Bug 520983
| Summary: | setroubleshoot: SELinux is preventing access to files with the label, file_t. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | David <idht4n> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | rawhide | CC: | dwalsh, jkubin, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i386 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:931909fbc5578d79eed3431bdef88dc5c2d225808fb2829f58466afce5160cfd | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-09-04 13:45:47 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Did you try what setroubleshoot suggests touch /.autorelabel; reboot No... I was told on the fedora-test-list to report all problems:
Adam Williamson wrote:
> The SELinux stuff now makes it extremely easy to report problems; you
> can do it just with one click on a button in sealert. Please do this for
> all SELinux alerts you see, rather than filtering through this list
> first, we want to get _all_ the reports you see. The SELinux maintainers
> are very fast about looking at reports and taking appropriate action.
So I did. Many of the warnings were after a fresh install of fedora 12
alpha, so I figured any warnings were bugs. I'll try autorelabel now.
I did the touch /.autorelabel. Not sure if it worked, because the computer became unresponsive after reboot (black screen, control alt delete did nothing... hit the power button after ~15 minutes). Still getting selinux warnings but I don't know if I've seen this one. As root execute fixfiles restore You chould see a hole bunch of "*" start to appear, Each one represents 1000 files being relabeled. It will read your entire file system and fix the labels. This could take a long time, depending on the amount of files. When it is complete, you should be able to reboot and no longer have AVC messages about file_t. |
The following was filed automatically by setroubleshoot: Summary: SELinux is preventing access to files with the label, file_t. Detailed Description: SELinux permission checks on files labeled file_t are being denied. file_t is the context the SELinux kernel gives to files that do not have a label. This indicates a serious labeling problem. No files on an SELinux box should ever be labeled file_t. If you have just added a new disk drive to the system you can relabel it using the restorecon command. Otherwise you should relabel the entire file system. Allowing Access: You can execute the following command as root to relabel your computer system: "touch /.autorelabel; reboot" Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:file_t:s0 Target Objects /home1 [ dir ] Source Default Source Path /bin/bash Port <Unknown> Host (removed) Source RPM Packages bash-4.0.28-2.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.28-9.fc12 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name file Host Name (removed) Platform Linux (removed) 2.6.31-0.190.rc8.fc12.i686 #1 SMP Fri Aug 28 19:07:13 EDT 2009 i686 i686 Alert Count 80 First Seen Fri 28 Aug 2009 09:21:13 AM PDT Last Seen Wed 02 Sep 2009 06:31:46 PM PDT Local ID 35134d0a-8557-48c9-afc3-966a5c909503 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1251941506.190:41): avc: denied { search } for pid=1522 comm="Default" name="/" dev=sda7 ino=2 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=dir node=(removed) type=SYSCALL msg=audit(1251941506.190:41): arch=40000003 syscall=195 success=no exit=-13 a0=88bf830 a1=bfc12570 a2=287ff4 a3=0 items=0 ppid=1344 pid=1522 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="Default" exe="/bin/bash" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) audit2allow suggests: #============= xdm_t ============== allow xdm_t file_t:dir search;