Bug 827712
| Summary: | SELinux is preventing /usr/bin/totem-video-thumbnailer from 'execute' accesses on the file /run/user/dario/.orc/orcexec.iMG9e3 (deleted). | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Dario Castellarin <req1348> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 17 | CC: | belegdol, dominick.grift, dwalsh, fedoraproject, jantho, jmcdermottjr, jonasfust, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:9f438163b0bf01631d266866e0be952c1dc6881f8c07948d970cc9da07193bc0 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-06-17 00:01:25 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** Bug 827697 has been marked as a duplicate of this bug. *** Fixed in selinux-policy-3.10.0-129.fc17 The problem still persists with selinux-policy-3.10.0-129.fc17.noarch I apologize, this is a merge issue. Re-fixing in selinux-policy-3.10.0-130.fc17.noarch selinux-policy-3.10.0-130.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-130.fc17 Package selinux-policy-3.10.0-130.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-130.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-9520/selinux-policy-3.10.0-130.fc17 then log in and leave karma (feedback). selinux-policy-3.10.0-130.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report. Problem still seems to exist with selinux-policy-3.10.0-132.fc17 sesearch -A -s thumb_t -t gstreamer_home_t -p execute
Found 1 semantic av rules:
allow thumb_t gstreamer_home_t : file { ioctl read write create getattr setattr lock append unlink link rename execute execute_no_trans open } ;
What AVC msgs are you getting? Sorry for the delay in response I have not been around to gather the info:
I am assuming you are looking for this:
type=AVC msg=audit(1340338620.984:87): avc: denied { execute } for pid=2182 comm="multiqueue0:src" path=2F686F6D652F6A616D65732F2E6F72632F6F7263657865632E4D7642683474202864656C6574656429 dev="sda3" ino=655907 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:gstreamer_home_t:s0 tclass=file
This is different. It looks like you are correct the avc message is different. Sorry about that. Its odd fedora's bug report util brought me here. Miroslav, I keep thinking we should label this .orc directory differently since we really do not want to allow apps like thumb drives and mozilla plugins to execute all the gstreamer homedir content, but then again does this really add any security. |
libreport version: 2.0.10 executable: /usr/bin/python2.7 hashmarkername: setroubleshoot kernel: 3.3.7-3.fc17.x86_64 time: sab 02 giu 2012 17:45:41 CEST description: :SELinux is preventing /usr/bin/totem-video-thumbnailer from 'execute' accesses on the file /run/user/dario/.orc/orcexec.iMG9e3 (deleted). : :***** Plugin catchall (100. confidence) suggests *************************** : :If si crede che totem-video-thumbnailer dovrebbe avere possibilità di accesso execute sui orcexec.iMG9e3 (deleted) file in modo predefinito. :Then si dovrebbe riportare il problema come bug. :E' possibile generare un modulo di politica locale per consentire questo accesso. :Do :consentire questo accesso per il momento eseguendo: :# grep multiqueue0:src /var/log/audit/audit.log | audit2allow -M mypol :# semodule -i mypol.pp : :Additional Information: :Source Context unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 :Target Context unconfined_u:object_r:gstreamer_home_t:s0 :Target Objects /run/user/dario/.orc/orcexec.iMG9e3 (deleted) [ : file ] :Source multiqueue0:src :Source Path /usr/bin/totem-video-thumbnailer :Port <Sconosciuto> :Host (removed) :Source RPM Packages totem-3.4.2-1.fc17.x86_64 :Target RPM Packages :Policy RPM selinux-policy-3.10.0-128.fc17.noarch :Selinux Enabled True :Policy Type targeted :Enforcing Mode Permissive :Host Name (removed) :Platform Linux (removed) 3.3.7-3.fc17.x86_64 #1 SMP Thu : May 31 21:19:46 UTC 2012 x86_64 x86_64 :Alert Count 1 :First Seen sab 02 giu 2012 17:45:01 CEST :Last Seen sab 02 giu 2012 17:45:01 CEST :Local ID b0dc9f96-de3b-4bd3-a704-ab82ae11a64d : :Raw Audit Messages :type=AVC msg=audit(1338651901.74:96): avc: denied { execute } for pid=16952 comm="multiqueue0:src" path=2F72756E2F757365722F646172696F2F2E6F72632F6F7263657865632E694D47396533202864656C6574656429 dev="tmpfs" ino=829419 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:gstreamer_home_t:s0 tclass=file : : :type=SYSCALL msg=audit(1338651901.74:96): arch=x86_64 syscall=mmap success=yes exit=139634002395136 a0=0 a1=10000 a2=5 a3=1 items=0 ppid=16925 pid=16952 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=2 comm=multiqueue0:src exe=/usr/bin/totem-video-thumbnailer subj=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 key=(null) : :Hash: multiqueue0:src,thumb_t,gstreamer_home_t,file,execute : :audit2allowunable to open /sys/fs/selinux/policy: Permission denied : : :audit2allow -Runable to open /sys/fs/selinux/policy: Permission denied : :