Bug 560256
| Summary: | SELinux is preventing the gconf-defaults- from using potentially mislabeled files (.testing.writeability). | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | gluengo <c.gonzalo.luengo> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 12 | CC: | dwalsh, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:15d578dce8a2ad5f2d97dc2c1b954b949eaa1c316f5346b65e5246e3f1c41e14 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-02-01 11:01:16 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 560254 *** |
Resúmen: SELinux is preventing the gconf-defaults- from using potentially mislabeled files (.testing.writeability). Descripción Detallada: [gconf-defaults- es un tipo permisivo (gconfdefaultsm_t). Este acceso no fue denegado.] SELinux has denied gconf-defaults- access to potentially mislabeled file(s) (.testing.writeability). This means that SELinux will not allow gconf-defaults- to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access. Permitiendo Acceso: If you want gconf-defaults- to access this files, you need to relabel them using restorecon -v '.testing.writeability'. You might want to relabel the entire directory using restorecon -R -v '.testing.writeability'. Información Adicional: Contexto Fuente system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 Contexto Destino unconfined_u:object_r:user_home_t:s0 Objetos Destino .testing.writeability [ dir ] Fuente gconf-defaults- Dirección de Fuente /usr/libexec/gconf-defaults-mechanism Puerto <Desconocido> Nombre de Equipo (removed) Paquetes RPM Fuentes GConf2-2.26.2-1.fc11 Paquetes RPM Destinos RPM de Políticas selinux-policy-3.6.12-91.fc11 SELinux Activado True Tipo de Política targeted Modo Obediente Enforcing Nombre de Plugin home_tmp_bad_labels Nombre de Equipo (removed) Plataforma Linux (removed) 2.6.30.9-102.fc11.x86_64 #1 SMP Fri Dec 4 00:18:53 EST 2009 x86_64 x86_64 Cantidad de Alertas 4 Visto por Primera Vez vie 18 dic 2009 01:48:56 CLST Visto por Última Vez vie 18 dic 2009 09:28:36 CLST ID Local 52270f28-0a8f-45ce-8f35-26b55a19a4b3 Números de Línea Mensajes de Auditoría Crudos node=(removed) type=AVC msg=audit(1261139316.130:20): avc: denied { remove_name } for pid=2322 comm="gconf-defaults-" name=".testing.writeability" dev=dm-0 ino=430 scontext=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir node=(removed) type=AVC msg=audit(1261139316.130:20): avc: denied { unlink } for pid=2322 comm="gconf-defaults-" name=".testing.writeability" dev=dm-0 ino=430 scontext=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_home_t:s0 tclass=file node=(removed) type=SYSCALL msg=audit(1261139316.130:20): arch=c000003e syscall=87 success=yes exit=0 a0=215ddd0 a1=41 a2=1c0 a3=2b items=0 ppid=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gconf-defaults-" exe="/usr/libexec/gconf-defaults-mechanism" subj=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 key=(null) Hash String generated from selinux-policy-3.6.12-91.fc11,home_tmp_bad_labels,gconf-defaults-,gconfdefaultsm_t,user_home_t,dir,remove_name audit2allow suggests: #============= gconfdefaultsm_t ============== allow gconfdefaultsm_t user_home_t:dir remove_name; allow gconfdefaultsm_t user_home_t:file unlink;