Bug 1832521

Dan,

Apart from the denial, is there any actual problem with how the pdf cups filter works?

Would you mind collecting any possible additional denials?

setenforce 0
<reproduce the issue>
setenforce 1

ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts recent

The data is printed properly to file.

Here is the ouput requested:

----
type=AVC msg=audit(05/11/2020 11:01:32.253:41189) : avc:  denied  { create } for  pid=394766 comm=cups-pdf scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1 
----
type=AVC msg=audit(05/11/2020 11:01:32.253:41190) : avc:  denied  { connect } for  pid=394766 comm=cups-pdf scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1 
----

Caught in enforcing mode:
----
type=PROCTITLE msg=audit(05/12/2020 07:59:25.714:871) : proctitle=cups-pdf:/ 1 unconfined-user Fedora 1 LogType=7 PageSize=A4 PDFVer=1.2 Label=2 number-up=1 noCollate Truncate=64 Resolution=300d 
type=SYSCALL msg=audit(05/12/2020 07:59:25.714:871) : arch=x86_64 syscall=socket success=no exit=EACCES(Permission denied) a0=local a1=SOCK_DGRAM a2=ip a3=0x7ffe9f87c8d8 items=0 ppid=1717 pid=9823 auid=unset uid=root gid=lp euid=root suid=root fsuid=root egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-pdf exe=/usr/lib/cups/backend/cups-pdf subj=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(05/12/2020 07:59:25.714:871) : avc:  denied  { create } for  pid=9823 comm=cups-pdf scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0 
----

Caught in permissive mode:
----
type=PROCTITLE msg=audit(05/12/2020 08:02:15.828:952) : proctitle=cups-pdf:/ 2 unconfined-user Fedora 1 LogType=7 PageSize=A4 PDFVer=1.2 Label=2 number-up=1 noCollate Truncate=64 Resolution=300d 
type=SYSCALL msg=audit(05/12/2020 08:02:15.828:952) : arch=x86_64 syscall=socket success=yes exit=10 a0=local a1=SOCK_DGRAM a2=ip a3=0x7fffc5abe568 items=0 ppid=1717 pid=10759 auid=unset uid=root gid=lp euid=root suid=root fsuid=root egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-pdf exe=/usr/lib/cups/backend/cups-pdf subj=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(05/12/2020 08:02:15.828:952) : avc:  denied  { create } for  pid=10759 comm=cups-pdf scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1 
----
type=PROCTITLE msg=audit(05/12/2020 08:02:15.828:953) : proctitle=cups-pdf:/ 2 unconfined-user Fedora 1 LogType=7 PageSize=A4 PDFVer=1.2 Label=2 number-up=1 noCollate Truncate=64 Resolution=300d 
type=SOCKADDR msg=audit(05/12/2020 08:02:15.828:953) : saddr={ saddr_fam=local path=userdb-f7c9ae500fe25f0769d207a8240334ca } 
type=SYSCALL msg=audit(05/12/2020 08:02:15.828:953) : arch=x86_64 syscall=connect success=no exit=ECONNREFUSED(Connection refused) a0=0xa a1=0x7fffc5abe880 a2=0x2a a3=0x7fffc5abe568 items=0 ppid=1717 pid=10759 auid=unset uid=root gid=lp euid=root suid=root fsuid=root egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-pdf exe=/usr/lib/cups/backend/cups-pdf subj=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(05/12/2020 08:02:15.828:953) : avc:  denied  { connect } for  pid=10759 comm=cups-pdf scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1 
----

I also have the issue and https://bugzilla.redhat.com/show_bug.cgi?id=1829853 seems to be a duplicate.

No "real" issue detected so far, cups-pdf seems to work as usual, just the warning is unsettling.

