| Summary: | SELinux is preventing /usr/bin/gok from read access on /var subdirectories | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Matthew Mosesohn <mmosesoh> | ||||
| Component: | gok | Assignee: | Matthias Clasen <mclasen> | ||||
| Status: | CLOSED WONTFIX | QA Contact: | Desktop QE <desktop-qa-list> | ||||
| Severity: | low | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | 6.3 | CC: | dwalsh, ksrot, mclasen, mmalik, msanders, pertusus, tpelka, tsmetana, wendellcraigbaker | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | selinux-policy-3.7.19-138.el6 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | 697207 | Environment: | |||||
| Last Closed: | 2017-12-06 10:48:29 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Bug Depends On: | 697207 | ||||||
| Bug Blocks: | 670971 | ||||||
| Attachments: |
|
||||||
|
Description
Matthew Mosesohn
2011-12-07 14:40:29 UTC
Can't really do anything about SELinux policy, sorry. Reassigning. This was added to selinux-policy in Fedora already in this change entry: * Tue Dec 21 2010 Miroslav Grepl <mgrepl> 3.9.12-1 - Update to upstream - Fixes for systemd policy - Fixes for passenger policy - Allow staff users to run mysqld in the staff_t domain, akonadi needs this - Add bin_t label for /usr/share/kde4/apps/kajongg/kajongg.py - auth_use_nsswitch does not need avahi to read passwords,needed for resolving data - Dontaudit (xdm_t) gok attempting to list contents of /var/account - Telepathy domains need to read urand - Need interface to getattr all file classes in a mock library for setroubleshoot Yes, we don't audit some gok accesses. But still this covers a behaviour so why gok is listing the contents of /var? > Yes, we don't audit some gok accesses. But still this covers a behaviour so why
> gok is listing the contents of /var?
David, any update?
Created attachment 566069 [details]
generated AVCs
Reproduced on my RHEL-6.3 virtual machine. # rpm -qa selinux-policy\* selinux-policy-3.7.19-137.el6.noarch selinux-policy-targeted-3.7.19-137.el6.noarch selinux-policy-minimum-3.7.19-137.el6.noarch selinux-policy-mls-3.7.19-137.el6.noarch selinux-policy-doc-3.7.19-137.el6.noarch # sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 24 Policy from config file: targeted # How to Reproduce: 1) boot into runlevel 5 2) switch to graphical screen where GDM is visible 3) open "Universal Access Preferences" window --> select "Use on-screen keyboard" --> click on "Close" 4) get rid of gok process 5) ausearch -m avc -m user_avc -m selinux_err -tc recent So the gok command is going out and randomly listing lots of directories? Looks like in Fedora we have allowed it to list all of these directories probably would have been better to dontaudit. files_dontaudit_list_non_security(xdm_t) This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux. Red Hat Enterprise Linux 6 is in the Production 3 Phase. During the Production 3 Phase, Critical impact Security Advisories (RHSAs) and selected Urgent Priority Bug Fix Advisories (RHBAs) may be released as they become available. The official life cycle policy can be reviewed here: http://redhat.com/rhel/lifecycle This issue does not meet the inclusion criteria for the Production 3 Phase and will be marked as CLOSED/WONTFIX. If this remains a critical requirement, please contact Red Hat Customer Support to request a re-evaluation of the issue, citing a clear business justification. Note that a strong business justification will be required for re-evaluation. Red Hat Customer Support can be contacted via the Red Hat Customer Portal at the following URL: https://access.redhat.com/ |