Bug 844494
| Summary: | SELinux is preventing /bin/bash from 'write' accesses on the directory ffgtk. | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Markus Schulze <ms> | ||||
| Component: | 0xFFFF | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 16 | CC: | dominick.grift, dwalsh, dwmw2, mgrepl | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | i686 | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | abrt_hash:8bf37488636d239fee5ebde273fd845845abacb4ac0802a8bd4cc1f2e2c7c9df | ||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2012-08-10 07:18:58 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Markus Schulze
2012-07-30 22:19:47 UTC
Created attachment 601347 [details]
File: description
Where is ffgtk-cups located? /usr/lib/cups/backend/ Does restorecon -R -v /var/lib/cups Do anything? Well, it seems so, but now another alert comes up:
SELinux is preventing /bin/bash from 'write' accesses on the directory /var/spool/ffgtk.
***** Plugin catchall (100. confidence) suggests ***************************
If sie denken, dass bash standardmässig erlaubt sein sollte, write Zugriff auf ffgtk directory zu erhalten.
Then sie sollten dies als Fehler melden.
Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen.
Do
zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen:
# grep ffgtk-cups /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context system_u:system_r:cupsd_t:s0-s0:c0.c1023
Target Context unconfined_u:object_r:var_spool_t:s0
Target Objects /var/spool/ffgtk [ dir ]
Source ffgtk-cups
Source Path /bin/bash
Port <Unbekannt>
Host (removed)
Source RPM Packages bash-4.2.28-1.fc16.i686
Target RPM Packages
Policy RPM selinux-policy-3.10.0-90.fc16.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name (removed)
Platform Linux (removed) 3.3.8-1.fc16.i686 #1 SMP
Mon Jun 4 21:30:50 UTC 2012 i686 i686
Alert Count 1
First Seen Di 31 Jul 2012 19:19:11 CEST
Last Seen Di 31 Jul 2012 19:19:11 CEST
Local ID bfc189cc-6b01-4ecc-857d-2b5b9957b7d4
Raw Audit Messages
type=AVC msg=audit(1343755151.421:161): avc: denied { write } for pid=17889 comm="ffgtk-cups" name="ffgtk" dev="dm-1" ino=542847 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_spool_t:s0 tclass=dir
type=SYSCALL msg=audit(1343755151.421:161): arch=i386 syscall=open success=no exit=EACCES a0=9e91aa0 a1=8241 a2=1b6 a3=0 items=0 ppid=17887 pid=17889 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm=ffgtk-cups exe=/bin/bash subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
Hash: ffgtk-cups,cupsd_t,var_spool_t,dir,write
audit2allow
Is there another restorecon needed on /var/spool/ffgtk ?
What does # rpm -qf /var/spool/ffgtk /var/spool/ffgtk is a directory I'll close this bug, because the problem is caused by changes made to ffgtk. They changed the way the fax printer is handled and the packet maintainer didn't include the changes yet. |