$ rpm -qa | grep -e cups-pdf -e selinux-policy
selinux-policy-3.14.5-38.fc32.noarch
cups-pdf-3.0.1-9.fc32.x86_64
selinux-policy-minimum-3.14.5-38.fc32.noarch
selinux-policy-targeted-3.14.5-38.fc32.noarch

Raw Audit Messages
type=AVC msg=audit(1589785422.397:383): avc:  denied  { create } for  pid=8790 comm="cups-pdf" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0

Hash: cups-pdf,cups_pdf_t,cups_pdf_t,unix_dgram_socket,create

*** Bug 1829853 has been marked as a duplicate of this bug. ***

The source code of cups-pdf doesn't create any socket, It must be a dependency that does it and now it uses a different socket type, because the policy already has [1]

  allow cups_pdf_t self:unix_stream_socket create_stream_socket_perms;

for stream sockets.

I will try to check the reason of this datagram socket creation, but I am on a heavily locked down country, my land based internet is dead, and phone tethering is at sub 100kb/s speeds, so I am still not using Fedora 32.  

[1] https://github.com/fedora-selinux/selinux-policy-contrib/blob/b35f071eace9e06117f78cdda3dd6692388dff6f/cups.te#L613

Similar problem has been detected:

Have installed the standard cups-pdf package (v3.0.1-9) on Fedora 32.

From a Firefox web page, sepected "print", and CUps-PDF as my printer.  SELinux alert popped up immediately.

Entered the commands (under root) the error dialogue suggested for allowing the function:

ausearch -c 'cups-pdf' --raw | audit2allow -M my-cupspdf
semodule -X 300 -i my-cupspdf.pp

then tried the same print again.  A second, identical SELinux alert popped up.

----------------------------------

Expected behavior would be that the Cups-PDF package would set up it's correct permissions.

hashmarkername: setroubleshoot
kernel:         5.6.18-300.fc32.x86_64
package:        selinux-policy-targeted-3.14.5-40.fc32.noarch
reason:         SELinux is preventing cups-pdf from 'create' accesses on the unix_dgram_socket labeled cups_pdf_t.
type:           libreport

*** Bug 1862206 has been marked as a duplicate of this bug. ***

Similar problem has been detected:

I attempted to print a file with cups-pdf.

hashmarkername: setroubleshoot
kernel:         5.8.12-200.fc32.x86_64
package:        selinux-policy-targeted-3.14.5-43.fc32.noarch
reason:         SELinux is preventing cups-pdf from 'create' accesses on the unix_dgram_socket labeled cups_pdf_t.
type:           libreport

I propose this fix.

PR:https://github.com/fedora-selinux/selinux-policy-contrib/pull/337

Link to scratch build:https://download.copr.fedorainfracloud.org/results/rfilo/Selinux-policy-f32/fedora-32-x86_64/01694783-selinux-policy/

Bumped to FC33.

(In reply to Richard Fiľo from comment #11)
> I propose this fix.
> 
> PR:https://github.com/fedora-selinux/selinux-policy-contrib/pull/337
> 
> Link to scratch
> build:https://download.copr.fedorainfracloud.org/results/rfilo/Selinux-
> policy-f32/fedora-32-x86_64/01694783-selinux-policy/

Thanks Richard for your policy patch, do you plan to fix the formatting review on it or do you want I take it from here?

*** Bug 1881243 has been marked as a duplicate of this bug. ***

*** Bug 1895576 has been marked as a duplicate of this bug. ***

Note backporting to F32 is needed, too.

FEDORA-2020-aff0be81b3 has been submitted as an update to Fedora 33. https://bodhi.fedoraproject.org/updates/FEDORA-2020-aff0be81b3

FEDORA-2020-aff0be81b3 has been pushed to the Fedora 33 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-aff0be81b3`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-aff0be81b3

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

FEDORA-2020-aff0be81b3 has been pushed to the Fedora 33 stable repository.
If problem still persists, please make note of it in this bug report.

Similar problem has been detected:

I always happen when creating pdf file - printing to cups-pdf printer.

hashmarkername: setroubleshoot
kernel:         5.10.7-100.fc32.x86_64
package:        selinux-policy-targeted-3.14.5-45.fc32.noarch
reason:         SELinux is preventing cups-pdf from 'create' accesses on the unix_dgram_socket Neznámé.
type:           libreport