Bug 1316447

Summary: SELinux is preventing /usr/libexec/abrt-hook-ccpp from 'write' accesses on the sock_file socket.
Product: [Fedora] Fedora Reporter: Tom Ghyselinck <tom.ghyselinck>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 23CC: dominick.grift, dwalsh, jdbarnes, lvrabec, mgrepl, plautrba, tom.ghyselinck, vikigoyal
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:4c57fd730d96f84202f9bbdbf70670167009e9a11c5ca25033fffb5baa8f87d3;VARIANT_ID=workstation;
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-03-10 10:23:51 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Tom Ghyselinck 2016-03-10 09:35:48 UTC
Description of problem:
SELinux is preventing /usr/libexec/abrt-hook-ccpp from 'write' accesses on the sock_file socket.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that abrt-hook-ccpp should be allowed write access on the socket sock_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep abrt-hook-ccpp /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:abrt_dump_oops_t:s0
Target Context                system_u:object_r:nscd_var_run_t:s0
Target Objects                socket [ sock_file ]
Source                        abrt-hook-ccpp
Source Path                   /usr/libexec/abrt-hook-ccpp
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    <Unknown>
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.4.3-300.fc23.x86_64 #1 SMP Fri
                              Feb 26 18:45:40 UTC 2016 x86_64 x86_64
Alert Count                   3
First Seen                    2016-03-10 10:31:52 CET
Last Seen                     2016-03-10 10:31:52 CET
Local ID                      ae5b8285-6c22-45ea-b5c9-99d0f5799ec8

Raw Audit Messages
type=AVC msg=audit(1457602312.891:1055): avc:  denied  { write } for  pid=31528 comm="abrt-hook-ccpp" name="socket" dev="tmpfs" ino=20928 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=sock_file permissive=0


type=SYSCALL msg=audit(1457602312.891:1055): arch=x86_64 syscall=connect success=no exit=EACCES a0=6 a1=7ffe9d420a80 a2=6e a3=7fd684882ce0 items=0 ppid=2 pid=31528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=abrt-hook-ccpp exe=/usr/libexec/abrt-hook-ccpp subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null)

Hash: abrt-hook-ccpp,abrt_dump_oops_t,nscd_var_run_t,sock_file,write


Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.4.3-300.fc23.x86_64
type:           libreport

Comment 1 Lukas Vrabec 2016-03-10 10:23:51 UTC
$ audit2allow -i avc 


#============= abrt_dump_oops_t ==============

#!!!! This avc is allowed in the current policy
allow abrt_dump_oops_t nscd_var_run_t:sock_file write;


What is version of your selinux-policy package? Could you update this package and try to reproduce this issue?

Comment 2 Tom Ghyselinck 2016-03-10 10:56:24 UTC
Hi,

My package version is:
$ dnf info selinux-policy
Last metadata expiration check performed 14:20:58 ago on Wed Mar  9 21:33:08 2016.
Installed Packages
Name        : selinux-policy
Arch        : noarch
Epoch       : 0
Version     : 3.13.1
Release     : 158.7.fc23
Size        : 18 k
Repo        : @System
From repo   : updates
Summary     : SELinux policy configuration
URL         : http://github.com/TresysTechnology/refpolicy/wiki
License     : GPLv2+
Description : SELinux Base package for SELinux Reference Policy - modular.
            : Based off of reference policy: Checked out revision  2.20091117

Comment 3 Joe B 2016-03-25 22:52:42 UTC
*** Bug 1321377 has been marked as a duplicate of this bug. ***

Comment 4 vikram goyal 2016-04-23 12:59:29 UTC
Description of problem:

upgrading with dnf update create this alert.

