Bug 639247
| Summary: | SELinux is preventing /usr/libexec/gdm-session-worker "create" access | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Milos Malik <mmalik> |
| Component: | libselinux | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.0 | CC: | dwalsh, eparis, mgrepl, mtruneck, sdsmall |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-06-13 09:36:03 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 658571 | ||
| Bug Blocks: | 750385, 756082 | ||
|
Description
Milos Malik
2010-10-01 08:53:27 UTC
Appeared immediately after comment#0 Summary: SELinux is preventing /usr/libexec/gdm-session-worker "entrypoint" access on /usr/bin/gnome-keyring-daemon. Detailed Description: SELinux denied access requested by gdm-session-wor. It is not expected that this access is required by gdm-session-wor and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context guest_u:guest_r:oddjob_mkhomedir_t:s0 Target Context system_u:object_r:bin_t:s0 Target Objects /usr/bin/gnome-keyring-daemon [ file ] Source gdm-session-wor Source Path /usr/libexec/gdm-session-worker Port <Unknown> Host localhost.localdomain Source RPM Packages gdm-2.30.4-21.el6 Target RPM Packages gnome-keyring-2.28.2-6.el6 Policy RPM selinux-policy-3.7.19-55.el6 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.32-71.el6.i686 #1 SMP Wed Sep 1 01:26:34 EDT 2010 i686 i686 Alert Count 3 First Seen Fri Oct 1 10:43:52 2010 Last Seen Fri Oct 1 10:47:03 2010 Local ID 46d0d879-29b7-43a3-84e9-85c5107610a6 Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1285922823.270:335): avc: denied { entrypoint } for pid=5660 comm="gdm-session-wor" path="/usr/bin/gnome-keyring-daemon" dev=dm-0 ino=64714 scontext=guest_u:guest_r:oddjob_mkhomedir_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file node=localhost.localdomain type=SYSCALL msg=audit(1285922823.270:335): arch=40000003 syscall=11 success=no exit=-13 a0=7ba449 a1=bf9bd1a0 a2=a014618 a3=7ba48c items=0 ppid=5622 pid=5660 auid=505 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none) ses=24 comm="gdm-session-wor" exe="/usr/libexec/gdm-session-worker" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) I'm sorry I forgot that guest_u user is not allowed to work in an X session. So this is what happened when you tried to login via X as a guest user. You were not allowed to login correct? Yes, I tried to log into X via GDM. After I entered login and password GDM displayed a message something like "Unable to open session" and I was not allowed to log in. Sadly the tool looked for a transition from xdm_t to guest_t and then attempted to fail over to other domains. Maybe it is time to change the library to not bring back alternative matches. We would have to make this change in Rawhide before we tried it in RHEL6. Delayed until at least 6.2 Fixed in libselinux-2.1.13-10.el7 This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request. The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days |