Bug 613369

Created attachment 430946 [details]
pipslite.te

Description of problem:

I recently created a policy module (attached) for pipslite (Epson-provided printer drivers, attached); it used to work just fine but something's obviously changed a lot with a recent Fedora update, since first of all I had to explictly allow unconfined_u to look at the file's attributes to avoid an avc:

allow unconfined_t pipslite_fifo_t:fifo_file getattr;

The avc was:

type=AVC msg=audit(1278807797.441:5107): avc:  denied  { getattr } for  pid=18094 comm="bash" path="/var/run/pipslitelp0" dev=dm-12 i
no=1032 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:pipslite_fifo_t:s0 tclass=fifo_file
type=SYSCALL msg=audit(1278807797.441:5107): arch=c000003e syscall=4 success=yes exit=0 a0=15b8930 a1=7fff2c5a1980 a2=7fff2c5a1980 a3
=1 items=0 ppid=18093 pid=18094 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=348 comm="bash" exe="/b
in/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)

Second, I get weird warnings from audit2allow (Even though it works ...) :

[root@chimpy ~]# audit2allow -Ral
libsepol.context_from_record: type pipslite_socket_t is not defined
libsepol.context_from_record: could not create context structure
libsepol.context_from_string: could not create context structure
libsepol.sepol_context_to_sid: could not convert system_u:object_r:pipslite_socket_t:s0 to sid
libsepol.context_from_record: type pipslite_socket_t is not defined
libsepol.context_from_record: could not create context structure
libsepol.context_from_string: could not create context structure
(last 4 lines repeated a dozen times)

Version-Release number of selected component (if applicable):

selinux-policy-3.7.19-33.fc13.noarch

How reproducible:

Every time I run audit2allow 

Steps to Reproduce:
1. install my policy module : semodule -i pipslite.pp
2. audit2allow -Ral
3.
  
Actual results:

Lots of warnings

Expected results:

No such warnings


Additional info:

System was installed fresh as F10 and updated to F11, then F12 and F13; this has once caused a problem in the past so I mention it.

[root@chimpy ~]# semanage user -l

                Labeling   MLS/       MLS/                          
SELinux User    Prefix     MCS Level  MCS Range                      SELinux Roles

git_shell_u     user       s0         s0                             git_shell_r
guest_u         user       s0         s0                             guest_r
root            user       s0         s0-s0:c0.c1023                 staff_r sysadm_r system_r unconfined_r
staff_u         user       s0         s0-s0:c0.c1023                 staff_r sysadm_r system_r unconfined_r
sysadm_u        user       s0         s0-s0:c0.c1023                 sysadm_r
system_u        user       s0         s0-s0:c0.c1023                 system_r unconfined_r
unconfined_u    user       s0         s0-s0:c0.c1023                 system_r unconfined_r
user_u          user       s0         s0                             user_r
xguest_u        user       s0         s0                             xguest_r

[root@chimpy ~]# semanage login -l

Login Name                SELinux User              MLS/MCS Range            

__default__               unconfined_u              s0-s0:c0.c1023           
root                      unconfined_u              s0-s0:c0.c1023           
system_u                  system_u                  s0-s0:c0.c1023           


[root@chimpy ~]# cat /etc/selinux/targeted/contexts/files/file_contexts.local
# This file is auto-generated by libsemanage
# Do not edit directly.

/home/nico/Music(/.*)?    system_u:object_r:public_content_rw_t:s0