Bug 560388

Summary: SELinux is preventing /usr/libexec/abrt-hook-python access to a leaked socket file descriptor.
Product: [Fedora] Fedora Reporter: Julian <julian.rubach>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 12CC: dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:545e23c94030a60f7952cd2fa32f4c0f22129c61cb2fc90dcc1ba06cd630da0a
Fixed In Version: 3.6.32-84.fc12 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-02-11 14:43:33 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Julian 2010-01-31 12:37:20 UTC 
Zusammenfassung:

SELinux is preventing /usr/libexec/abrt-hook-python access to a leaked socket
file descriptor.

Detaillierte Beschreibung:

[abrt-hook-pytho hat einen toleranten Typ (abrt_helper_t). Dieser Zugriff wurde
nicht verweigert.]

SELinux denied access requested by the abrt-hook-pytho command. It looks like
this is either a leaked descriptor or abrt-hook-pytho output was redirected to a
file it is not allowed to access. Leaks usually can be ignored since SELinux is
just closing the leak and reporting the error. The application does not use the
descriptor, so it will run properly. If this is a redirection, you will not get
output in the socket. You should generate a bugzilla on selinux-policy, and it
will get routed to the appropriate package. You can safely ignore this avc.

Zugriff erlauben:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385)

Zusätzliche Informationen:

Quellkontext                  unconfined_u:unconfined_r:abrt_helper_t:s0-s0:c0.c
                              1023
Zielkontext                   unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Zielobjekte                   socket [ socket ]
Quelle                        abrt-hook-pytho
Quellen-Pfad                  /usr/libexec/abrt-hook-python
Port                          <Unbekannt>
Host                          (removed)
Quellen-RPM-Pakete            abrt-addon-python-1.0.3-1.fc12
Ziel-RPM-Pakete               
RPM-Richtlinie                selinux-policy-3.6.32-69.fc12
SELinux aktiviert             True
Richtlinienversion            targeted
Enforcing-Modus               Enforcing
Plugin-Name                   leaks
Hostname                      (removed)
Plattform                     Linux (removed)
                              2.6.31.12-174.2.3.fc12.x86_64 #1 SMP Mon Jan 18
                              19:52:07 UTC 2010 x86_64 x86_64
Anzahl der Alarme             1
Zuerst gesehen                Fr 22 Jan 2010 12:08:50 CET
Zuletzt gesehen               Fr 22 Jan 2010 12:08:50 CET
Lokale ID                     41978654-6c67-4842-bfd3-475961f8ea10
Zeilennummern                 

Raw-Audit-Meldungen           

node=(removed) type=AVC msg=audit(1264158530.900:37): avc:  denied  { read write } for  pid=4984 comm="abrt-hook-pytho" path="socket:[70305]" dev=sockfs ino=70305 scontext=unconfined_u:unconfined_r:abrt_helper_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=socket

node=(removed) type=SYSCALL msg=audit(1264158530.900:37): arch=c000003e syscall=59 success=yes exit=0 a0=16620f0 a1=1599830 a2=1641090 a3=20 items=0 ppid=4967 pid=4984 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=475 sgid=475 fsgid=475 tty=(none) ses=1 comm="abrt-hook-pytho" exe="/usr/libexec/abrt-hook-python" subj=unconfined_u:unconfined_r:abrt_helper_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.6.32-69.fc12,leaks,abrt-hook-pytho,abrt_helper_t,unconfined_t,socket,read,write
audit2allow suggests:

#============= abrt_helper_t ==============
allow abrt_helper_t unconfined_t:socket { read write };
Comment 1 Daniel Walsh 2010-02-01 19:51:41 UTC 
Miroslav,

Can you make abrt_domtrans_helper look like the following.

interface(`abrt_domtrans_helper',`
	gen_require(`
		type abrt_helper_t, abrt_helper_exec_t;
	')

        domtrans_pattern($1, abrt_helper_exec_t, abrt_helper_t)

ifdef(`hide_broken_symptoms', `
	dontaudit abrt_helper_t $1:socket_class_set { read write };
	fs_dontaudit_rw_anon_inodefs_files(abrt_helper_t)
')
')

Also add socket to socket_class_set in obj_perm_sets.spt
Comment 2 Miroslav Grepl 2010-02-01 20:03:03 UTC 
Fixed in selinux-policy-3.6.32-80.fc12
Comment 3 Fedora Update System 2010-02-03 23:20:48 UTC 
selinux-policy-3.6.32-82.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-82.fc12
Comment 4 Fedora Update System 2010-02-05 01:46:04 UTC 
selinux-policy-3.6.32-84.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-1492
Comment 5 Fedora Update System 2010-02-11 14:39:08 UTC 
selinux-policy-3.6.32-84.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.