Bug 1438942
| Summary: | SELinux is preventing gdk-pixbuf-thum from using the 'dac_read_search' capabilities. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Delete My Account <c.crispino8611> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rawhide | CC: | dominick.grift, dwalsh, lvrabec, mgrepl, plautrba, pmoore, ssekidde |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:58ba9cbaaa5b6dc84d18c1d7e95bc1959a7959a11697089020512432a8db9b6c; | ||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-06-02 06:32:36 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Description of problem: Search with Caja (root user) SELinux is preventing gdk-pixbuf-thum from using the 'dac_read_search' capabilities. ***** Plugin dac_override (91.4 confidence) suggests ********************** If si vuole aiutare ad identificare se al dominio serva questo accesso o se si possiede un file con i permessi sbagliati sul sistema Then attivare l'auditing completo per ottenere le informazioni del percorso del file incriminato e generare nuovamente l'errore. Do Attivare il controllo completo auditing # auditctl -w /etc/shadow -p w Provare a ricreare AVC. Eseguire quindi # ausearch -m avc -ts recent Qualora si noti il record PATH, controllare la proprietà/i permessi sul file e correggerli, altrimenti registrare un bugzilla. ***** Plugin catchall (9.59 confidence) suggests ************************** If si pensa che gdk-pixbuf-thum dovrebbe avere funzionalità dac_read_search in modo predefinito. Then si dovrebbe riportare il problema come bug. E' possibile generare un modulo di politica locale per consentire questo accesso. Do allow this access for now by executing: # ausearch -c 'gdk-pixbuf-thum' --raw | audit2allow -M my-gdkpixbufthum # semodule -X 300 -i my-gdkpixbufthum.pp Additional Information: Source Context unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 Target Context unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 Target Objects Unknown [ capability ] Source gdk-pixbuf-thum Source Path gdk-pixbuf-thum Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-248.fc27.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.11.0-0.rc4.git3.1.fc27.x86_64 #1 SMP Thu Mar 30 15:10:15 UTC 2017 x86_64 x86_64 Alert Count 1 First Seen 2017-04-04 21:56:38 CEST Last Seen 2017-04-04 21:56:38 CEST Local ID 918918ee-f167-46f9-bc26-4f91146e08f4 Raw Audit Messages type=AVC msg=audit(1491335798.929:1094): avc: denied { dac_read_search } for pid=25909 comm="gdk-pixbuf-thum" capability=2 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=capability permissive=0 Hash: gdk-pixbuf-thum,thumb_t,thumb_t,capability,dac_read_search Version-Release number of selected component: selinux-policy-3.13.1-248.fc27.noarch Additional info: component: selinux-policy reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.0-0.rc4.git3.1.fc27.x86_64 type: libreport