Bug 582063

Summary: SELinux is preventing /usr/bin/gpg "write" access on S.gpg-agent.
Product: [Fedora] Fedora Reporter: Carl G. <carlg>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: 12CC: dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:bd314be6c8679e1a0a5ed14da1d99addedc9876a7f00ecf878c9aca5f9add747
Fixed In Version: selinux-policy-3.6.32-113.fc12 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-05-03 16:09:29 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Carl G. 2010-04-14 01:45:57 UTC 
Résumé:

SELinux is preventing /usr/bin/gpg "write" access on S.gpg-agent.

Description détaillée:

SELinux denied access requested by gpg. It is not expected that this access is
required by gpg and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Autoriser l'accès:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Informations complémentaires:

Contexte source               staff_u:staff_r:gpg_t:s0-s0:c0.c1023
Contexte cible                staff_u:object_r:user_tmp_t:s0
Objets du contexte            S.gpg-agent [ sock_file ]
source                        gpg
Chemin de la source           /usr/bin/gpg
Port                          <Inconnu>
Hôte                         (removed)
Paquetages RPM source         gnupg-1.4.10-1.fc12
Paquetages RPM cible          
Politique RPM                 selinux-policy-3.6.32-108.fc12
Selinux activé               True
Type de politique             targeted
Mode strict                   Enforcing
Nom du plugin                 catchall
Nom de l'hôte                (removed)
Plateforme                    Linux (removed)
                              2.6.32.11-99.fc12.x86_64 #1 SMP Mon Apr 5 19:59:38
                              UTC 2010 x86_64 x86_64
Compteur d'alertes            1
Première alerte              mar 13 avr 2010 21:43:20 EDT
Dernière alerte              mar 13 avr 2010 21:43:20 EDT
ID local                      2c9f2b66-74a1-442d-8fcd-9c6510f5be21
Numéros des lignes           

Messages d'audit bruts        

node=(removed) type=AVC msg=audit(1271209400.853:795): avc:  denied  { write } for  pid=13576 comm="gpg" name="S.gpg-agent" dev=dm-2 ino=3177 scontext=staff_u:staff_r:gpg_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:user_tmp_t:s0 tclass=sock_file

node=(removed) type=SYSCALL msg=audit(1271209400.853:795): arch=c000003e syscall=42 success=no exit=-13 a0=7 a1=7fff12f90db0 a2=22 a3=2 items=0 ppid=6765 pid=13576 auid=500 uid=500 gid=501 euid=500 suid=500 fsuid=500 egid=501 sgid=501 fsgid=501 tty=(none) ses=1 comm="gpg" exe="/usr/bin/gpg" subj=staff_u:staff_r:gpg_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  catchall,gpg,gpg_t,user_tmp_t,sock_file,write
audit2allow suggests:

#============= gpg_t ==============
allow gpg_t user_tmp_t:sock_file write;
Comment 1 Carl G. 2010-04-14 01:48:55 UTC 
Enigmail (PGP plugin)+ Thunderbird :

Envoi de courrier abandonné.

Erreur - mauvaise phrase secrète

gpg ligne de commande et sortie :
/usr/bin/gpg
can't connect to `/tmp/seahorse-2dfTzt/S.gpg-agent': Permission non accordée
gpg: impossible de se connecter à `/tmp/seahorse-2dfTzt/S.gpg-agent': connect failed
gpg: impossible de demander la phrase de passe en mode automatique
gpg: Phrase de passe invalide ; réessayez ...
gpg: impossible de demander la phrase de passe en mode automatique
gpg: Phrase de passe invalide ; réessayez ...
gpg: impossible de demander la phrase de passe en mode automatique
gpg: « 0x1036E384 » a été ignoré: mauvaise phrase de passe
gpg: [stdin]: clearsign failed: mauvaise phrase de passe
Comment 2 Daniel Walsh 2010-04-14 12:50:48 UTC 
Miroslav,

Add

userdom_stream_connect(gpg_t)
Comment 3 Miroslav Grepl 2010-04-16 07:31:17 UTC 
Fixed in selinux-policy-3.6.32-112.fc12
Comment 4 Fedora Update System 2010-04-23 12:44:54 UTC 
selinux-policy-3.6.32-113.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-113.fc12
Comment 5 Fedora Update System 2010-04-27 02:23:31 UTC 
selinux-policy-3.6.32-113.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-113.fc12
Comment 6 Fedora Update System 2010-05-03 16:07:32 UTC 
selinux-policy-3.6.32-113.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.