Bug 546145

Zusammenfassung:

SELinux is preventing /usr/libexec/polkit-gnome-authentication-agent-1 "search"
access on /usr/share/X11/fonts.

Detaillierte Beschreibung:

[polkit-gnome-au hat einen toleranten Typ (policykit_auth_t). Dieser Zugriff
wurde nicht verweigert.]

SELinux denied access requested by polkit-gnome-au. It is not expected that this
access is required by polkit-gnome-au and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Zugriff erlauben:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug
report.

Zusätzliche Informationen:

Quellkontext                  unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c
                              0.c1023
Zielkontext                   system_u:object_r:fonts_t:s0
Zielobjekte                   /usr/share/X11/fonts [ dir ]
Quelle                        polkit-gnome-au
Quellen-Pfad                  /usr/libexec/polkit-gnome-authentication-agent-1
Port                          <Unbekannt>
Host                          (removed)
Quellen-RPM-Pakete            polkit-gnome-0.95-0.git20090913.6.fc12
Ziel-RPM-Pakete               xorg-x11-font-utils-7.2-10.fc12
RPM-Richtlinie                selinux-policy-3.6.32-55.fc12
SELinux aktiviert             True
Richtlinienversion            targeted
Enforcing-Modus               Enforcing
Plugin-Name                   catchall
Hostname                      (removed)
Plattform                     Linux (removed) 2.6.31.6-162.fc12.x86_64 #1 SMP Fri Dec
                              4 00:06:26 EST 2009 x86_64 x86_64
Anzahl der Alarme             7
Zuerst gesehen                Do 10 Dez 2009 07:30:28 CET
Zuletzt gesehen               Do 10 Dez 2009 07:30:28 CET
Lokale ID                     5b4ee05f-249f-4df0-917a-33dcb5d2b226
Zeilennummern                 

Raw-Audit-Meldungen           

node=(removed) type=AVC msg=audit(1260426628.492:26171): avc:  denied  { search } for  pid=1728 comm="polkit-gnome-au" name="fonts" dev=sda5 ino=15354 scontext=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fonts_t:s0 tclass=dir

node=(removed) type=SYSCALL msg=audit(1260426628.492:26171): arch=c000003e syscall=4 success=yes exit=128 a0=13364e0 a1=7fffd32e7310 a2=7fffd32e7310 a3=10 items=0 ppid=1571 pid=1728 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="polkit-gnome-au" exe="/usr/libexec/polkit-gnome-authentication-agent-1" subj=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.6.32-55.fc12,catchall,polkit-gnome-au,policykit_auth_t,fonts_t,dir,search
audit2allow suggests:

#============= policykit_auth_t ==============
allow policykit_auth_t fonts_t:dir search;