Bug 975853

Summary: SELinux is preventing /usr/bin/pkla-check-authorization from 'getattr' accesses on the filesystem /.
Product: [Fedora] Fedora Reporter: Jagabandhu Paul <bondhu.paul>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 19CC: dominick.grift, dwalsh, mgrepl, zalatik
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:1472cde562e1bfa621f8a8fb26c76dc3fb8e83b92c1341187501ff6bdfb29d8b
Fixed In Version: selinux-policy-3.12.1-54.fc19 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-06-23 02:27:50 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Jagabandhu Paul 2013-06-19 09:16:05 EDT
Description of problem:
SELinux is preventing /usr/bin/pkla-check-authorization from 'getattr' accesses on the filesystem /.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that pkla-check-authorization should be allowed getattr access on the  filesystem by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep pkla-check-auth /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:policykit_t:s0
Target Context                system_u:object_r:fs_t:s0
Target Objects                / [ filesystem ]
Source                        pkla-check-auth
Source Path                   /usr/bin/pkla-check-authorization
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           polkit-pkla-compat-0.1-2.fc19.x86_64
Target RPM Packages           filesystem-3.1-2.fc18.x86_64
                              filesystem-3.2-10.fc19.x86_64
Policy RPM                    selinux-policy-3.11.1-97.fc18.noarch selinux-
                              policy-3.12.1-52.fc19.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.9.5-201.fc18.x86_64 #1 SMP Tue
                              Jun 11 19:40:51 UTC 2013 x86_64 x86_64
Alert Count                   187
First Seen                    2013-06-19 18:43:58 IST
Last Seen                     2013-06-19 18:45:18 IST
Local ID                      dfd30cae-bc43-467f-be7c-a43945f51025

Raw Audit Messages
type=AVC msg=audit(1371647718.311:623): avc:  denied  { getattr } for  pid=17273 comm="pkla-check-auth" name="/" dev="dm-1" ino=2 scontext=system_u:system_r:policykit_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem


type=SYSCALL msg=audit(1371647718.311:623): arch=x86_64 syscall=statfs success=no exit=EACCES a0=7f42d31185d0 a1=7fff2b1d85b0 a2=7f42d3108f20 a3=7fff2b1d8370 items=0 ppid=655 pid=17273 auid=4294967295 uid=999 gid=999 euid=999 suid=999 fsuid=999 egid=999 sgid=999 fsgid=999 ses=4294967295 tty=(none) comm=pkla-check-auth exe=/usr/bin/pkla-check-authorization subj=system_u:system_r:policykit_t:s0 key=(null)

Hash: pkla-check-auth,policykit_t,fs_t,filesystem,getattr

audit2allow

#============= policykit_t ==============
allow policykit_t fs_t:filesystem getattr;

audit2allow -R
require {
	type policykit_t;
}

#============= policykit_t ==============
fs_getattr_xattr_fs(policykit_t)


Additional info:
reporter:       libreport-2.1.5
hashmarkername: setroubleshoot
kernel:         3.9.5-201.fc18.x86_64
type:           libreport
Comment 1 Daniel Walsh 2013-06-19 16:00:53 EDT
If you execute 

chcon -t policykit_auth_exec_t /usr/bin/pkla-check-authorization 

Does it work fine?
Comment 2 Daniel Walsh 2013-06-19 16:08:45 EDT
cf7a5e03ac6cbb7426db9915d7bfe64274d77627 adds this label in git.
Comment 3 Fedora Update System 2013-06-19 17:32:22 EDT
selinux-policy-3.12.1-54.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-54.fc19
Comment 4 Fedora Update System 2013-06-20 14:02:45 EDT
Package selinux-policy-3.12.1-54.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-54.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-11355/selinux-policy-3.12.1-54.fc19
then log in and leave karma (feedback).
Comment 5 Maxim 2013-06-22 19:35:13 EDT
Description of problem:
upgrade to fedora 19

Additional info:
reporter:       libreport-2.1.5
hashmarkername: setroubleshoot
kernel:         3.9.6-200.fc18.x86_64
type:           libreport
Comment 6 Fedora Update System 2013-06-23 02:27:50 EDT
selinux-policy-3.12.1-54.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.