Bug 1643698
| Summary: | SELinux is preventing appsrc0:src from 'execute' accesses on the file 2F72756E2F757365722F313030302F6F7263657865632E4E6E62395457202864656C6574656429. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | xzj8b3 <xzj8b3> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 29 | CC: | dwalsh, jonathonpoppleton, lvrabec, mgrepl, plautrba |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:799d0b2cc69775780cdd2d3f803786cb4951340d778a7cd855d2ff45bb764e31;VARIANT_ID=workstation; | ||
| Fixed In Version: | selinux-policy-3.14.2-42.fc29 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-11-09 06:02:14 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
commit 5dd050d9e89117756ceb46dfdc1734effe0a2760 (HEAD -> rawhide, origin/rawhide, origin/HEAD)
Author: Lukas Vrabec <lvrabec>
Date: Sun Nov 4 13:11:56 2018 +0100
Allow thumb_t domain to execute own tmpfs files BZ(1643698)
selinux-policy-3.14.2-42.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-3129f981d3 selinux-policy-3.14.2-42.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-3129f981d3 selinux-policy-3.14.2-42.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: Defaulth SELinux is preventing appsrc0:src from 'execute' accesses on the file 2F72756E2F757365722F313030302F6F7263657865632E4E6E62395457202864656C6574656429. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that appsrc0:src should be allowed execute access on the 2F72756E2F757365722F313030302F6F7263657865632E4E6E62395457202864656C6574656429 file by default. Then si dovrebbe riportare il problema come bug. E' possibile generare un modulo di politica locale per consentire questo accesso. Do allow this access for now by executing: # ausearch -c 'appsrc0:src' --raw | audit2allow -M my-appsrc0src # semodule -X 300 -i my-appsrc0src.pp Additional Information: Source Context unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 Target Context unconfined_u:object_r:thumb_tmpfs_t:s0 Target Objects 2F72756E2F757365722F313030302F6F7263657865632E4E6E 62395457202864656C6574656429 [ file ] Source appsrc0:src Source Path appsrc0:src Port <Sconosciuto> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.14.2-40.fc29.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 4.18.16-300.fc29.x86_64 #1 SMP Sat Oct 20 23:24:08 UTC 2018 x86_64 x86_64 Alert Count 1 First Seen 2018-10-27 16:12:04 CEST Last Seen 2018-10-27 16:12:04 CEST Local ID 13a2e83d-3bd9-4127-90bc-5f20f4f906da Raw Audit Messages type=AVC msg=audit(1540649524.394:328): avc: denied { execute } for pid=7621 comm="appsrc0:src" path=2F72756E2F757365722F313030302F6F7263657865632E4E6E62395457202864656C6574656429 dev="tmpfs" ino=191721 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:thumb_tmpfs_t:s0 tclass=file permissive=1 Hash: appsrc0:src,thumb_t,thumb_tmpfs_t,file,execute Version-Release number of selected component: selinux-policy-3.14.2-40.fc29.noarch Additional info: component: selinux-policy reporter: libreport-2.9.6 hashmarkername: setroubleshoot kernel: 4.18.16-300.fc29.x86_64 type: libreport