Bug 543836

Summary: SELinux is preventing /usr/bin/xauth "read" access on /usr/share/google-gadgets/resources.gg.
Product: [Fedora] Fedora Reporter: Sylvain Réault <vindicators>
Component: selinux-policyAssignee: Daniel Walsh <dwalsh>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 12CC: dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:3ea06fa6cd1f63614783f6fc3bb5264666ff32aae7e8cb7f2456f28931983085
Fixed In Version: 3.6.32-55.fc12 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-12-07 22:47:54 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Sylvain Réault 2009-12-03 09:32:58 UTC 
Résumé:

SELinux is preventing /usr/bin/xauth "read" access on
/usr/share/google-gadgets/resources.gg.

Description détaillée:

[xauth a un type permissif (xauth_t). Cet accès n'a pas été refusé.]

SELinux denied access requested by xauth. It is not expected that this access is
required by xauth and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Autoriser l'accès:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug
report.

Informations complémentaires:

Contexte source               unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023
Contexte cible                system_u:object_r:usr_t:s0
Objets du contexte            /usr/share/google-gadgets/resources.gg [ file ]
source                        xauth
Chemin de la source           /usr/bin/xauth
Port                          <Inconnu>
Hôte                         (removed)
Paquetages RPM source         xorg-x11-xauth-1.0.2-7.fc12
Paquetages RPM cible          google-gadgets-0.11.1-1.fc12
Politique RPM                 selinux-policy-3.6.32-49.fc12
Selinux activé               True
Type de politique             targeted
Mode strict                   Enforcing
Nom du plugin                 catchall
Nom de l'hôte                (removed)
Plateforme                    Linux (removed) 2.6.31.6-145.fc12.x86_64 #1
                              SMP Sat Nov 21 15:57:45 EST 2009 x86_64 x86_64
Compteur d'alertes            7
Première alerte              jeu. 03 déc. 2009 10:06:35 CET
Dernière alerte              jeu. 03 déc. 2009 10:32:01 CET
ID local                      514f0dc0-9f5b-4ea7-b93a-7e65a237191e
Numéros des lignes           

Messages d'audit bruts        

node=(removed) type=AVC msg=audit(1259832721.496:1041): avc:  denied  { read } for  pid=15814 comm="xauth" path="/usr/share/google-gadgets/resources.gg" dev=sda1 ino=263435 scontext=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1259832721.496:1041): arch=c000003e syscall=59 success=yes exit=0 a0=7ffff122571c a1=13b77f0 a2=12b9dd0 a3=8 items=0 ppid=15805 pid=15814 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.6.32-49.fc12,catchall,xauth,xauth_t,usr_t,file,read
audit2allow suggests:

#============= xauth_t ==============
allow xauth_t usr_t:file read;
Comment 1 Daniel Walsh 2009-12-03 14:55:11 UTC 
This is a leaked file descroptor from google-gadgets, most likely.  You can ignore it as all that happened is SELinux closed it and the command finished successfully.

xauth definitely does not know anything about /usr/share/google-gadgets/resources.gg

You should report this as a bug to google, to close all file descriptors before fork/exec

fcntl(fd, F_SETFD, FD_CLOEXEC)

I can allow it for now, just to eliminate the AVC.

Fixed in selinux-policy-3.6.32-54.fc12
Comment 2 Fedora Update System 2009-12-03 20:28:40 UTC 
selinux-policy-3.6.32-55.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-55.fc12
Comment 3 Fedora Update System 2009-12-04 23:46:58 UTC 
selinux-policy-3.6.32-55.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-12650
Comment 4 Fedora Update System 2009-12-08 07:53:37 UTC 
selinux-policy-3.6.32-55.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.