Bug 566074

요약:

SELinux is preventing gdm-binary (xdm_t) "unlink" to
./force-display-on-active-vt (var_spool_t).

상세 설명:

SELinux is preventing gdm-binary (xdm_t) "unlink" to
./force-display-on-active-vt (var_spool_t). The SELinux type var_spool_t, is a
generic type for all files in the directory and very few processes (SELinux
Domains) are allowed to write to this SELinux type. This type of denial usual
indicates a mislabeled file. By default a file created in a directory has the
gets the context of the parent directory, but SELinux policy has rules about the
creation of directories, that say if a process running in one SELinux Domain
(D1) creates a file in a directory with a particular SELinux File Context (F1)
the file gets a different File Context (F2). The policy usually allows the
SELinux Domain (D1) the ability to write, unlink, and append on (F2). But if for
some reason a file (./force-display-on-active-vt) was created with the wrong
context, this domain will be denied. The usual solution to this problem is to
reset the file context on the target file, restorecon -v
'./force-display-on-active-vt'. If the file context does not change from
var_spool_t, then this is probably a bug in policy. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy
package. If it does change, you can try your application again to see if it
works. The file context could have been mislabeled by editing the file or moving
the file from a different directory, if the file keeps getting mislabeled, check
the init scripts to see if they are doing something to mislabel the file.

액세스 허용:

You can attempt to fix file context by executing restorecon -v
'./force-display-on-active-vt'

Fix 명령 :

restorecon './force-display-on-active-vt'

자세한 정보:

소스 문맥                 system_u:system_r:xdm_t:s0-s0:c0.c1023
대상 문맥                 system_u:object_r:var_spool_t:s0
대상 객체                 ./force-display-on-active-vt [ file ]
소스                        gdm-binary
소스 경로                 /usr/sbin/gdm-binary
포트                        <알려지지 않음>
호스트                     (removed)
소스 RPM 패키지          gdm-2.24.1-4.fc10
대상 RPM 패키지          
정책 RPM                    selinux-policy-3.5.13-59.fc10
Selinux 활성화             True
정책 유형                 targeted
강제 모드                 Enforcing
플러그인명               mislabeled_file
호스트명                  (removed)
플랫폼                     Linux (removed) 2.6.27.24-170.2.68.fc10.x86_64 #1 SMP
                              Wed May 20 22:47:23 EDT 2009 x86_64 x86_64
통지 카운트              7
초기 화면                 2009년 04월 30일 (목) 오후 09시 44분 52초
마지막 화면              2009년 06월 01일 (월) 오전 10시 08분 13초
로컬 ID                     814f27a0-93ff-43ef-a13b-ed50e0b60a5f
줄 번호                    

원 감사 메세지          

node=(removed) type=AVC msg=audit(1243818493.597:8): avc:  denied  { unlink } for  pid=2625 comm="gdm-binary" name="force-display-on-active-vt" dev=sda1 ino=401434 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1243818493.597:8): arch=c000003e syscall=87 success=no exit=-13 a0=41bf88 a1=0 a2=1 a3=8101010101010100 items=0 ppid=1 pid=2625 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdm-binary" exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  mislabeled_file,gdm-binary,xdm_t,var_spool_t,file,unlink
audit2allow suggests:

#============= xdm_t ==============
allow xdm_t var_spool_t:file unlink;