| Summary: | SELinux is preventing /usr/bin/iceauth from 'read' accesses on the file /home/jacek/.DCOPserver_(removed)__0 (deleted). | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Jacek Pawlyta <cunio> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED INSUFFICIENT_DATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 15 | CC: | alirohman, bignikita, dschulz1988, dwalsh, etnomax, josue.garc, mdeggers, mgrepl, msava, rob.d.wills, thottam, vikigoyal |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:80b1f57a5c6aee0b13ee1980c9b7db82a281512bec7f9cbd124d886c63422934 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-10-07 14:13:37 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
Some how the /home/jacek/.DCOPserver_(removed)__0 file got created with the wrong label? Any idea what was going on when this happened? Try restorecon -R -v -F ~/ November 6 2011 while making sure that my new machine is patched to the latest level , I have got this -
SELinux is preventing /usr/bin/iceauth from read access on the file /home/user3/.DCOPserver_themachine__0 (deleted).
***** Plugin restorecon (99.5 confidence) suggests *************************
If you want to fix the label.
/home/user3/.DCOPserver_themachine__0 (deleted) default label should be iceauth_home_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /home/user3/.DCOPserver_themachine__0 (deleted)
***** Plugin catchall (1.49 confidence) suggests ***************************
If you believe that iceauth should be allowed read access on the .DCOPserver_themachine__0 (deleted) file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep iceauth /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context unconfined_u:unconfined_r:iceauth_t:s0-s0:c0.c1023
Target Context unconfined_u:object_r:user_home_dir_t:s0
Target Objects /home/user3/.DCOPserver_themachine__0 (deleted) [
file ]
Source iceauth
Source Path /usr/bin/iceauth
Port <Unknown>
Host themachine
Source RPM Packages xorg-x11-server-utils-7.5-5.fc15
Target RPM Packages
Policy RPM selinux-policy-3.9.16-23.fc15
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name themachine
Platform Linux themachine 2.6.38.6-26.rc1.fc15.x86_64 #1
SMP Mon May 9 20:45:15 UTC 2011 x86_64 x86_64
Alert Count 5
First Seen Sat 05 Nov 2011 02:00:23 PM EDT
Last Seen Sun 06 Nov 2011 11:16:21 AM EST
Local ID 08d8ac58-f3a6-4c84-87ae-8380b35a08c5
Raw Audit Messages
type=AVC msg=audit(1320596181.203:68): avc: denied { read } for pid=2443 comm="iceauth" path=2F686F6D652F75736572332F2E44434F507365727665725F7468656D616368696E655F5F30202864656C6574656429 dev=sda3 ino=269817 scontext=unconfined_u:unconfined_r:iceauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=file
type=SYSCALL msg=audit(1320596181.203:68): arch=x86_64 syscall=execve success=yes exit=0 a0=17307b0 a1=172fa90 a2=172edb0 a3=8 items=0 ppid=2442 pid=2443 auid=504 uid=504 gid=100 euid=504 suid=504 fsuid=504 egid=100 sgid=100 fsgid=100 tty=(none) ses=2 comm=iceauth exe=/usr/bin/iceauth subj=unconfined_u:unconfined_r:iceauth_t:s0-s0:c0.c1023 key=(null)
Hash: iceauth,iceauth_t,user_home_dir_t,file,read
audit2allow
#============= iceauth_t ==============
allow iceauth_t user_home_dir_t:file read;
audit2allow -R
#============= iceauth_t ==============
allow iceauth_t user_home_dir_t:file read;
Do you know what created ".DCOPserver_themachine__0"? in my case the problem appears probably when Google Chrome is starting |
SELinux is preventing /usr/bin/iceauth from 'read' accesses on the file /home/jacek/.DCOPserver_(removed)__0 (deleted). ***** Plugin restorecon (99.5 confidence) suggests ************************* If you want to fix the label. /home/jacek/.DCOPserver_(removed)__0 (deleted) default label should be iceauth_home_t. Then you can run restorecon. Do # /sbin/restorecon -v /home/jacek/.DCOPserver_(removed)__0 (deleted) ***** Plugin catchall (1.49 confidence) suggests *************************** If you believe that iceauth should be allowed read access on the .DCOPserver_(removed)__0 (deleted) file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep iceauth /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:unconfined_r:iceauth_t:s0-s0:c0.c1023 Target Context unconfined_u:object_r:user_home_dir_t:s0 Target Objects /home/jacek/.DCOPserver_(removed)__0 (deleted) [ file ] Source iceauth Source Path /usr/bin/iceauth Port <Unknown> Host (removed) Source RPM Packages xorg-x11-server-utils-7.5-5.fc15 Target RPM Packages Policy RPM selinux-policy-3.9.16-22.fc15 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 2.6.38.5-23.fc15.x86_64 #1 SMP Wed May 4 03:34:03 UTC 2011 x86_64 x86_64 Alert Count 290 First Seen Wed 30 Mar 2011 12:18:47 PM CEST Last Seen Fri 06 May 2011 03:21:12 PM CEST Local ID 8b2815e9-6a47-4a90-af13-17db3efc051f Raw Audit Messages type=AVC msg=audit(1304688072.929:181): avc: denied { read } for pid=14947 comm="iceauth" path=2F686F6D652F6A6163656B2F2E44434F507365727665725F6A6163656B2E7061776C7974612E706C5F5F30202864656C6574656429 dev=dm-2 ino=15209253 scontext=unconfined_u:unconfined_r:iceauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=file type=SYSCALL msg=audit(1304688072.929:181): arch=x86_64 syscall=execve success=yes exit=0 a0=1631be0 a1=1630f70 a2=1630120 a3=7ffff4a219d0 items=0 ppid=14946 pid=14947 auid=500 uid=500 gid=501 euid=500 suid=500 fsuid=500 egid=501 sgid=501 fsgid=501 tty=(none) ses=10 comm=iceauth exe=/usr/bin/iceauth subj=unconfined_u:unconfined_r:iceauth_t:s0-s0:c0.c1023 key=(null) Hash: iceauth,iceauth_t,user_home_dir_t,file,read audit2allow #============= iceauth_t ============== allow iceauth_t user_home_dir_t:file read; audit2allow -R #============= iceauth_t ============== allow iceauth_t user_home_dir_t:file read;