Bug 1491858
| Summary: | SELinux is preventing abrt-action-sav from 'write' accesses on the file /var/lib/rpm/Sha1header. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Reynaldo Porras <reynaldo.porras> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 26 | CC: | dwalsh, lsm5, lvrabec, mgrepl, plautrba, pmatilai, pmoore |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:53b69c22b90dfec56a10860d72a15336c0bd135bd2be140760c745f80e100ee3;VARIANT_ID=workstation; | ||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-02-07 09:19:22 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 1495817 *** |
Description of problem: It happened during a dnf update Eliminado: kernel.x86_64 4.12.5-300.fc26 kernel-core.x86_64 4.12.5-300.fc26 kernel-devel.x86_64 4.12.5-300.fc26 kernel-modules.x86_64 4.12.5-300.fc26 kernel-modules-extra.x86_64 4.12.5-300.fc26 kmod-nvidia-340xx-4.12.5-300.fc26.x86_64.x86_64 1:340.102-4.fc26 Instalado: kernel.x86_64 4.12.11-300.fc26 kernel-core.x86_64 4.12.11-300.fc26 kernel-devel.x86_64 4.12.11-300.fc26 kernel-modules.x86_64 4.12.11-300.fc26 kernel-modules-extra.x86_64 4.12.11-300.fc26 Actualizado: autocorr-en.noarch 1:5.3.6.1-5.fc26 bluez.x86_64 5.46-6.fc26 bluez-cups.x86_64 5.46-6.fc26 bluez-libs.x86_64 5.46-6.fc26 bluez-obexd.x86_64 5.46-6.fc26 emacs-filesystem.noarch 1:25.3-1.fc26 ffmpeg-libs.x86_64 3.3.3-4.fc26 file.x86_64 5.30-11.fc26 file-libs.x86_64 5.30-11.fc26 flatpak.x86_64 0.9.10-1.fc26 flatpak-libs.x86_64 0.9.10-1.fc26 fpaste.noarch 0.3.9.1-1.fc26 gawk.x86_64 4.1.4-4.fc26 gdb.x86_64 8.0.1-26.fc26 gdb-headless.x86_64 8.0.1-26.fc26 gnome-online-accounts.x86_64 3.24.3-1.fc26 google-chrome-stable.x86_64 61.0.3163.91-1 kernel-headers.x86_64 4.12.11-300.fc26 kernel-tools-libs.x86_64 4.12.11-300.fc26 libreoffice-calc.x86_64 1:5.3.6.1-5.fc26 libreoffice-core.x86_64 1:5.3.6.1-5.fc26 libreoffice-data.noarch 1:5.3.6.1-5.fc26 libreoffice-draw.x86_64 1:5.3.6.1-5.fc26 libreoffice-emailmerge.x86_64 1:5.3.6.1-5.fc26 libreoffice-filters.x86_64 1:5.3.6.1-5.fc26 libreoffice-graphicfilter.x86_64 1:5.3.6.1-5.fc26 libreoffice-gtk2.x86_64 1:5.3.6.1-5.fc26 libreoffice-gtk3.x86_64 1:5.3.6.1-5.fc26 libreoffice-impress.x86_64 1:5.3.6.1-5.fc26 libreoffice-langpack-en.x86_64 1:5.3.6.1-5.fc26 libreoffice-math.x86_64 1:5.3.6.1-5.fc26 libreoffice-ogltrans.x86_64 1:5.3.6.1-5.fc26 libreoffice-opensymbol-fonts.noarch 1:5.3.6.1-5.fc26 libreoffice-pdfimport.x86_64 1:5.3.6.1-5.fc26 libreoffice-pyuno.x86_64 1:5.3.6.1-5.fc26 libreoffice-ure.x86_64 1:5.3.6.1-5.fc26 libreoffice-ure-common.noarch 1:5.3.6.1-5.fc26 libreoffice-writer.x86_64 1:5.3.6.1-5.fc26 libreoffice-x11.x86_64 1:5.3.6.1-5.fc26 libreoffice-xsltfilter.x86_64 1:5.3.6.1-5.fc26 libwmf-lite.x86_64 0.2.8.4-53.fc26 perl-Date-Manip.noarch 6.60-1.fc26 python2-pyOpenSSL.noarch 16.2.0-5.fc26 python3-pyOpenSSL.noarch 16.2.0-5.fc26 qemu-block-curl.x86_64 2:2.9.1-1.fc26 qemu-block-dmg.x86_64 2:2.9.1-1.fc26 qemu-block-gluster.x86_64 2:2.9.1-1.fc26 qemu-block-iscsi.x86_64 2:2.9.1-1.fc26 qemu-block-nfs.x86_64 2:2.9.1-1.fc26 qemu-block-rbd.x86_64 