Bug 683988

Summary: MLS: USER_AVC ... denied { send_msg } for ... interface=net.reactivated.Fprint.Manager ...
Product: Red Hat Enterprise Linux 6 Reporter: Milos Malik <mmalik>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Karel Srot <ksrot>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.1CC: dwalsh, ksrot, mgrepl
Target Milestone: rc   
Target Release: ---   
Hardware: ppc64   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.7.19-79.el6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-05-19 12:24:19 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Milos Malik 2011-03-10 20:59:41 UTC
Description of problem:


Version-Release number of selected component (if applicable):
dbus-1.2.24-3.el6.ppc64
dbus-devel-1.2.24-3.el6.ppc64
dbus-glib-0.86-5.el6.ppc64
dbus-libs-1.2.24-3.el6.ppc64
dbus-python-0.83.0-6.1.el6.ppc64
eggdbus-0.6-3.el6.ppc64
fprintd-0.1-19.git04fd09cfa.el6.ppc64
fprintd-pam-0.1-19.git04fd09cfa.el6.ppc64
selinux-policy-3.7.19-78.el6.noarch
selinux-policy-doc-3.7.19-78.el6.noarch
selinux-policy-minimum-3.7.19-78.el6.noarch
selinux-policy-mls-3.7.19-78.el6.noarch
selinux-policy-targeted-3.7.19-78.el6.noarch

How reproducible:
always

Steps to Reproduce:
1) get a RHEL-6.1 machine with active MLS policy
2) log in as root via console
3) run following commands:
# sestatus 
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        mls
# id -Z
root:sysadm_r:sysadm_t:SystemLow-SystemHigh
# newrole -r secadm_r
Password: 
# id -Z
root:secadm_r:secadm_t:SystemLow-SystemHigh
# exit
logout
# id -Z
root:sysadm_r:sysadm_t:SystemLow-SystemHigh
  
Actual results:
----
time->Thu Mar 10 15:52:57 2011
type=USER_AVC msg=audit(1299790377.360:197): user pid=1215 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s15:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=net.reactivated.Fprint.Manager member=GetDefaultDevice dest=net.reactivated.Fprint spid=3154 tpid=3156 scontext=root:sysadm_r:newrole_t:s0-s15:c0.c1023 tcontext=system_u:system_r:fprintd_t:s0-s15:c0.c1023 tclass=dbus : exe="/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
----

Expected results:
no AVCs

Comment 1 Miroslav Grepl 2011-03-11 12:27:05 UTC
How Dan said, we should fix it on non mls machines.

Comment 2 Daniel Walsh 2011-03-11 13:10:00 UTC
Yes fprintd should not be installed on MLS boxes.

We have this policy in F15

Comment 3 Miroslav Grepl 2011-03-17 10:27:30 UTC
Fixed in selinux-policy-3.7.19-79.el6

Comment 7 errata-xmlrpc 2011-05-19 12:24:19 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0526.html