Bug 523321
| Summary: | setroubleshoot: SELinux is preventing the /usr/libexec/polkit-gnome-authentication-agent-1 from using potentially mislabeled files (orbit-gdm). | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | al morris <allinux4> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | rawhide | CC: | dwalsh, jkubin, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:94114e22d8da50e9f32cfbcfe21e6ce1704a8bd599b7f601fe67c5aa2d8b7881 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-09-14 21:17:59 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Fix the labeling under /usr restorecon -R -v /usr |
The following was filed automatically by setroubleshoot: Summary: SELinux is preventing the /usr/libexec/polkit-gnome-authentication-agent-1 from using potentially mislabeled files (orbit-gdm). Detailed Description: [polkit-gnome-au has a permissive type (policykit_auth_t). This access was not denied.] SELinux has denied polkit-gnome-au access to potentially mislabeled file(s) (orbit-gdm). This means that SELinux will not allow polkit-gnome-au to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access. Allowing Access: If you want polkit-gnome-au to access this files, you need to relabel them using restorecon -v 'orbit-gdm'. You might want to relabel the entire directory using restorecon -R -v 'orbit-gdm'. Additional Information: Source Context system_u:system_r:policykit_auth_t:s0-s0:c0.c1023 Target Context system_u:object_r:xdm_tmp_t:s0 Target Objects orbit-gdm [ dir ] Source polkit-gnome-au Source Path /usr/libexec/polkit-gnome-authentication-agent-1 Port <Unknown> Host (removed) Source RPM Packages polkit-gnome-0.94-4.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.31-3.fc12 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name home_tmp_bad_labels Host Name (removed) Platform Linux (removed) 2.6.31-2.fc12.x86_64 #1 SMP Thu Sep 10 00:25:40 EDT 2009 x86_64 x86_64 Alert Count 1 First Seen Mon 14 Sep 2009 12:55:14 PM CDT Last Seen Mon 14 Sep 2009 12:55:14 PM CDT Local ID d9c971aa-6d29-41dc-8c50-a782af9ed5cb Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1252950914.971:15): avc: denied { setattr } for pid=1515 comm="polkit-gnome-au" name="orbit-gdm" dev=sda2 ino=114735 scontext=system_u:system_r:policykit_auth_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xdm_tmp_t:s0 tclass=dir node=(removed) type=SYSCALL msg=audit(1252950914.971:15): arch=c000003e syscall=132 success=yes exit=0 a0=1eba920 a1=7fffe3a83380 a2=7fffe3a832f0 a3=7fffe3a83080 items=0 ppid=1482 pid=1515 auid=4294967295 uid=42 gid=482 euid=42 suid=42 fsuid=42 egid=482 sgid=482 fsgid=482 tty=(none) ses=4294967295 comm="polkit-gnome-au" exe="/usr/libexec/polkit-gnome-authentication-agent-1" subj=system_u:system_r:policykit_auth_t:s0-s0:c0.c1023 key=(null) audit2allow suggests: #============= policykit_auth_t ============== allow policykit_auth_t xdm_tmp_t:dir setattr;