Bug 2041166
| Summary: | avc: denied mounton /etc/fonts | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Davide Repetto <red> | ||||
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> | ||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 35 | CC: | dwalsh, grepl.miroslav, lvrabec, mmalik, omosnace, pkoncity, vmojzis, zpytela | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | --- | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2022-05-08 14:45:16 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Created attachment 1851087 [details]
Other AVCs possibly related to this one:
|
Note: ubuntu snaps are installed - snapd-selinux-2.54.1-1.fc35.noarch SELinux is preventing 5 from 'mounton' accesses on the cartella /etc/fonts. ***** Plugin catchall_labels (83.8 confidence) suggests ******************* Se vuoi abilitare 5 ad avere mounton accesso al fonts directory Then e' necessario modificare l'etichetta su /etc/fonts Do # semanage fcontext -a -t FILE_TYPE '/etc/fonts' dove FILE_TYPE รจ uno dei seguenti: bin_t, fonts_cache_t, fonts_t, lib_t, snappy_snap_t, snappy_tmp_t, tmpfs_t, user_tmp_t. Successivamente, eseguire: restorecon -v '/etc/fonts' ***** Plugin catchall (17.1 confidence) suggests ************************** Se ci credi 5 dovrebbe essere consentito mounton accesso al fonts directory per impostazione predefinita. Then si dovrebbe riportare il problema come bug. E' possibile generare un modulo di politica locale per consentire questo accesso. Do consentire questo accesso per ora eseguendo: # ausearch -c '5' --raw | audit2allow -M my-$MODULE_NOME # semodule -X 300 -i miei-5.pp Additional Information: Source Context system_u:system_r:snappy_mount_t:s0 Target Context system_u:object_r:etc_t:s0 Target Objects /etc/fonts [ dir ] Source 5 Source Path 5 Port <Sconosciuto> Host (removed) Source RPM Packages Target RPM Packages fonts-filesystem-2.0.5-6.fc35.noarch SELinux Policy RPM selinux-policy-targeted-35.8-1.fc35.noarch Local Policy RPM Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 5.15.14-200.fc35.x86_64 #1 SMP Tue Jan 11 16:49:27 UTC 2022 x86_64 x86_64 Alert Count 4 First Seen 2022-01-11 14:59:05 CET Last Seen 2022-01-16 08:36:32 CET Local ID 478e6e0a-d01a-4966-a4f4-f6a7a0301195 Raw Audit Messages type=AVC msg=audit(1642318592.273:223): avc: denied { mounton } for pid=1359 comm="5" path="/etc/fonts" dev="sde4" ino=662 scontext=system_u:system_r:snappy_mount_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1 Hash: 5,snappy_mount_t,etc_t,dir,mounton