Bug 786059

Summary: SELinux is preventing /usr/libexec/kde4/ksysguardprocesslist_helper from 'read' accesses on the None Trolltech.conf.
Product: [Fedora] Fedora Reporter: Jerzy Spendel <jspendel>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED CANTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 16CC: dominick.grift, dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:7f351ecdcf69c592fce2b1a5fbab48fb0afe6ac4b30394629d406d2c4c85c63c
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-01-31 10:29:19 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Jerzy Spendel 2012-01-31 10:18:07 UTC
libreport version: 2.0.8
executable:     /usr/bin/python
hashmarkername: setroubleshoot
kernel:         3.1.0-7.fc16.x86_64
reason:         SELinux is preventing /usr/libexec/kde4/ksysguardprocesslist_helper from 'read' accesses on the None Trolltech.conf.
time:           Tue 31 Jan 2012 11:17:34 AM CET

description:
:SELinux is preventing /usr/libexec/kde4/ksysguardprocesslist_helper from 'read' accesses on the None Trolltech.conf.
:
:*****  Plugin catchall (100. confidence) suggests  ***************************
:
:If you believe that ksysguardprocesslist_helper should be allowed read access on the Trolltech.conf <Unknown> by default.
:Then you should report this as a bug.
:You can generate a local policy module to allow this access.
:Do
:allow this access for now by executing:
:# grep ksysguardproces /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context                system_u:system_r:gnomesystemmm_t:s0-s0:c0.c1023
:Target Context                system_u:object_r:etc_runtime_t:s0
:Target Objects                Trolltech.conf [ None ]
:Source                        ksysguardproces
:Source Path                   /usr/libexec/kde4/ksysguardprocesslist_helper
:Port                          <Unknown>
:Host                          (removed)
:Source RPM Packages           
:Target RPM Packages           
:Policy RPM                    <Unknown>
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed) 3.1.0-7.fc16.x86_64 #1 SMP Tue Nov 1
:                              21:10:48 UTC 2011 x86_64 x86_64
:Alert Count                   4
:First Seen                    Tue 31 Jan 2012 11:11:04 AM CET
:Last Seen                     Tue 31 Jan 2012 11:16:49 AM CET
:Local ID                      11ed0525-53d8-476f-8f3b-113d46abfac7
:
:Raw Audit Messages
:type=AVC msg=audit(1328005009.593:248): avc:  denied  { read } for  pid=2440 comm="ksysguardproces" name="Trolltech.conf" dev=sda5 ino=3014658 scontext=system_u:system_r:gnomesystemmm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_runtime_t:s0 tclass=filenode=(removed) type=SYSCALL msg=audit(1328005009.593:248): arch=c000003e syscall=2 success=no exit=-13 a0=d1c3e8 a1=80000 a2=1b6 a3=0 items=0 ppid=2439 pid=2440 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ksysguardproces" exe="/usr/libexec/kde4/ksysguardprocesslist_helper" subj=system_u:system_r:gnomesystemmm_t:s0-s0:c0.c1023 key=(null)
:
:
:Hash: ksysguardproces,gnomesystemmm_t,etc_runtime_t,None,read
:
:audit2allow
:
:
:audit2allow -R
:
:

Comment 1 Miroslav Grepl 2012-01-31 10:29:19 UTC
Could you try to execute

$ chcon -t bin_t /usr/libexec/kde4/ksysguardprocesslist_helper


and see if it works. If no, please reopen the bug. Thank you.


Should work. We have this label because of mislabeled "resolv.conf". But we have filename transition which should prevent this issue and because there is a bug in KDE I would make this change until KDE gets fix.