Bug 639512

Summary:

SELinux is preventing /usr/lib64/nspluginwrapper/plugin-config access to a
leaked /dev/dri/card0 file descriptor.

Detailed Description:

[plugin-config has a permissive type (nsplugin_config_t). This access was not
denied.]

SELinux denied access requested by the plugin-config command. It looks like this
is either a leaked descriptor or plugin-config output was redirected to a file
it is not allowed to access. Leaks usually can be ignored since SELinux is just
closing the leak and reporting the error. The application does not use the
descriptor, so it will run properly. If this is a redirection, you will not get
output in the /dev/dri/card0. You should generate a bugzilla on selinux-policy,
and it will get routed to the appropriate package. You can safely ignore this
avc.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385)

Additional Information:

Source Context                unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:
                              c0.c1023
Target Context                system_u:object_r:dri_device_t:s0
Target Objects                /dev/dri/card0 [ chr_file ]
Source                        plugin-config
Source Path                   /usr/lib64/nspluginwrapper/plugin-config
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           nspluginwrapper-1.3.0-14.fc14
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.5-7.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   leaks
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.35.4-28.fc14.x86_64 #1 SMP Wed Sep 15 01:56:54
                              UTC 2010 x86_64 x86_64
Alert Count                   2
First Seen                    Fri 01 Oct 2010 08:51:53 PM EDT
Last Seen                     Fri 01 Oct 2010 08:52:07 PM EDT
Local ID                      40578099-a749-4265-8332-8a03cafc1411
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1285980727.141:22): avc:  denied  { read write } for  pid=2274 comm="plugin-config" path="/dev/dri/card0" dev=devtmpfs ino=6179 scontext=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 tcontext=system_u:object_r:dri_device_t:s0 tclass=chr_file

node=(removed) type=SYSCALL msg=audit(1285980727.141:22): arch=c000003e syscall=59 success=yes exit=0 a0=174cc10 a1=1748ff0 a2=174cff0 a3=1 items=0 ppid=2272 pid=2274 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="plugin-config" exe="/usr/lib64/nspluginwrapper/plugin-config" subj=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  leaks,plugin-config,nsplugin_config_t,dri_device_t,chr_file,read,write
audit2allow suggests:

#============= nsplugin_config_t ==============
allow nsplugin_config_t dri_device_t:chr_file { read write };