Bug 844430
Summary: | SELinux is preventing /usr/libexec/colord-sane from 'read' accesses on the file interpreter. | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Frank Büttner <bugzilla> |
Component: | colord | Assignee: | Richard Hughes <hughsient> |
Status: | CLOSED WORKSFORME | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | unspecified | Docs Contact: | |
Priority: | unspecified | ||
Version: | 17 | CC: | bugzilla, dominick.grift, dwalsh, hughsient, mgrepl, rhughes, robert.l.kief |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | x86_64 | ||
OS: | Unspecified | ||
Whiteboard: | abrt_hash:99b59b81c789bec1df43d749a6fdef7c481eb00f991583c1f25f0a426715eb32 | ||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2013-04-24 11:22:26 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Frank Büttner
2012-07-30 15:24:11 UTC
I thought we dropped colord-sane? (In reply to comment #1) > I thought we dropped colord-sane? No, I'm waiting for the new sane-backends so I can just use udev. Hopefully soon. Frank, could you execute # semanage permissive -a colord_t re-test it and attach your output of # ausearch -m avc -ts recent Thank you. Here the output: ausearch -m avc -ts recent system_r:colord_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=file [root@bart ~]# ausearch -m avc -ts recent ---- time->Tue Sep 11 17:30:23 2012 type=SYSCALL msg=audit(1347377423.292:131): arch=c000003e syscall=2 success=yes exit=8 a0=7fff63d5b390 a1=0 a2=1b6 a3=238 items=0 ppid=1 pid=3231 auid=4294967295 uid=996 gid=995 euid=996 suid=996 fsuid=996 egid=995 sgid=995 fsgid=995 tty=(none) ses=4294967295 comm="colord-sane" exe="/usr/libexec/colord-sane" subj=system_u:system_r:colord_t:s0 key=(null) type=AVC msg=audit(1347377423.292:131): avc: denied { open } for pid=3231 comm="colord-sane" path="/var/lib/iscan/interpreter" dev="dm-1" ino=88736293 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=file type=AVC msg=audit(1347377423.292:131): avc: denied { read } for pid=3231 comm="colord-sane" name="interpreter" dev="dm-1" ino=88736293 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=file ---- time->Tue Sep 11 17:30:23 2012 type=SYSCALL msg=audit(1347377423.292:132): arch=c000003e syscall=5 success=yes exit=0 a0=8 a1=7fff63d5c220 a2=7fff63d5c220 a3=78 items=0 ppid=1 pid=3231 auid=4294967295 uid=996 gid=995 euid=996 suid=996 fsuid=996 egid=995 sgid=995 fsgid=995 tty=(none) ses=4294967295 comm="colord-sane" exe="/usr/libexec/colord-sane" subj=system_u:system_r:colord_t:s0 key=(null) type=AVC msg=audit(1347377423.292:132): avc: denied { getattr } for pid=3231 comm="colord-sane" path="/var/lib/iscan/interpreter" dev="dm-1" ino=88736293 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=file The SELinux error icon appears after a restart. Package: (null) OS Release: Fedora release 17 (Beefy Miracle) *** Bug 879689 has been marked as a duplicate of this bug. *** On F18 this file should have this label. matchpathcon /var/lib/iscan/interprete /var/lib/iscan/interprete system_u:object_r:cupsd_rw_etc_t:s0 And colord is allowed to read it. |