Bug 213933
| Summary: | /usr/sbin/synaptic needs to be labeled as rpm_exec_t in targeted policy, too | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Gérard Milmeister <gemi> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Ben Levenson <benl> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6 | CC: | axel.thimm, extras-qa |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Current | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2007-09-12 17:08:33 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
What tool are you using to install? It should be labeled rpm_exec_t to work correctly? You might have a labeling problem. Output of ll -Z: -rwxr-xr-x root root system_u:object_r:sbin_t /usr/sbin/synaptic* I also did /sbin/restorecon /usr/sbin/synaptic, but this didn't change anything. In the file_contexts policy file, there is an entry for synaptic for the strict policy, but not for the targeted policy: /usr/sbin/synaptic -- system_u:object_r:apt_exec_t:s0 Ok on Fedora this needs to be labeled rpm_exec_t, since it is installing rpms. I will change this in tonights update Fixed in selinux-policy-2.4.3-1 Thanks a lot, Dan! The policy specifies /usr/bin/synaptic which is linked to consolehelper. Shouldn't it specify /usr/sbin/synaptic directly, or doesn't it matter? Yes it should be sbin I will fix in next update. Moving modified bugs to closed |
There is a problem when installing packages that have install scripts (%post). Apparently SELinux prevents it from executing bash. Here is the audit log entry: type=AVC msg=audit(1162117424.263:1705): avc: denied { transition } for pid=1 6381 comm="synaptic" name="bash" dev=hda2 ino=65603 scontext=system_u:system_r:u nconfined_t:s0 tcontext=system_u:system_r:rpm_script_t:s0 tclass=process With SELinux set to enforce, packages are thus not correctly installed.