||
| Last Closed: | 2016-07-19 17:08:56 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
Also seeing blocking on other files in Fedora 22 with latest updates, e.g.
SELinux is preventing brprintconflsr3 from execute access on the file /etc/ld.so.cache.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that brprintconflsr3 should be allowed execute access on the ld.so.cache file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep brprintconflsr3 /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context system_u:system_r:cupsd_t:s0-s0:c0.c1023
Target Context system_u:object_r:ld_so_cache_t:s0
Target Objects /etc/ld.so.cache [ file ]
Source brprintconflsr3
Source Path brprintconflsr3
Port <Unknown>
Host (removed)
Source RPM Packages
Target RPM Packages glibc-2.21-7.fc22.x86_64 glibc-2.21-7.fc22.i686
Policy RPM selinux-policy-3.13.1-128.6.fc22.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name (removed>
Platform Linux (removed) 4.0.8-300.fc22.x86_64 #1 SMP Fri Jul 10
21:04:56 UTC 2015 x86_64 x86_64
Alert Count 10
First Seen 2015-07-26 18:07:52 EDT
Last Seen 2015-07-26 18:07:52 EDT
Local ID d2f0f9e0-5659-4604-872f-27a681a8e425
Raw Audit Messages
type=AVC msg=audit(1437948472.247:877): avc: denied { execute } for pid=2356 comm="rawtobr3" path="/etc/ld.so.cache" dev="dm-1" ino=1050344 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ld_so_cache_t:s0 tclass=file permissive=0
Hash: brprintconflsr3,cupsd_t,ld_so_cache_t,file,execute
Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed. |
Description of problem: When trying to print, the print job is not sent to the printer. SELinux is blocking it. The driver used is from the Brother website and has worked well for the last few years. SELinux is preventing brprintconflsr3 from using the 'execmem' accesses on a process. ***** Plugin catchall_boolean (89.3 confidence) suggests ****************** If you want to allow cups to execmem Then you must tell SELinux about this by enabling the 'cups_execmem' boolean. You can read 'None' man page for more details. Do setsebool -P cups_execmem 1 ***** Plugin catchall (11.6 confidence) suggests ************************** If you believe that brprintconflsr3 should be allowed execmem access on processes labeled cupsd_t by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep brprintconflsr3 /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:cupsd_t:s0-s0:c0.c1023 Target Context system_u:system_r:cupsd_t:s0-s0:c0.c1023 Target Objects Unknown [ process ] Source brprintconflsr3 Source Path brprintconflsr3 Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-128.6.fc22.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.0.8-300.fc22.x86_64 #1 SMP Fri Jul 10 21:04:56 UTC 2015 x86_64 x86_64 Alert Count 40 First Seen 2015-07-20 13:18:44 EDT Last Seen 2015-07-23 11:37:44 EDT Local ID 07372336-ff10-47be-9dc7-75721cccecf0 Raw Audit Messages type=AVC msg=audit(1437665864.807:624): avc: denied { execmem } for pid=5608 comm="rawtobr3" scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tclass=process permissive=0 Hash: brprintconflsr3,cupsd_t,cupsd_t,process,execmem Version-Release number of selected component: selinux-policy-3.13.1-128.6.fc22.noarch Additional info: reporter: libreport-2.6.1 hashmarkername: setroubleshoot kernel: 4.0.8-300.fc22.x86_64 type: libreport