Bug 560836

Resúmen:

SELinux is preventing /usr/bin/kdm "write" access on /root.

Descripción Detallada:

[SELinux esta en modo permisivo. Este acceso no fue denegado.]

SELinux denied access requested by kdm. It is not expected that this access is
required by kdm and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Permitiendo Acceso:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Información Adicional:

Contexto Fuente               system_u:system_r:xdm_t:s0-s0:c0.c1023
Contexto Destino              system_u:object_r:admin_home_t:s0
Objetos Destino               /root [ dir ]
Fuente                        kdm
Dirección de Fuente          /usr/bin/kdm
Puerto                        <Desconocido>
Nombre de Equipo              (removed)
Paquetes RPM Fuentes          kdm-4.3.90-9.fc13
Paquetes RPM Destinos         filesystem-2.4.31-1.fc13
RPM de Políticas             selinux-policy-3.7.8-2.fc13
SELinux Activado              True
Tipo de Política             targeted
Modo Obediente                Permissive
Nombre de Plugin              catchall
Nombre de Equipo              (removed)
Plataforma                    Linux (removed) 2.6.33-0.20.rc5.git0.fc13.x86_64 #1
                              SMP Fri Jan 22 19:49:17 UTC 2010 x86_64 x86_64
Cantidad de Alertas           9
Visto por Primera Vez         sáb 30 ene 2010 18:11:57 CET
Visto por Última Vez         lun 01 feb 2010 18:00:59 CET
ID Local                      784aa36f-98da-4db5-9a7e-be3389ab0773
Números de Línea            

Mensajes de Auditoría Crudos 

node=(removed) type=AVC msg=audit(1265043659.7:99): avc:  denied  { write } for  pid=13371 comm="kdm" name="root" dev=dm-0 ino=90113 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir

node=(removed) type=AVC msg=audit(1265043659.7:99): avc:  denied  { add_name } for  pid=13371 comm="kdm" name=".xsession-errors-:0" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir

node=(removed) type=AVC msg=audit(1265043659.7:99): avc:  denied  { create } for  pid=13371 comm="kdm" name=".xsession-errors-:0" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=file

node=(removed) type=AVC msg=audit(1265043659.7:99): avc:  denied  { append open } for  pid=13371 comm="kdm" name=".xsession-errors-:0" dev=dm-0 ino=2825 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1265043659.7:99): arch=c000003e syscall=2 success=yes exit=3 a0=2382900 a1=4c1 a2=180 a3=7fff59c89f00 items=0 ppid=13343 pid=13371 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=14 comm="kdm" exe="/usr/bin/kdm" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.7.8-2.fc13,catchall,kdm,xdm_t,admin_home_t,dir,write
audit2allow suggests:

#============= xdm_t ==============
#!!!! The source type 'xdm_t' can write to a 'dir' of the following types:
# xdm_rw_etc_t, root_t, tmp_t, var_t, user_fonts_t, user_tmpfs_t, xdm_spool_t, fonts_cache_t, user_home_dir_t, locale_t, var_auth_t, tmpfs_t, var_spool_t, var_lib_t, user_tmp_t, var_run_t, xdm_tmp_t, auth_cache_t, xdm_tmpfs_t, xserver_log_t, var_log_t, xdm_log_t, pam_var_run_t, xdm_var_lib_t, xdm_var_run_t, xdm_home_t, pam_var_console_t, pcscd_var_run_t, var_lock_t, xkb_var_lib_t, root_t

allow xdm_t admin_home_t:dir { write add_name };
allow xdm_t admin_home_t:file { create open append };