Bug 560255

Resúmen:

SELinux is preventing gconf-defaults- (gconfdefaultsm_t) "search" to
/home/gluengo/.gconf (user_home_t).

Descripción Detallada:

SELinux denied access requested by gconf-defaults-. /home/gluengo/.gconf may be
a mislabeled. /home/gluengo/.gconf default SELinux type is gconf_home_t, but its
current type is user_home_t. Changing this file back to the default type, may
fix your problem.

File contexts can be assigned to a file in the following ways.

  * Files created in a directory receive the file context of the parent
    directory by default.
  * The SELinux policy might override the default label inherited from the
    parent directory by specifying a process running in context A which creates
    a file in a directory labeled B will instead create the file with label C.
    An example of this would be the dhcp client running with the dhclient_t type
    and creates a file in the directory /etc. This file would normally receive
    the etc_t type due to parental inheritance but instead the file is labeled
    with the net_conf_t type because the SELinux policy specifies this.
  * Users can change the file context on a file using tools such as chcon, or
    restorecon.

This file could have been mislabeled either by user error, or if an normally
confined application was run under the wrong domain.

However, this might also indicate a bug in SELinux because the file should not
have been labeled with this type.

If you believe this is a bug, please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package.

Permitiendo Acceso:

You can restore the default system context to this file by executing the
restorecon command. restorecon '/home/gluengo/.gconf', if this file is a
directory, you can recursively restore using restorecon -R
'/home/gluengo/.gconf'.

Comando para Corregir:

restorecon '/home/gluengo/.gconf'

Información Adicional:

Contexto Fuente               system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023
Contexto Destino              unconfined_u:object_r:user_home_t:s0
Objetos Destino               /home/gluengo/.gconf [ dir ]
Fuente                        gconf-defaults-
Dirección de Fuente          /usr/libexec/gconf-defaults-mechanism
Puerto                        <Desconocido>
Nombre de Equipo              (removed)
Paquetes RPM Fuentes          GConf2-2.26.2-1.fc11
Paquetes RPM Destinos         
RPM de Políticas             selinux-policy-3.6.12-91.fc11
SELinux Activado              True
Tipo de Política             targeted
Modo Obediente                Enforcing
Nombre de Plugin              restorecon
Nombre de Equipo              (removed)
Plataforma                    Linux (removed)
                              2.6.30.9-102.fc11.x86_64 #1 SMP Fri Dec 4 00:18:53
                              EST 2009 x86_64 x86_64
Cantidad de Alertas           5
Visto por Primera Vez         vie 18 dic 2009 09:28:36 CLST
Visto por Última Vez         vie 18 dic 2009 09:28:36 CLST
ID Local                      96d39d85-2f9d-4f20-b357-aa64e8cebff2
Números de Línea            

Mensajes de Auditoría Crudos 

node=(removed) type=AVC msg=audit(1261139316.129:19): avc:  denied  { search } for  pid=2322 comm="gconf-defaults-" name=".gconf" dev=dm-0 ino=307 scontext=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir

node=(removed) type=AVC msg=audit(1261139316.129:19): avc:  denied  { write } for  pid=2322 comm="gconf-defaults-" name=".gconf" dev=dm-0 ino=307 scontext=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir

node=(removed) type=AVC msg=audit(1261139316.129:19): avc:  denied  { add_name } for  pid=2322 comm="gconf-defaults-" name=".testing.writeability" scontext=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir

node=(removed) type=AVC msg=audit(1261139316.129:19): avc:  denied  { create } for  pid=2322 comm="gconf-defaults-" name=".testing.writeability" scontext=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_home_t:s0 tclass=file

node=(removed) type=AVC msg=audit(1261139316.129:19): avc:  denied  { write open } for  pid=2322 comm="gconf-defaults-" name=".testing.writeability" dev=dm-0 ino=430 scontext=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_home_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1261139316.129:19): arch=c000003e syscall=2 success=no exit=-131938811387944 a0=215ddd0 a1=41 a2=1c0 a3=2b items=0 ppid=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gconf-defaults-" exe="/usr/libexec/gconf-defaults-mechanism" subj=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.6.12-91.fc11,restorecon,gconf-defaults-,gconfdefaultsm_t,user_home_t,dir,search
audit2allow suggests:

#============= gconfdefaultsm_t ==============
#!!!! The source type 'gconfdefaultsm_t' can write to a 'dir' of the following types:
# gconf_etc_t, gconf_home_t, nfs_t

allow gconfdefaultsm_t user_home_t:dir { write search add_name };
#!!!! The source type 'gconfdefaultsm_t' can write to a 'file' of the following types:
# gconf_etc_t, gconf_home_t, nfs_t

allow gconfdefaultsm_t user_home_t:file { write create open };