Bug 1255960
| Summary: | SELinux is preventing brprintconflsr3 from 'execute' accesses on the file /etc/ld.so.cache. | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | ambrish dhaka <ambijat> | |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | |
| Status: | CLOSED EOL | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 22 | CC: | dominick.grift, dwalsh, emc2983, john.j.jesus, lvrabec, mgrepl, michael, pebolle, plautrba, trommer.martin | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | x86_64 | |||
| OS: | Unspecified | |||
| Whiteboard: | abrt_hash:9301a6365ce4d30409eed37a41fa31a069006e285a7202d982e4cdd4402d159d | |||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1294595 (view as bug list) | Environment: | ||
| Last Closed: | 2016-07-19 20:35:56 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
*** Bug 1255961 has been marked as a duplicate of this bug. *** Description of problem: printing on brother laser printer 2250DN Version-Release number of selected component: selinux-policy-3.13.1-128.12.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.1.6-200.fc22.x86_64 type: libreport Description of problem: Everytime I try to print something this alert pops up, but printing is successful. Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.2.3-200.fc22.x86_64 type: libreport Same problem:
SELinux is preventing brprintconflsr3 from execute access on the file /etc/ld.so.cache.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that brprintconflsr3 should be allowed execute access on the ld.so.cache file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep brprintconflsr3 /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context system_u:system_r:cupsd_t:s0-s0:c0.c1023
Target Context unconfined_u:object_r:ld_so_cache_t:s0
Target Objects /etc/ld.so.cache [ file ]
Source brprintconflsr3
Source Path brprintconflsr3
Port <Unknown>
Host (removed)
Source RPM Packages
Target RPM Packages glibc-2.21-8.fc22.x86_64 glibc-2.21-8.fc22.i686
Policy RPM selinux-policy-3.13.1-128.18.fc22.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name (removed)
Platform Linux (removed) 4.2.5-201.fc22.x86_64 #1 SMP Wed Oct 28
20:00:23 UTC 2015 x86_64 x86_64
Alert Count 70
First Seen 2015-10-25 23:46:19 EDT
Last Seen 2015-11-11 07:21:56 EST
Local ID 4eeeb37a-73a1-4c04-b3e3-f3a298fc02fe
Raw Audit Messages
type=AVC msg=audit(1447244516.147:670): avc: denied { execute } for pid=9502 comm="rawtobr3" path="/etc/ld.so.cache" dev="dm-1" ino=1049662 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:ld_so_cache_t:s0 tclass=file permissive=0
Hash: brprintconflsr3,cupsd_t,ld_so_cache_t,file,execute
I *still* need to use 'setsebool cups_execmem 1' as per bug
https://bugzilla.redhat.com/show_bug.cgi?id=1246184
in order to print at all, and even though print is successful the above alert appears.
This is now worse in Fedora 23. Same error, but now printing does not happen at all.
SELinux is preventing brprintconflsr3 from execute access on the file /etc/ld.so.cache.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that brprintconflsr3 should be allowed execute access on the ld.so.cache file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep brprintconflsr3 /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context system_u:system_r:cupsd_t:s0-s0:c0.c1023
Target Context system_u:object_r:ld_so_cache_t:s0
Target Objects /etc/ld.so.cache [ file ]
Source brprintconflsr3
Source Path brprintconflsr3
Port <Unknown>
Host (removed)
Source RPM Packages
Target RPM Packages glibc-2.22-6.fc23.x86_64 glibc-2.22-6.fc23.i686
Policy RPM selinux-policy-3.13.1-155.fc23.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name (removed)
Platform Linux (removed) 4.2.6-301.fc23.x86_64
#1 SMP Fri Nov 20 22:22:41 UTC 2015 x86_64 x86_64
Alert Count 9
First Seen 2015-12-08 00:06:03 EST
Last Seen 2015-12-08 00:06:03 EST
Local ID a0b21b7c-09c0-40aa-9df9-f50a22bc3675
Raw Audit Messages
type=AVC msg=audit(1449551163.283:697): avc: denied { execute } for pid=7609 comm="brprintconflsr3" path="/etc/ld.so.cache" dev="dm-0" ino=1837314 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ld_so_cache_t:s0 tclass=file permissive=0
Hash: brprintconflsr3,cupsd_t,ld_so_cache_t,file,execute
I installed Fedora 23 and cups. I also got the SE alert in the log during printing.
Mar 18 22:38:51 me_user audit: AVC avc: denied { execute } for pid=6309 comm="rawtobr3" path="/etc/ld.so.cache" dev="sda2" ino=1181615 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:ld_so_cache_t:s0 tclass=file permissive=0
But the printing succeed.
"I *still* need to use 'setsebool cups_execmem 1' as per bug
https://bugzilla.redhat.com/show_bug.cgi?id=1246184
in order to print at all, and even though print is successful the above alert appears."
Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed. This problem (with executable brhl3150cdwfilt for Brother printer driver for HL3150CDW) occurs on Fedora 24, so this bug should be reopened. |
Description of problem: printing error SELinux is preventing brprintconflsr3 from 'execute' accesses on the file /etc/ld.so.cache. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that brprintconflsr3 should be allowed execute access on the ld.so.cache file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep brprintconflsr3 /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:cupsd_t:s0-s0:c0.c1023 Target Context unconfined_u:object_r:ld_so_cache_t:s0 Target Objects /etc/ld.so.cache [ file ] Source brprintconflsr3 Source Path brprintconflsr3 Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages glibc-2.21-7.fc22.x86_64 glibc-2.21-7.fc22.i686 Policy RPM selinux-policy-3.13.1-128.10.fc22.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.1.5-200.fc22.x86_64 #1 SMP Mon Aug 10 23:38:23 UTC 2015 x86_64 x86_64 Alert Count 10 First Seen 2015-08-22 17:45:53 IST Last Seen 2015-08-22 17:45:53 IST Local ID e033f10b-90be-4881-b84f-70841af8a9fd Raw Audit Messages type=AVC msg=audit(1440245753.811:644): avc: denied { execute } for pid=3416 comm="rawtobr3" path="/etc/ld.so.cache" dev="dm-1" ino=397760 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:ld_so_cache_t:s0 tclass=file permissive=0 Hash: brprintconflsr3,cupsd_t,ld_so_cache_t,file,execute Version-Release number of selected component: selinux-policy-3.13.1-128.10.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.1.5-200.fc22.x86_64 type: libreport