Bug 525611
| Summary: | setroubleshoot: SELinux is preventing /usr/libexec/gdm-session-worker "write" access on .dmrc.O1GL0U. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Matěj Cepl <mcepl> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | rawhide | CC: | dwalsh, mcepl, mgrepl, rstrode |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:5de86674487d3ed1712f771e588cc9929a67dc58a42747986864d15470c93146 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-09-25 14:59:30 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Ray did this file change name? Fixed in selinux-policy-3.6.32-11.fc12.noarch *** Bug 525612 has been marked as a duplicate of this bug. *** |
The following was filed automatically by setroubleshoot: Souhrn: SELinux is preventing /usr/libexec/gdm-session-worker "write" access on .dmrc.O1GL0U. Podrobný popis: [SELinux is in permissive mode. This access was not denied.] SELinux denied access requested by gdm-session-wor. The current boolean settings do not allow this access. If you have not setup gdm-session-wor to require this access this may signal an intrusion attempt. If you do intend this access you need to change the booleans on this system to allow the access. Povolení přístupu: Confined processes can be configured to run requiring different access, SELinux provides booleans to allow you to turn on/off access as needed. The boolean allow_polyinstantiation is set incorrectly. Boolean Description: Enable polyinstantiated directory support. Příkaz pro opravu: # setsebool -P allow_polyinstantiation 1 Další informace: Kontext zdroje system_u:system_r:xdm_t:s0-s0:c0.c1023 Kontext cíle unconfined_u:object_r:user_home_t:s0 Objekty cíle .dmrc.O1GL0U [ file ] Zdroj gdm-session-wor Cesta zdroje /usr/libexec/gdm-session-worker Port <Neznámé> Počítač (removed) RPM balíčky zdroje gdm-2.27.90-2.fc12 RPM balíčky cíle RPM politiky selinux-policy-3.6.32-8.fc12 Selinux povolen True Typ politiky targeted MLS povoleno True Vynucovací režim Permissive Název zásuvného modulu catchall_boolean Název počítače (removed) Platforma Linux (removed) 2.6.31-33.fc12.x86_64 #1 SMP Thu Sep 17 15:40:43 EDT 2009 x86_64 x86_64 Počet upozornění 1 Poprvé viděno Pá 25. září 2009, 06:27:27 CEST Naposledy viděno Pá 25. září 2009, 06:27:27 CEST Místní ID f6c56bd7-110f-46a8-b738-f290e6646017 Čísla řádků Původní zprávy auditu node=(removed) type=AVC msg=audit(1253852847.746:314): avc: denied { write } for pid=14589 comm="gdm-session-wor" name=".dmrc.O1GL0U" dev=dm-9 ino=3242 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file node=(removed) type=SYSCALL msg=audit(1253852847.746:314): arch=c000003e syscall=2 success=yes exit=9 a0=d27940 a1=c2 a2=1b6 a3=ffffffef items=0 ppid=14558 pid=14589 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=17 comm="gdm-session-wor" exe="/usr/libexec/gdm-session-worker" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) audit2allow suggests: #============= xdm_t ============== allow xdm_t user_home_t:file write;