Bug 968975
| Summary: | avc: denied { setattr } for pid=4446 comm="gdm" name="gdm" dev="dm-1" | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Jaroslav Škarvada <jskarvad> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED NOTABUG | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.0 | CC: | jskarvad |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-05-30 21:29:19 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
What does # ls -dZ /var/gdm /var/lib/gdm ls -dZ /var/gdm /var/lib/gdm drwx--x--x. gdm gdm unconfined_u:object_r:var_t:s0 /var/gdm drwxrwx--T. gdm gdm system_u:object_r:xdm_var_lib_t:s0 /var/lib/gdm It was probably fixed by restorecon: # restorecon -v /var/gdm restorecon reset /var/gdm context unconfined_u:object_r:var_t:s0->unconfined_u:object_r:xserver_log_t:s0 Interesting that the autorelabel didn't fix it. I cannot reboot the machine now, but I will try to reboot it later (i.e. tmrw) to see whether the problem gone. It does seem to work after reboot. I have no idea how it got the wrong label. Closing, sorry for the false positive. |
Description of problem: When run gdm on the compose RHEL-7.0-20130529.n.1, the following AVC shows in the log (IIRC it repeats if gdm is restarted): May 30 12:13:46 dhcp-25-243 kernel: [ 1628.769135] type=1400 audit(1369908826.768:10): avc: denied { setattr } for pid=4446 comm="gdm" name="gdm" dev="dm-1" ino=137413002 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=dir May 30 12:14:41 dhcp-25-243 kernel: [ 1683.616987] type=1400 audit(1369908881.615:11): avc: denied { setattr } for pid=4738 comm="gdm" name="gdm" dev="dm-1" ino=137413002 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=dir It seems to be harmless. Version-Release number of selected component (if applicable): selinux-policy-3.12.1-46.el7.noarch How reproducible: Always Steps to Reproduce: 1. Set boot to graphical target 2. Try to login through gdm Actual results: Above mentioned AVC Expected results: No AVC Additional info: I tried to autorelabel the filesystem, but the problem persists.