Bug 2020531
| Summary: | SELinux denial appears when printing via lpd (cups-lpd) | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Milos Malik <mmalik> | |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> | |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 35 | CC: | dwalsh, grepl.miroslav, lvrabec, mmalik, omosnace, pkoncity, vmojzis, zpytela | |
| Target Milestone: | --- | Keywords: | Triaged | |
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | selinux-policy-35.6-1.fc35 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 2039449 (view as bug list) | Environment: | ||
| Last Closed: | 2021-12-04 01:23:38 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 2039449 | |||
The same SELinux denial appears in permissive mode:
----
type=PROCTITLE msg=audit(11/05/2021 04:30:31.873:931) : proctitle=/usr/lib/cups/daemon/cups-lpd
type=PATH msg=audit(11/05/2021 04:30:31.873:931) : item=0 name=/proc/1/environ inode=13550 dev=00:16 mode=file,400 ouid=root ogid=root rdev=00:00 obj=system_u:system_r:init_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(11/05/2021 04:30:31.873:931) : cwd=/
type=SYSCALL msg=audit(11/05/2021 04:30:31.873:931) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0xffffff9c a1=0x7ffd27408890 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=17628 auid=unset uid=lp gid=lp euid=lp suid=lp fsuid=lp egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-lpd exe=/usr/lib/cups/daemon/cups-lpd subj=system_u:system_r:cupsd_lpd_t:s0 key=(null)
type=AVC msg=audit(11/05/2021 04:30:31.873:931) : avc: denied { search } for pid=17628 comm=cups-lpd name=1 dev="proc" ino=13409 scontext=system_u:system_r:cupsd_lpd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=dir permissive=1
----
I've undrafted the existing PR: https://github.com/fedora-selinux/selinux-policy/pull/773 which should be sufficient because: # sesearch --dontaudit -s daemon -t init_t -ds dontaudit daemon init_t:dir { getattr open search }; dontaudit daemon init_t:fd use; dontaudit daemon init_t:file { getattr ioctl lock open read }; FEDORA-2021-ea3fa543f0 has been submitted as an update to Fedora 35. https://bodhi.fedoraproject.org/updates/FEDORA-2021-ea3fa543f0 FEDORA-2021-ea3fa543f0 has been pushed to the Fedora 35 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-ea3fa543f0` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-ea3fa543f0 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2021-ea3fa543f0 has been pushed to the Fedora 35 stable repository. If problem still persists, please make note of it in this bug report. |
Description of problem: * the lpd prints the file successfully, but 1 SELinux denial appears Version-Release number of selected component (if applicable): cups-2.3.3op2-9.fc35.x86_64 cups-client-2.3.3op2-9.fc35.x86_64 cups-filesystem-2.3.3op2-9.fc35.noarch cups-filters-1.28.10-1.fc35.x86_64 cups-filters-libs-1.28.10-1.fc35.x86_64 cups-ipptool-2.3.3op2-9.fc35.x86_64 cups-libs-2.3.3op2-9.fc35.x86_64 cups-lpd-2.3.3op2-9.fc35.x86_64 selinux-policy-35.5-1.fc35.noarch selinux-policy-devel-35.5-1.fc35.noarch selinux-policy-targeted-35.5-1.fc35.noarch How reproducible: * always Steps to Reproduce: 1. get a Fedora 35 machine (targeted policy is active) 2. # systemctl start cups.service 3. # systemctl enable cups-lpd.socket 4. # systemctl start cups-lpd.socket 5. # lpadmin -p test -o printer-is-shared=true -E 6. # DEVICE_URI=lpd://127.0.0.1/test /usr/lib/cups/backend/lpd 1 user test 1 '' /etc/fstab 7. search for SELinux denials Actual results: ---- type=PROCTITLE msg=audit(11/05/2021 04:11:18.023:728) : proctitle=/usr/lib/cups/daemon/cups-lpd type=PATH msg=audit(11/05/2021 04:11:18.023:728) : item=0 name=/proc/1/environ nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(11/05/2021 04:11:18.023:728) : cwd=/ type=SYSCALL msg=audit(11/05/2021 04:11:18.023:728) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0xffffff9c a1=0x7ffc7f4b0f60 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=16668 auid=unset uid=lp gid=lp euid=lp suid=lp fsuid=lp egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-lpd exe=/usr/lib/cups/daemon/cups-lpd subj=system_u:system_r:cupsd_lpd_t:s0 key=(null) type=AVC msg=audit(11/05/2021 04:11:18.023:728) : avc: denied { search } for pid=16668 comm=cups-lpd name=1 dev="proc" ino=13409 scontext=system_u:system_r:cupsd_lpd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=dir permissive=0 ---- Expected results: * no SELinux denials