Bug 963318
| Summary: | SELinux is preventing /usr/libexec/colord from 'read' accesses on the file /home/SECURITY/amy/.local/share/icc/edid-a99d98c760ecb11e07592f0536164edc.icc. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | David Spurek <dspurek> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 19 | CC: | deanhunter, dominick.grift, dwalsh, ebenes, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:48e53508c1185c43be4be978b5c509238f7058f376767991e057497ad776a80b | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-05-16 06:13:46 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
You have a labeling problem. Did you execute something like # semanage fcontext -a -e /home /home/SECURITY # restorecon -R -v /home I have this same problem when logging into an NFS server as a user whose home directory is mounted from the same server. I noticed that the SELinux boolean use_nfs_home_dirs is set off. I suspect that this is the immediate cause of the problem. However, I also noticed that the home directory file labels bear no resemblance to those of a local home directory. Is there information available on how to set the labels for NFS mounted home directories so that when NFS is enhanced to work with SELinux (in Fedora 20?) we will be ready? I think we will be discovering this together. How are the labels different? For the case of this error: [root@host ~]# ls -lZ /home/local/.local/share/icc -rw-rw-r--. local local unconfined_u:object_r:icc_data_home_t:s0 edid-b6c33574ee9f79890208c5c599c274b4.icc [root@host ~]# ls -lZ /home/net/dean/.local/share/icc -rw-rw-r--. dean dean system_u:object_r:home_root_t:s0 edid-a99d98c760ecb11e07592f0536164edc.icc -rw-rw-r--. dean dean system_u:object_r:user_home_t:s0 edid-b6c33574ee9f79890208c5c599c274b4.icc [root@host ~]# As I look at this, some of the problem may be because I did not understand, when I was first configuring the NFS home directories, that SELinux file context was not supported. I was trying anything I could think of to get it to work. Is there a mailing list or other forum I should be watching for the discovery of how to configure SELinux labels for NFS mounted home directories? # semanage fcontext -a -e /home /home/net # restorecon -R -v /home/net Should fix the local labels. The solution is actually: # semanage fcontext --add --equal /home /srv/nfs/home # restorecon -Rv /srv/nfs/home *** Bug 1099691 has been marked as a duplicate of this bug. *** |
Description of problem: GDM login with Active directory account cause this avc message SELinux is preventing /usr/libexec/colord from 'read' accesses on the file /home/SECURITY/amy/.local/share/icc/edid-a99d98c760ecb11e07592f0536164edc.icc. ***** Plugin restorecon (99.5 confidence) suggests ************************* If you want to fix the label. /home/SECURITY/amy/.local/share/icc/edid-a99d98c760ecb11e07592f0536164edc.icc default label should be user_home_t. Then you can run restorecon. Do # /sbin/restorecon -v /home/SECURITY/amy/.local/share/icc/edid-a99d98c760ecb11e07592f0536164edc.icc ***** Plugin catchall (1.49 confidence) suggests *************************** If you believe that colord should be allowed read access on the edid-a99d98c760ecb11e07592f0536164edc.icc file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep gdbus /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:colord_t:s0 Target Context unconfined_u:object_r:home_root_t:s0 Target Objects /home/SECURITY/amy/.local/share/icc/edid- a99d98c760ecb11e07592f0536164edc.icc [ file ] Source gdbus Source Path /usr/libexec/colord Port <Unknown> Host (removed) Source RPM Packages colord-0.1.34-1.fc19.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-44.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.9.0-301.fc19.x86_64 #1 SMP Mon Apr 29 13:44:05 UTC 2013 x86_64 x86_64 Alert Count 2 First Seen 2013-05-15 11:49:37 EDT Last Seen 2013-05-15 11:49:38 EDT Local ID f3019b47-cc7c-492c-b0cb-134c1ab7e1d6 Raw Audit Messages type=AVC msg=audit(1368632978.349:768): avc: denied { read } for pid=1154 comm="gdbus" path="/home/SECURITY/amy/.local/share/icc/edid-a99d98c760ecb11e07592f0536164edc.icc" dev="dm-1" ino=150234 scontext=system_u:system_r:colord_t:s0 tcontext=unconfined_u:object_r:home_root_t:s0 tclass=file type=SYSCALL msg=audit(1368632978.349:768): arch=x86_64 syscall=recvmsg success=yes exit=EBUSY a0=a a1=7f62f7940bb0 a2=40000000 a3=0 items=0 ppid=1 pid=1154 auid=4294967295 uid=997 gid=997 euid=997 suid=997 fsuid=997 egid=997 sgid=997 fsgid=997 ses=4294967295 tty=(none) comm=gdbus exe=/usr/libexec/colord subj=system_u:system_r:colord_t:s0 key=(null) Hash: gdbus,colord_t,home_root_t,file,read audit2allow #============= colord_t ============== allow colord_t home_root_t:file read; audit2allow -R require { type colord_t; } #============= colord_t ============== colord_dbus_chat(colord_t) Additional info: reporter: libreport-2.1.4 hashmarkername: setroubleshoot kernel: 3.9.0-301.fc19.x86_64 type: libreport Potential duplicate: bug 882343