Following were the updates:

Apr 23 18:20:49 INFO Upgraded: expat-2.1.1-1.fc23.x86_64
Apr 23 18:20:56 INFO Installed: kernel-core-4.4.7-300.fc23.x86_64
Apr 23 18:21:06 INFO Installed: kernel-modules-4.4.7-300.fc23.x86_64
Apr 23 18:21:07 INFO Upgraded: libsolv-0.6.20-1.fc23.x86_64
Apr 23 18:21:09 INFO Upgraded: setroubleshoot-server-3.3.5-3.fc23.x86_64
Apr 23 18:21:10 INFO Upgraded: pygtk2-2.24.0-14.fc23.x86_64
Apr 23 18:21:12 INFO Upgraded: bluez-5.39-1.fc23.x86_64
Apr 23 18:21:12 INFO Upgraded: libreport-filesystem-2.6.4-2.fc23.x86_64
Apr 23 18:21:13 INFO Upgraded: libreport-2.6.4-2.fc23.x86_64
Apr 23 18:21:14 INFO Upgraded: abrt-libs-2.8.0-4.fc23.x86_64
Apr 23 18:21:14 INFO Upgraded: libreport-web-2.6.4-2.fc23.x86_64
Apr 23 18:21:15 INFO Upgraded: libreport-python3-2.6.4-2.fc23.x86_64
Apr 23 18:21:16 INFO Upgraded: libreport-plugin-ureport-2.6.4-2.fc23.x86_64
Apr 23 18:21:16 INFO Upgraded: abrt-python3-2.8.0-4.fc23.x86_64
Apr 23 18:21:19 INFO Upgraded: abrt-2.8.0-4.fc23.x86_64
Apr 23 18:21:20 INFO Upgraded: abrt-dbus-2.8.0-4.fc23.x86_64
Apr 23 18:21:21 INFO Upgraded: abrt-retrace-client-2.8.0-4.fc23.x86_64
Apr 23 18:21:21 INFO Upgraded: libreport-plugin-bugzilla-2.6.4-2.fc23.x86_64
Apr 23 18:21:22 INFO Upgraded: abrt-plugin-bodhi-2.8.0-4.fc23.x86_64
Apr 23 18:21:22 INFO Upgraded: abrt-addon-xorg-2.8.0-4.fc23.x86_64
Apr 23 18:21:23 INFO Upgraded: abrt-addon-python3-2.8.0-4.fc23.x86_64
Apr 23 18:21:23 INFO Upgraded: libreport-plugin-reportuploader-2.6.4-2.fc23.x86_64
Apr 23 18:21:25 INFO Upgraded: libreport-gtk-2.6.4-2.fc23.x86_64
Apr 23 18:21:26 INFO Upgraded: abrt-gui-libs-2.8.0-4.fc23.x86_64
Apr 23 18:21:29 INFO Upgraded: gnome-abrt-1.2.2-2.fc23.x86_64
Apr 23 18:21:29 INFO Upgraded: libreport-fedora-2.6.4-2.fc23.x86_64
Apr 23 18:21:29 INFO Upgraded: libreport-plugin-logger-2.6.4-2.fc23.x86_64
Apr 23 18:21:30 INFO Upgraded: abrt-gui-2.8.0-4.fc23.x86_64
Apr 23 18:21:30 INFO Upgraded: libreport-plugin-kerneloops-2.6.4-2.fc23.x86_64
Apr 23 18:21:31 INFO Upgraded: abrt-addon-kerneloops-2.8.0-4.fc23.x86_64
Apr 23 18:21:32 INFO Upgraded: abrt-addon-vmcore-2.8.0-4.fc23.x86_64
Apr 23 18:21:33 INFO Upgraded: abrt-addon-pstoreoops-2.8.0-4.fc23.x86_64
Apr 23 18:21:35 INFO Upgraded: abrt-addon-coredump-helper-2.8.0-4.fc23.x86_64
Apr 23 18:21:36 INFO Upgraded: abrt-addon-ccpp-2.8.0-4.fc23.x86_64
Apr 23 18:21:36 INFO Upgraded: libreport-cli-2.6.4-2.fc23.x86_64
