Hide Forgot
Description of problem: SELinux is preventing /usr/sbin/userdel from 'rmdir' accesses on the directory minetest. ***** Plugin catchall_labels (83.8 confidence) suggests ******************* If you want to allow userdel to have rmdir access on the minetest directory Then you need to change the label on minetest Do # semanage fcontext -a -t FILE_TYPE 'minetest' where FILE_TYPE is one of the following: alsa_home_t, antivirus_home_t, audio_home_t, auth_home_t, cache_home_t, chrome_sandbox_home_t, config_home_t, data_home_t, dbus_home_t, fetchmail_home_t, gconf_home_t, git_user_content_t, gkeyringd_gnome_home_t, gnome_home_t, gpg_secret_t, gstreamer_home_t, home_bin_t, home_cert_t, httpd_user_content_t, httpd_user_htaccess_t, httpd_user_ra_content_t, httpd_user_rw_content_t, httpd_user_script_exec_t, icc_data_home_t, iceauth_home_t, irc_home_t, irc_tmp_t, irssi_home_t, kismet_home_t, krb5_home_t, local_login_home_t, mail_home_rw_t, mail_home_t, mail_spool_t, mandb_home_t, mozilla_home_t, mpd_home_t, mpd_user_data_t, mplayer_home_t, mysqld_home_t, openshift_cgroup_read_tmp_t, openshift_cron_tmp_t, openshift_rw_file_t, openshift_tmp_t, openshift_var_lib_t, polipo_cache_home_t, polipo_config_home_t, procmail_home_t, pulseaudio_home_t, rlogind_home_t, rssh_ro_t, rssh_rw_t, screen_home_t, selinux_config_t, selinux_login_config_t, semanage_store_t, semanage_tmp_t, smsd_var_lib_t, spamc_home_t, ssh_home_t, stapserver_var_lib_t, svirt_home_t, systemd_home_t, telepathy_cache_home_t, telepathy_data_home_t, telepathy_gabble_cache_home_t, telepathy_logger_cache_home_t, telepathy_logger_data_home_t, telepathy_mission_control_cache_home_t, telepathy_mission_control_data_home_t, telepathy_mission_control_home_t, telepathy_sunshine_home_t, thumb_home_t, tvtime_home_t, uml_ro_t, uml_rw_t, user_fonts_cache_t, user_fonts_config_t, user_fonts_t, user_home_dir_t, user_home_t, user_tmp_t, user_tmpfs_t, useradd_var_run_t, virt_content_t, virt_home_t, vmware_conf_t, vmware_file_t, wine_home_t, wireshark_home_t, xauth_home_t, xdm_home_t. Then execute: restorecon -v 'minetest' ***** Plugin catchall (17.1 confidence) suggests ************************** If you believe that userdel should be allowed rmdir access on the minetest directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep userdel /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023 Target Context system_u:object_r:var_lib_t:s0 Target Objects minetest [ dir ] Source userdel Source Path /usr/sbin/userdel Port <Unknown> Host (removed) Source RPM Packages shadow-utils-4.1.5.1-8.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-90.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.11.8-300.fc20.x86_64 #1 SMP Wed Nov 13 16:34:27 UTC 2013 x86_64 x86_64 Alert Count 1 First Seen 2013-11-25 19:14:53 MSK Last Seen 2013-11-25 19:14:53 MSK Local ID 27f77c97-dd7c-4f63-9d46-28cac73cebde Raw Audit Messages type=AVC msg=audit(1385392493.3:1140): avc: denied { rmdir } for pid=6933 comm="userdel" name="minetest" dev="dm-1" ino=1837163 scontext=unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir type=SYSCALL msg=audit(1385392493.3:1140): arch=x86_64 syscall=rmdir success=no exit=EACCES a0=7fb05b3165b0 a1=1 a2=54d0 a3=d items=0 ppid=6932 pid=6933 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=1 tty=pts0 comm=userdel exe=/usr/sbin/userdel subj=unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023 key=(null) Hash: userdel,useradd_t,var_lib_t,dir,rmdir Additional info: reporter: libreport-2.1.9 hashmarkername: setroubleshoot kernel: 3.11.8-300.fc20.x86_64 type: libreport
Where does the minetest package come from?
(In reply to Daniel Walsh from comment #1) > Where does the minetest package come from? This is my package (I'm maintainer of minetest). I've deleted minetest. After this, I've tried `userdel -r minetest` and got SELinux AVC
Did you just execute userdel from the command line or from an init script or from a post install of an RPM?
(In reply to Daniel Walsh from comment #3) > Did you just execute userdel from the command line or from an init script or > from a post install of an RPM? from terminal
home for minetest user is /var/lib/minetest My configuration: / on /dev/fedora_pc/root /home on /dev/fedora_pc/home
Please update to the latest policy yum -y update I believe this problem has been fixed.
(In reply to Daniel Walsh from comment #6) > Please update to the latest policy > > yum -y update > > I believe this problem has been fixed. I have updated packages ;) but after updating I've not rebooted. I will reboot soon and re-test
selinux-policy-3.12.1-105.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-105.fc20
Package selinux-policy-3.12.1-105.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-105.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-22285/selinux-policy-3.12.1-105.fc20 then log in and leave karma (feedback).
selinux-policy-3.12.1-105.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.