Bug 577890
| Summary: | SELinux is preventing /usr/lib/cups/daemon/cups-deviced from executing mfp. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | clainth ficien <kafnir> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 12 | CC: | dwalsh, kafnir, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i386 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:a335fc7aa4b1a5d51784befa0f60a6cf3d1ee9d921141a718c829e044ec5bead | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-06-23 08:56:11 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Where is mfp? chcon -t bin_t mfp Will allow this access. *** Bug 577940 has been marked as a duplicate of this bug. *** |
Summary: SELinux is preventing /usr/lib/cups/daemon/cups-deviced from executing mfp. Detailed Description: SELinux has denied the cups-deviced from executing mfp. If cups-deviced is supposed to be able to execute mfp, this could be a labeling problem. Most confined domains are allowed to execute files labeled bin_t. So you could change the labeling on this file to bin_t and retry the application. If this cups-deviced is not supposed to execute mfp, this could signal an intrusion attempt. Allowing Access: If you want to allow cups-deviced to execute mfp: chcon -t bin_t 'mfp' If this fix works, please update the file context on disk, with the following command: semanage fcontext -a -t bin_t 'mfp' Please specify the full path to the executable, Please file a bug report to make sure this becomes the default labeling. Additional Information: Source Context unconfined_u:system_r:cupsd_t:s0-s0:c0.c1023 Target Context unconfined_u:object_r:usr_t:s0 Target Objects mfp [ file ] Source cupsd Source Path /usr/sbin/cupsd Port <Unknown> Host (removed) Source RPM Packages cups-1.4.2-28.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.32-103.fc12 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name execute Host Name (removed) Platform Linux (removed) 2.6.32.9-70.fc12.i686 #1 SMP Wed Mar 3 05:14:32 UTC 2010 i686 i686 Alert Count 3 First Seen Mon 29 Mar 2010 11:38:03 AM EDT Last Seen Mon 29 Mar 2010 11:39:25 AM EDT Local ID 46dba81e-b7ff-4b7e-851d-d4a237921ffc Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1269877165.787:200): avc: denied { execute } for pid=6268 comm="cups-deviced" name="mfp" dev=sda2 ino=88277 scontext=unconfined_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:usr_t:s0 tclass=file node=(removed) type=SYSCALL msg=audit(1269877165.787:200): arch=40000003 syscall=11 success=no exit=-13 a0=bfd70d8c a1=bfd70584 a2=bfd71a70 a3=b items=0 ppid=6263 pid=6268 auid=500 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=1 comm="cups-deviced" exe="/usr/lib/cups/daemon/cups-deviced" subj=unconfined_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null) Hash String generated from execute,cupsd,cupsd_t,usr_t,file,execute audit2allow suggests: #============= cupsd_t ============== allow cupsd_t usr_t:file execute;