Bug 825564
| Summary: | SELinux is preventing /usr/lib/systemd/systemd-logind from 'read' accesses on the directory uaccess. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Giovanni Campagna <scampa.giovanni> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rawhide | CC: | dominick.grift, dwalsh, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:607976b92aa9b20792615dbec3fc10961f475f228bfbfcad166b52deffe199a9 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-05-29 15:33:26 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
What is a path to the "uacces" directory? Either you will need to add or restore labeling. I would figure this is caused by systemd-udev being mislabeled. /run/udev/tags/uaccess Fixed in selinux-policy-3.10.0-127.fc17 |
libreport version: 2.0.10 executable: /usr/bin/python2.7 hashmarkername: setroubleshoot kernel: 3.5.0-0.rc0.git7.1.fc18.x86_64 time: dom 27 mag 2012 16:56:01 EDT description: :SELinux is preventing /usr/lib/systemd/systemd-logind from 'read' accesses on the directory uaccess. : :***** Plugin catchall_labels (83.8 confidence) suggests ******************** : :If you want to allow systemd-logind to have read access on the uaccess directory :Then e' necessario modificare l'etichetta su uaccess :Do :# semanage fcontext -a -t TIPO_FILE 'uaccess' :dove TIPO_FILE è uno dei seguenti: auditadm_usertype, config_home_t, sysctl_crypto_t, polydomain, systemd_logind_t, user_tmp_t, remote_login_t, udev_rules_t, secadm_su_t, postgresql_t, dbusd_etc_t, device_t, abrt_t, etc_t, lib_t, root_t, saslauthd_t, usr_t, rhev_agentd_consolehelper_t, newrole_t, openvpn_t, dbadm_usertype, logadm_usertype, secadm_usertype, sysadm_usertype, webadm_usertype, rlogind_t, unconfined_usertype, local_login_t, domain, init_var_run_t, net_conf_t, udev_var_run_t, textrel_shlib_t, system_cronjob_t, systemd_logind_var_run_t, user_usertype, staff_consolehelper_t, systemd_logind_sessions_t, keystone_t, staff_usertype, sysadm_su_t, var_run_t, auditadm_su_t, guest_usertype, xguest_usertype, cgroup_t, dirsrv_t, device_t, initrc_t, locale_t, passwd_t, var_auth_t, racoon_t, cert_t, chfn_t, crond_t, ftpd_t, etc_t, etc_t, proc_t, sysfs_t, rshd_t, xdm_t, sshd_t, nscd_var_run_t. :Quindi eseguire: :restorecon -v 'uaccess' : : :***** Plugin catchall (17.1 confidence) suggests *************************** : :If si crede che systemd-logind dovrebbe avere possibilità di accesso read sui uaccess directory in modo predefinito. :Then si dovrebbe riportare il problema come bug. :E' possibile generare un modulo di politica locale per consentire questo accesso. :Do :consentire questo accesso per il momento eseguendo: :# grep systemd-logind /var/log/audit/audit.log | audit2allow -M mypol :# semodule -i mypol.pp : :Additional Information: :Source Context system_u:system_r:systemd_logind_t:s0 :Target Context system_u:object_r:default_t:s0 :Target Objects uaccess [ dir ] :Source systemd-logind :Source Path /usr/lib/systemd/systemd-logind :Port <Sconosciuto> :Host (removed) :Source RPM Packages :Target RPM Packages :Policy RPM selinux-policy-3.10.0-121.fc17.noarch :Selinux Enabled True :Policy Type targeted :Enforcing Mode Enforcing :Host Name (removed) :Platform Linux (removed) : 3.5.0-0.rc0.git7.1.fc18.x86_64 #1 SMP Fri May 25 : 15:20:30 UTC 2012 x86_64 x86_64 :Alert Count 8 :First Seen dom 27 mag 2012 16:45:18 EDT :Last Seen dom 27 mag 2012 16:51:31 EDT :Local ID f3ba9c9c-70c7-4d86-b97a-899f63547951 : :Raw Audit Messages :type=AVC msg=audit(1338151891.187:53): avc: denied { read } for pid=449 comm="systemd-logind" name="uaccess" dev="tmpfs" ino=8906 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir : : :Hash: systemd-logind,systemd_logind_t,default_t,dir,read : :audit2allow : :#============= systemd_logind_t ============== :allow systemd_logind_t default_t:dir read; : :audit2allow -R : :#============= systemd_logind_t ============== :allow systemd_logind_t default_t:dir read; : :