Bug 523513

Summary: setroubleshoot: SELinux is preventing Xorg (xserver_t) "write" access to device /dev/vga_arbiter.
Product: [Fedora] Fedora Reporter: Jesse Leal dos Santos <jesse>
Component: udevAssignee: Harald Hoyer <harald>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 12CC: dwalsh, harald, mgrepl
Target Milestone: ---Keywords: Triaged
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:1f0a94d55ba7667bf847ef8b92734a856ab9fe90950ae5dfdbb39a1582e18481
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-01-26 06:07:27 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Jesse Leal dos Santos 2009-09-15 15:01:44 EDT
The following was filed automatically by setroubleshoot:


SELinux is preventing Xorg (xserver_t) "write" access to device

Detailed Description:

SELinux has denied the Xorg (xserver_t) "write" access to device
/dev/vga_arbiter. /dev/vga_arbiter is mislabeled, this device has the default
label of the /dev directory, which should not happen. All Character and/or Block
Devices should have a label. You can attempt to change the label of the file
using restorecon -v '/dev/vga_arbiter'. If this device remains labeled device_t,
then this is a bug in SELinux policy. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy
package. If you look at the other similar devices labels, ls -lZ /dev/SIMILAR,
and find a type that would work for /dev/vga_arbiter, you can use chcon -t
SIMILAR_TYPE '/dev/vga_arbiter', If this fixes the problem, you can make this
permanent by executing semanage fcontext -a -t SIMILAR_TYPE '/dev/vga_arbiter'
If the restorecon changes the context, this indicates that the application that
created the device, created it without using SELinux APIs. If you can figure out
which application created the device, please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this application.

Allowing Access:

Attempt restorecon -v '/dev/vga_arbiter' or chcon -t SIMILAR_TYPE

Additional Information:

Source Context                system_u:system_r:xserver_t:s0-s0:c0.c1023
Target Context                system_u:object_r:device_t:s0
Target Objects                /dev/vga_arbiter [ chr_file ]
Source                        Xorg
Source Path                   /usr/bin/Xorg (deleted)
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.31-3.fc12
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   device
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.31- #1 SMP Tue
                              Aug 11 21:00:45 EDT 2009 x86_64
Alert Count                   0
First Seen                    Tue 15 Sep 2009 01:48:28 PM BRT
Last Seen                     Tue 15 Sep 2009 01:48:28 PM BRT
Local ID                      c5c4b93c-e405-4499-8e8a-b55edd26f31e
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1253033308.593:40311): avc:  denied  { write } for  pid=1420 comm="Xorg" path="/dev/vga_arbiter" dev=tmpfs ino=1069 scontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file

node=(removed) type=SYSCALL msg=audit(1253033308.593:40311): arch=c000003e syscall=16 success=no exit=-25 a0=8 a1=40104d02 a2=7fffa17286a0 a3=7fffa1728430 items=0 ppid=1418 pid=1420 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=4294967295 comm="Xorg" exe=2F7573722F62696E2F586F7267202864656C6574656429 subj=system_u:system_r:xserver_t:s0-s0:c0.c1023 key=(null)

audit2allow suggests:

#============= xserver_t ==============
allow xserver_t device_t:chr_file write;
Comment 1 Daniel Walsh 2009-09-15 15:31:59 EDT
Udev did not create the device with the correct label.

If you run restorecon /dev/vga*

It will fix the label.

udev has to create the devices with the correct label.
Comment 2 Harald Hoyer 2009-09-16 02:53:25 EDT
please provide the output of:

# udevadm info --query=all --name=/dev/vga_arbiter
Comment 3 Bug Zapper 2009-11-16 07:27:08 EST
This bug appears to have been reported against 'rawhide' during the Fedora 12 development cycle.
Changing version to '12'.

More information and reason for this action is here:
Comment 5 Harald Hoyer 2010-01-26 06:07:27 EST

*** This bug has been marked as a duplicate of bug 519025 ***