| Summary: | SELinux is preventing /usr/bin/python from 'read' accesses on the file /etc/localtime. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | RVV <ronzhin98> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 14 | CC: | dwalsh, geffry.villatoro, mgrepl, ronzhin98 |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i386 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:c5bc4875f17b258c32ad1e508c67e48d53beeac47406a1d39023d96fc3fbe106 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-01-26 12:50:51 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
*** Bug 672410 has been marked as a duplicate of this bug. *** *** Bug 672411 has been marked as a duplicate of this bug. *** *** Bug 672407 has been marked as a duplicate of this bug. *** Any chance you got this after fresh Fedora 14 install? Alert tells you how to fix. Although we would like to know how it got mislabeled in the first place. restorecon /etc/localtime Please reopen if this happens again. *** Bug 681863 has been marked as a duplicate of this bug. *** |
SELinux is preventing /usr/bin/python from 'read' accesses on the file /etc/localtime. ***** Plugin restorecon (99.5 confidence) suggests ************************* If you want to fix the label. /etc/localtime default label should be locale_t. Then you can run restorecon. Do # /sbin/restorecon -v /etc/localtime ***** Plugin catchall (1.49 confidence) suggests *************************** If you believe that python should be allowed read access on the localtime file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep system-config-f /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:firewallgui_t:s0-s0:c0.c1023 Target Context system_u:object_r:etc_runtime_t:s0 Target Objects /etc/localtime [ file ] Source system-config-f Source Path /usr/bin/python Port <Неизвестно> Host (removed) Source RPM Packages python-2.7-8.fc14.1 Target RPM Packages glibc-2.12.90-21 Policy RPM selinux-policy-3.9.7-19.fc14 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 2.6.35.10-74.fc14.i686 #1 SMP Thu Dec 23 16:17:40 UTC 2010 i686 i686 Alert Count 2 First Seen Пнд 10 Янв 2011 23:34:09 Last Seen Пнд 10 Янв 2011 23:34:09 Local ID cc1faed8-36dc-4530-962c-ecc7f2c13c9e Raw Audit Messages type=AVC msg=audit(1294677249.38:1827): avc: denied { read } for pid=3794 comm="system-config-f" name="localtime" dev=dm-3 ino=2632 scontext=system_u:system_r:firewallgui_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_runtime_t:s0 tclass=file system-config-f,firewallgui_t,etc_runtime_t,file,read type=SYSCALL msg=audit(1294677249.38:1827): arch=i386 syscall=open success=no exit=EACCES a0=8a2a91 a1=0 a2=1b6 a3=8a0d1a items=0 ppid=3793 pid=3794 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=system-config-f exe=/usr/bin/python subj=system_u:system_r:firewallgui_t:s0-s0:c0.c1023 key=(null) system-config-f,firewallgui_t,etc_runtime_t,file,read #============= firewallgui_t ============== allow firewallgui_t etc_runtime_t:file read;