| Summary: | selinux policy | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | bodhi.zazen <bodhi.zazen> | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED CANTFIX | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 15 | CC: | bodhi.zazen, dennis, dominick.grift, dwalsh, mgrepl | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2011-06-01 06:11:18 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Attachments: |
|
||||||
|
Description
bodhi.zazen
2011-05-29 22:17:42 UTC
Looks like some device nodes are mislabelled. I guess udev, systemd and dracut did not catch that somehow. I guess you could try adding a restorecon -R -v -F /dev in rc.local or something similar? The reason the nvidia device is not usable by user_u is that it is mislabeled. If after the device is created you ran a restorecon on it restorecon /dev/nvid* It would label it correctly and your confined users would be allowed to access it. Similarly your other allow rules in your policy seem to be related to ~/ being mislabeled. restorecon -R -v ~/ Should clean them up. Daniel Walsh: Thank you for your time and detailed response. restorecon works, temporarily, but the labels are reset when I reboot, and must be restored as root, which is inconvenient. These are the default permissions: crw-rw-rw-. root root system_u:object_r:device_t:s0 nvidia0 crw-rw-rw-. root root system_u:object_r:device_t:s0 nvidiactl And after running restorecon /dev/nvid* crw-rw-rw-. root root system_u:object_r:xserver_misc_device_t:s0 nvidia0 crw-rw-rw-. root root system_u:object_r:xserver_misc_device_t:s0 nvidiactl Again, the problem now is the labels are reset to device_t at reboot. Fortunately there are some solutions for this issue. 1. You could add "/dev/nvidia*" to /etc/selinux/restorecond.conf and run the restorecond service. # yum install policycoreutils-restorecond # chkconfig level 2345 restorecond on # service restorecond start 2. If you see in the scripts where nvidia* are created, you could add a restorecon right afterwards. 3. Or you can add a local policy module using # grep gnome-session-c /var/log/audit/audit.log | audit2alllow -M nvidiaisbroken # semodule -i nvidiaisbroken.pp Or run restorecon -R -v /dev/nvidia* in rc.local We should have a better fix for this in F16 Thank you both. @ Daniel Walsh 1. Thanks, running restorecon in rc.local did not work , which is why I posted back. 2. Good to learn there will be a better solution , that is the point of posting bug reports, and again I appreciate your effort. @ Miroslav Grepl That is what I did, add a local policy, it was easier. Also, in suggesting autdit2allow I think the naming of the local policy, in this case "nvidiaisbroken" makes more sense then a generic term such as local.policy or my.policy. |