Apr 23 18:21:36 INFO Upgraded: abrt-tui-2.8.0-4.fc23.x86_64
Apr 23 18:21:37 INFO Upgraded: abrt-cli-2.8.0-4.fc23.x86_64
Apr 23 18:21:37 INFO Upgraded: abrt-desktop-2.8.0-4.fc23.x86_64
Apr 23 18:21:38 INFO Upgraded: setroubleshoot-3.3.5-3.fc23.x86_64
Apr 23 18:21:39 INFO Upgraded: libreport-anaconda-2.6.4-2.fc23.x86_64
Apr 23 18:21:39 INFO Upgraded: bluez-cups-5.39-1.fc23.x86_64
Apr 23 18:21:39 INFO Upgraded: pygtk2-libglade-2.24.0-14.fc23.x86_64
Apr 23 18:21:39 INFO Installed: kernel-4.4.7-300.fc23.x86_64
Apr 23 18:21:57 INFO Upgraded: google-chrome-stable-50.0.2661.86-1.x86_64
Apr 23 18:21:58 INFO Upgraded: xpad-4.8.0-1.fc23.x86_64
Apr 23 18:21:58 INFO Upgraded: parted-3.2-18.fc23.x86_64
Apr 23 18:21:59 INFO Upgraded: libtasn1-4.8-1.fc23.x86_64
Apr 23 18:22:01 INFO Upgraded: libinput-1.2.4-1.fc23.x86_64
Apr 23 18:22:03 INFO Upgraded: kernel-headers-4.4.7-300.fc23.x86_64
Apr 23 18:22:04 INFO Upgraded: hwdata-0.288-1.fc23.noarch
Apr 23 18:22:05 INFO Upgraded: bluez-libs-5.39-1.fc23.x86_64
Apr 23 18:22:05 INFO Cleanup: abrt-desktop-2.8.0-3.fc23.x86_64
Apr 23 18:22:05 INFO Cleanup: abrt-cli-2.8.0-3.fc23.x86_64
Apr 23 18:22:05 INFO Cleanup: abrt-addon-vmcore-2.8.0-3.fc23.x86_64
Apr 23 18:22:07 INFO Cleanup: libreport-anaconda-2.6.4-1.fc23.x86_64
Apr 23 18:22:07 INFO Cleanup: abrt-addon-python3-2.8.0-3.fc23.x86_64
Apr 23 18:22:07 INFO Erased: kernel-4.4.5-300.fc23.x86_64
Apr 23 18:22:08 INFO Cleanup: libreport-fedora-2.6.4-1.fc23.x86_64
Apr 23 18:22:05 INFO Cleanup: abrt-addon-vmcore-2.8.0-3.fc23.x86_64
Apr 23 18:22:07 INFO Cleanup: libreport-anaconda-2.6.4-1.fc23.x86_64
Apr 23 18:22:07 INFO Cleanup: abrt-addon-python3-2.8.0-3.fc23.x86_64
Apr 23 18:22:07 INFO Erased: kernel-4.4.5-300.fc23.x86_64
Apr 23 18:22:08 INFO Cleanup: libreport-fedora-2.6.4-1.fc23.x86_64
Apr 23 18:22:08 INFO Cleanup: google-chrome-stable-50.0.2661.75-1.x86_64
Apr 23 18:22:09 INFO Cleanup: abrt-gui-2.8.0-3.fc23.x86_64
Apr 23 18:22:09 INFO Cleanup: abrt-addon-ccpp-2.8.0-3.fc23.x86_64
Apr 23 18:22:10 INFO Cleanup: gnome-abrt-1.2.2-1.fc23.x86_64
Apr 23 18:22:11 INFO Cleanup: abrt-tui-2.8.0-3.fc23.x86_64
Apr 23 18:22:11 INFO Cleanup: abrt-addon-pstoreoops-2.8.0-3.fc23.x86_64
Apr 23 18:22:12 INFO Cleanup: abrt-addon-kerneloops-2.8.0-3.fc23.x86_64
Apr 23 18:22:13 INFO Cleanup: abrt-plugin-bodhi-2.8.0-3.fc23.x86_64
Apr 23 18:22:13 INFO Cleanup: libreport-plugin-kerneloops-2.6.4-1.fc23.x86_64
