Bug 525612
| Summary: | setroubleshoot: SELinux is preventing /usr/libexec/gdm-session-worker "rename" access on .dmrc.O1GL0U. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Matěj Cepl <mcepl> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | rawhide | CC: | dwalsh, mcepl, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:5c2bf415b9eb2705c18d2adb7b81e50cd8f6500bab58729a482ee3b705532ccf | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-09-25 15:00:03 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 525611 *** |
The following was filed automatically by setroubleshoot: Souhrn: SELinux is preventing /usr/libexec/gdm-session-worker "rename" access on .dmrc.O1GL0U. Podrobný popis: [SELinux is in permissive mode. This access was not denied.] SELinux denied access requested by gdm-session-wor. The current boolean settings do not allow this access. If you have not setup gdm-session-wor to require this access this may signal an intrusion attempt. If you do intend this access you need to change the booleans on this system to allow the access. Povolení přístupu: Confined processes can be configured to run requiring different access, SELinux provides booleans to allow you to turn on/off access as needed. The boolean allow_polyinstantiation is set incorrectly. Boolean Description: Enable polyinstantiated directory support. Příkaz pro opravu: # setsebool -P allow_polyinstantiation 1 Další informace: Kontext zdroje system_u:system_r:xdm_t:s0-s0:c0.c1023 Kontext cíle unconfined_u:object_r:user_home_t:s0 Objekty cíle .dmrc.O1GL0U [ file ] Zdroj gdm-session-wor Cesta zdroje /usr/libexec/gdm-session-worker Port <Neznámé> Počítač (removed) RPM balíčky zdroje gdm-2.27.90-2.fc12 RPM balíčky cíle RPM politiky selinux-policy-3.6.32-8.fc12 Selinux povolen True Typ politiky targeted MLS povoleno True Vynucovací režim Permissive Název zásuvného modulu catchall_boolean Název počítače (removed) Platforma Linux (removed) 2.6.31-33.fc12.x86_64 #1 SMP Thu Sep 17 15:40:43 EDT 2009 x86_64 x86_64 Počet upozornění 1 Poprvé viděno Pá 25. září 2009, 06:27:27 CEST Naposledy viděno Pá 25. září 2009, 06:27:27 CEST Místní ID 5d60f93a-a161-47e6-b3c9-1c0c27f7006a Čísla řádků Původní zprávy auditu node=(removed) type=AVC msg=audit(1253852847.816:315): avc: denied { rename } for pid=14589 comm="gdm-session-wor" name=".dmrc.O1GL0U" dev=dm-9 ino=3242 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file node=(removed) type=SYSCALL msg=audit(1253852847.816:315): arch=c000003e syscall=82 success=yes exit=0 a0=d24e50 a1=d28190 a2=d27930 a3=1 items=0 ppid=14558 pid=14589 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=17 comm="gdm-session-wor" exe="/usr/libexec/gdm-session-worker" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) audit2allow suggests: #============= xdm_t ============== allow xdm_t user_home_t:file rename;