2:2.9.1-1.fc26 qemu-block-ssh.x86_64 2:2.9.1-1.fc26 qemu-common.x86_64 2:2.9.1-1.fc26 qemu-guest-agent.x86_64 2:2.9.1-1.fc26 qemu-img.x86_64 2:2.9.1-1.fc26 qemu-kvm.x86_64 2:2.9.1-1.fc26 qemu-system-x86.x86_64 2:2.9.1-1.fc26 qemu-system-x86-core.x86_64 2:2.9.1-1.fc26 vim-common.x86_64 2:8.0.1097-1.fc26 vim-enhanced.x86_64 2:8.0.1097-1.fc26 vim-filesystem.x86_64 2:8.0.1097-1.fc26 vim-minimal.x86_64 2:8.0.1097-1.fc26 SELinux is preventing abrt-action-sav from 'write' accesses on the file /var/lib/rpm/Sha1header. ***** Plugin restorecon (94.8 confidence) suggests ************************ If quiere arreglar la etiqueta. La etiqueta predeterminada de /var/lib/rpm/Sha1header debería ser rpm_var_lib_t. Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly. Do # /sbin/restorecon -v /var/lib/rpm/Sha1header ***** Plugin catchall_labels (5.21 confidence) suggests ******************* If you want to allow abrt-action-sav to have write access on the Sha1header file Then necesita modificar la etiqueta en /var/lib/rpm/Sha1header Do # semanage fcontext -a -t FILE_TYPE '/var/lib/rpm/Sha1header' donde FILE_TYPE es uno de los siguientes: abrt_etc_t, abrt_tmp_t, abrt_upload_watch_tmp_t, abrt_var_cache_t, abrt_var_log_t, abrt_var_run_t, afs_cache_t, initrc_tmp_t, mock_var_lib_t, postfix_postdrop_t, puppet_tmp_t, rpm_log_t, rpm_var_cache_t, rpm_var_run_t, sysfs_t, user_cron_spool_t, user_tmp_t. Luego ejecute: restorecon -v '/var/lib/rpm/Sha1header' ***** Plugin catchall (1.44 confidence) suggests ************************** If cree que de manera predeterminada, abrt-action-sav debería permitir acceso write sobre Sha1header file. Then debería reportar esto como un error. Puede generar un módulo de política local para permitir este acceso. Do allow this access for now by executing: # ausearch -c 'abrt-action-sav' --raw | audit2allow -M my-abrtactionsav # semodule -X 300 -i my-abrtactionsav.pp Additional Information: Source Context system_u:system_r:abrt_t:s0-s0:c0.c1023 Target Context unconfined_u:object_r:var_lib_t:s0 Target Objects /var/lib/rpm/Sha1header [ file ] Source abrt-action-sav Source Path abrt-action-sav Port <Desconocido> Host (removed) Source RPM Packages Target RPM Packages rpm-4.13.0.1-7.fc26.x86_64 Policy RPM selinux-policy-3.13.1-260.8.fc26.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 4.12.9-300.fc26.x86_64 #1 SMP Fri Aug 25 13:09:43 UTC 2017 x86_64 x86_64 Alert Count 5 First Seen 2017-01-15 23:36:33 CST Last Seen 2017-09-14 12:58:07 CST Local ID d311db1b-be5f-445a-b86a-de510aed7fd8 Raw Audit Messages type=AVC msg=audit(1505415487.482:273): avc: denied { write } for pid=17419 comm="abrt-action-sav" name="Sha1header" dev="dm-1" ino=1839651 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1 Hash: abrt-action-sav,abrt_t,var_lib_t,file,write Version-Release number of selected component: selinux-policy-3.13.1-260.8.fc26.noarch Additional info: component: selinux-policy reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.9-300.fc26.x86_64 type: libreport Potential duplicate: bug 1209244