Apr 23 18:22:13 INFO Cleanup: libreport-plugin-bugzilla-2.6.4-1.fc23.x86_64
Apr 23 18:22:14 INFO Cleanup: abrt-addon-xorg-2.8.0-3.fc23.x86_64
Apr 23 18:22:14 INFO Cleanup: setroubleshoot-3.3.5-2.fc23.x86_64
Apr 23 18:22:15 INFO Cleanup: libreport-gtk-2.6.4-1.fc23.x86_64
Apr 23 18:22:15 INFO Cleanup: libreport-plugin-reportuploader-2.6.4-1.fc23.x86_64
Apr 23 18:22:16 INFO Cleanup: abrt-gui-libs-2.8.0-3.fc23.x86_64
Apr 23 18:22:16 INFO Cleanup: abrt-addon-coredump-helper-2.8.0-3.fc23.x86_64
Apr 23 18:22:16 INFO Cleanup: abrt-retrace-client-2.8.0-3.fc23.x86_64
Apr 23 18:22:17 INFO Cleanup: libsolv-0.6.19-2.fc23.x86_64
Apr 23 18:22:18 INFO Cleanup: abrt-dbus-2.8.0-3.fc23.x86_64
Apr 23 18:22:19 INFO Cleanup: abrt-python3-2.8.0-3.fc23.x86_64
Apr 23 18:22:19 INFO Cleanup: abrt-2.8.0-3.fc23.x86_64
Apr 23 18:22:21 INFO Cleanup: libreport-plugin-ureport-2.6.4-1.fc23.x86_64
Apr 23 18:22:21 INFO Cleanup: libreport-web-2.6.4-1.fc23.x86_64
Apr 23 18:22:26 INFO Cleanup: abrt-libs-2.8.0-3.fc23.x86_64
Apr 23 18:22:27 INFO Cleanup: libreport-python3-2.6.4-1.fc23.x86_64
Apr 23 18:22:27 INFO Cleanup: libreport-cli-2.6.4-1.fc23.x86_64
Apr 23 18:22:28 INFO Erased: kernel-modules-4.4.5-300.fc23.x86_64
Apr 23 18:22:35 INFO Cleanup: libreport-plugin-logger-2.6.4-1.fc23.x86_64
Apr 23 18:22:36 INFO Cleanup: libreport-2.6.4-1.fc23.x86_64
Apr 23 18:22:37 INFO Cleanup: pygtk2-libglade-2.24.0-12.fc23.x86_64
Apr 23 18:22:37 INFO Cleanup: bluez-cups-5.38-1.fc23.x86_64
Apr 23 18:22:37 INFO Cleanup: libreport-filesystem-2.6.4-1.fc23.x86_64
Apr 23 18:22:37 INFO Cleanup: kernel-headers-4.4.6-301.fc23.x86_64
Apr 23 18:22:38 INFO Cleanup: hwdata-0.287-1.fc23.noarch
Apr 23 18:22:39 INFO Cleanup: bluez-5.38-1.fc23.x86_64
Apr 23 18:22:40 INFO Cleanup: pygtk2-2.24.0-12.fc23.x86_64
Apr 23 18:22:41 INFO Erased: kernel-core-4.4.5-300.fc23.x86_64
Apr 23 18:22:42 INFO Cleanup: expat-2.1.0-12.fc23.x86_64
Apr 23 18:22:43 INFO Cleanup: setroubleshoot-server-3.3.5-2.fc23.x86_64
Apr 23 18:22:44 INFO Cleanup: xpad-4.7.0-1.fc23.x86_64
Apr 23 18:22:44 INFO Cleanup: parted-3.2-17.fc23.x86_64
Apr 23 18:22:45 INFO Cleanup: libtasn1-4.5-2.fc23.x86_64
Apr 23 18:22:45 INFO Cleanup: libinput-1.2.3-1.fc23.x86_64
Apr 23 18:22:46 INFO Cleanup: bluez-libs-5.38-1.fc23.x86_64

Version-Release number of selected component:
selinux-policy-3.13.1-158.14.fc23.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.4.6-301.fc23.x86_64
type:           libreport