Description of problem: SELinux is preventing /usr/libexec/cups-pk-helper-mechanism from 'read' accesses on the file tmpQ1BRQ4. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that cups-pk-helper-mechanism should be allowed read access on the tmpQ1BRQ4 file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep cups-pk-helper- /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:cupsd_config_t:s0-s0:c0.c1023 Target Context unconfined_u:object_r:user_home_t:s0 Target Objects tmpQ1BRQ4 [ file ] Source cups-pk-helper- Source Path /usr/libexec/cups-pk-helper-mechanism Port <Unknown> Host (removed) Source RPM Packages cups-pk-helper-0.2.4-2.fc19.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-74.9.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.11.4-201.fc19.x86_64 #1 SMP Thu Oct 10 14:11:18 UTC 2013 x86_64 x86_64 Alert Count 2 First Seen 2013-10-27 23:22:33 EDT Last Seen 2013-10-27 23:41:36 EDT Local ID d93e9e4b-5072-4f1e-b633-f97c786b8fc4 Raw Audit Messages type=AVC msg=audit(1382931696.13:1423): avc: denied { read } for pid=27998 comm="cups-pk-helper-" name="tmpQ1BRQ4" dev="dm-5" ino=181263 scontext=system_u:system_r:cupsd_config_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=SYSCALL msg=audit(1382931696.13:1423): arch=x86_64 syscall=open success=no exit=EACCES a0=23f1bd0 a1=0 a2=411588 a3=0 items=0 ppid=1 pid=27998 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=cups-pk-helper- exe=/usr/libexec/cups-pk-helper-mechanism subj=system_u:system_r:cupsd_config_t:s0-s0:c0.c1023 key=(null) Hash: cups-pk-helper-,cupsd_config_t,user_home_t,file,read Additional info: reporter: libreport-2.1.8 hashmarkername: setroubleshoot kernel: 3.11.4-201.fc19.x86_64 type: libreport Potential duplicate: bug 666185
Does bug 666185 look like the same problem to you?
It does look the same, yes. But I also do not have /tmp linked to my ~/tmp. I do have $TMPDIR set to ~/tmp though.
Description of problem: 1. Attempted to print from qpdfview (via cups), which failed. 2. SELinux detected an error. 3. Created a new local policy, per the error report. Note: there was also a failure to allow cups-pk-helper-mechanism to write to a temporary file. Additional info: reporter: libreport-2.1.8 hashmarkername: setroubleshoot kernel: 3.11.6-200.fc19.x86_64 type: libreport
(In reply to Dale Snell from comment #3) > 3. Created a new local policy, per the error report. Can you paste the commands you used to create the policy? Thanks!
Sure thing: "grep cups-pk-helper- /var/log/audit/audit.log | audit2allow -M local_cups_Policy". If it helps, my $TMPDIR is set to $HOME/.tmp.
Oops, forgot to add the second line: "semodule -i local_cups_Policy.pp"
So what was in local_cups_Policy.pp then? And/Or perhaps what was the output of: grep cups-pk-helper- /var/log/audit/audit.log
Okay, here you are, the output of grep cups-pk-helper- /var/log/audit/audit.log type=AVC msg=audit(1383246773.813:697): avc: denied { read } for pid=3297 comm="cups-pk-helper-" name="tmpK5Wgkz" dev="dm-8" ino=1477148 scontext=system_u:system_r:cupsd_config_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=SYSCALL msg=audit(1383246773.813:697): arch=c000003e syscall=2 success=no exit=-13 a0=f95910 a1=0 a2=ffffffffffffffff a3=3e2ee1b2e0 items=0 ppid=1 pid=3297 auid=4294967295 uid=0 gid=0 euid=1000 suid=0 fsuid=1000 egid=1000 sgid=0 fsgid=1000 ses=4294967295 tty=(none) comm="cups-pk-helper-" exe="/usr/libexec/cups-pk-helper-mechanism" subj=system_u:system_r:cupsd_config_t:s0-s0:c0.c1023 key=(null) Here are the contents of local_cups_Policy.te (.pp to follow as an attachment) module local_cups_Policy 1.0; require { type user_home_t; type cupsd_config_t; class file read; } #============= cupsd_config_t ============== allow cupsd_config_t user_home_t:file read;
Created attachment 818073 [details] The file /root/local_cups_Policy.pp
So, I got this one again. I don't think I really should need to have to create local policy. SELinux should have sufficient policy built-in to handle this.
You want me to allow a confined domain to read random content in users homedirectories? Because you changed where tmp content is stored?
(In reply to Daniel Walsh from comment #11) > You want me to allow a confined domain to read random content in users > homedirectories? I think you are putting words in my mouth. Of course I never suggested that entire home directories should be readible, but allowing access to ~/tmp is not any more unreasonable than allowing the same access in /tmp. > Because you changed where tmp content is stored? Yes. Because I don't want to have to manage consumption (by users) of my root filesystems. If they want to fill up their $HOME with files, temporary or otherwise, then that is their resource to do that with.
I have no problem labeling ~/tmp dirorectory as user_tmp_t, probably not a bad idea. Been a while since this bug was commented on.
3301303252216f80fb1dc2e7148c26507905a155 fixes this in git. Basically labels ~/.tmp and ~/tmp as user_tmp_t.
backported to F20,F19.
selinux-policy-3.12.1-74.30.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-74.30.fc19
Package selinux-policy-3.12.1-74.30.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-74.30.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-16276/selinux-policy-3.12.1-74.30.fc19 then log in and leave karma (feedback).
selinux-policy-3.12.1-74.30.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.