Description of problem: SELinux is preventing /usr/bin/vmware-user-suid-wrapper from 'execute_no_trans' accesses on the file . ***** Plugin catchall (100. confidence) suggests ************************** If sie denken, dass es vmware-user-suid-wrapper standardmässig erlaubt sein sollte, execute_no_trans Zugriff auf file zu erhalten. Then sie sollten dies als Fehler melden. Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen. Do zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen: # grep vmware-user-sui /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c 0.c1023 Target Context system_u:object_r:bin_t:s0 Target Objects [ file ] Source vmware-user-sui Source Path /usr/bin/vmware-user-suid-wrapper Port <Unknown> Host (removed) Source RPM Packages open-vm-tools-desktop-9.4.0-1.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-127.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.13.6-200.fc20.x86_64 #1 SMP Fri Mar 7 17:02:28 UTC 2014 x86_64 x86_64 Alert Count 1 First Seen 2014-03-13 09:54:14 CET Last Seen 2014-03-13 09:54:14 CET Local ID daa904e4-f70d-4c18-b78a-8dcefb771681 Raw Audit Messages type=AVC msg=audit(1394700854.405:373): avc: denied { execute_no_trans } for pid=1735 comm="vmware-user-sui" path="/usr/bin/vmtoolsd" dev="dm-1" ino=401136 scontext=unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file type=SYSCALL msg=audit(1394700854.405:373): arch=x86_64 syscall=execve success=no exit=EACCES a0=7fff74941f80 a1=7fff74941f40 a2=7fff749430b8 a3=14 items=0 ppid=1 pid=1735 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=1 tty=(none) comm=vmware-user-sui exe=/usr/bin/vmware-user-suid-wrapper subj=unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c0.c1023 key=(null) Hash: vmware-user-sui,vmtools_helper_t,bin_t,file,execute_no_trans Additional info: reporter: libreport-2.2.0 hashmarkername: setroubleshoot kernel: 3.13.6-200.fc20.x86_64 type: libreport
I got a similar error, only the 'execute' action was prevented, not 'execute_no_trans': SELinux is preventing /usr/bin/vmware-user-suid-wrapper from execute access on the file . ***** Plugin catchall (100. confidence) suggests ************************** If aby vmware-user-suid-wrapper powinno mieć domyślnie execute dostęp do file. Then proszę to zgłosić jako błąd. Można utworzyć lokalny moduł polityki, aby umożliwić ten dostęp. Do można tymczasowo zezwolić na ten dostęp wykonując polecenia: # grep vmware-user-sui /var/log/audit/audit.log | audit2allow -M mojapolityka # semodule -i mojapolityka.pp Additional Information: Source Context unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c 0.c1023 Target Context system_u:object_r:bin_t:s0 Target Objects [ file ] Source vmware-user-sui Source Path /usr/bin/vmware-user-suid-wrapper Port <Unknown> Host (...) Source RPM Packages open-vm-tools-desktop-9.4.0-1.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-127.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (...) Platform Linux (...) 3.13.6-200.fc20.x86_64 #1 SMP Fri Mar 7 17:02:28 UTC 2014 x86_64 x86_64 Alert Count 1 First Seen 2014-03-16 13:25:02 CET Last Seen 2014-03-16 13:25:02 CET Local ID 4a1d61e2-db88-48f0-9981-26dda4d633b4 Raw Audit Messages type=AVC msg=audit(1394972702.797:384): avc: denied { execute } for pid=1887 comm="vmware-user-sui" name="vmtoolsd" dev="dm-1" ino=1975021 scontext=unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file type=SYSCALL msg=audit(1394972702.797:384): arch=x86_64 syscall=execve success=no exit=EACCES a0=7fff73614ad0 a1=7fff73614a90 a2=7fff73615c08 a3=14 items=0 ppid=1 pid=1887 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=1 tty=(none) comm=vmware-user-sui exe=/usr/bin/vmware-user-suid-wrapper subj=unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c0.c1023 key=(null) Hash: vmware-user-sui,vmtools_helper_t,bin_t,file,execute
commit bf79f0cb2ec00444c981b078dcba5dfc9cc04871 fixes this in git.
Description of problem: This happens on start of GUI. Additional info: reporter: libreport-2.2.0 hashmarkername: setroubleshoot kernel: 3.13.6-200.fc20.x86_64 type: libreport
Description of problem: when logging in to Gnome this error occurs. Applying the suggested fix in SELinux Alert Browser does not fix the issue either. That is # grep vmware-user-sui /var/log/audit/audit.log | audit2allow -M mypol does not fix it. Additional info: reporter: libreport-2.2.0 hashmarkername: setroubleshoot kernel: 3.13.6-200.fc20.x86_64 type: libreport
Description of problem: Reboot, Login, SELinux notification appears every time... running 3.13.7-200.fc20.i686 .............From bug report 1057488------ Assigned to Miroslav Grepl Fedora Update System 2014-03-12 08:16:11 EDT selinux-policy-3.12.1-127.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. Status: ON_QA → CLOSED Fixed In Version: selinux-policy-3.12.1-122.fc20 → selinux-policy-3.12.1-127.fc20 Resolution: --- → ERRATA Last Closed: 2014-02-12 09:44:50 → 2014-03-12 08:16:11 ............................. SELinux is preventing /usr/bin/vmware-user-suid-wrapper from execute_no_trans access on the file . ***** Plugin catchall (100. confidence) suggests ************************** If you believe that vmware-user-suid-wrapper should be allowed execute_no_trans access on the file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep vmware-user-sui /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c 0.c1023 Target Context system_u:object_r:bin_t:s0 Target Objects [ file ] Source vmware-user-sui Source Path /usr/bin/vmware-user-suid-wrapper Port <Unknown> Host (removed) Source RPM Packages open-vm-tools-desktop-9.4.0-1.fc20.i686 Target RPM Packages Policy RPM selinux-policy-3.12.1-135.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux localhost.localdomain 3.13.7-200.fc20.i686+PAE #1 SMP Mon Mar 24 22:18:14 UTC 2014 i686 i686 Alert Count 1 First Seen 2014-03-28 16:42:43 EDT Last Seen 2014-03-28 16:42:43 EDT Local ID 0182960f-8105-4da5-b194-2f688c5d00a4 Raw Audit Messages type=AVC msg=audit(1396039363.879:359): avc: denied { execute_no_trans } for pid=1790 comm="vmware-user-sui" path="/usr/bin/vmtoolsd" dev="dm-1" ino=939207 scontext=unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file type=SYSCALL msg=audit(1396039363.879:359): arch=i386 syscall=execve success=no exit=EACCES a0=bfe9ef7c a1=bfe9ef5c a2=bfea005c a3=bfe9ef7c items=0 ppid=1 pid=1790 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=1 tty=(none) comm=vmware-user-sui exe=/usr/bin/vmware-user-suid-wrapper subj=unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c0.c1023 key=(null) Hash: vmware-user-sui,vmtools_helper_t,bin_t,file,execute_no_trans SELinux is preventing /usr/bin/vmware-user-suid-wrapper from execute_no_trans access on the file . Plugin: catchall you want to allow vmware-user-suid-wrapper to have execute_no_trans access on the fileIf you believe that vmware-user-suid-wrapper should be allowed execute_no_trans access on the file by default. You should report this as a bug. You can generate a local policy module to allow this access. Allow this access for now by executing: # grep vmware-user-sui /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional info: reporter: libreport-2.2.0 hashmarkername: setroubleshoot kernel: 3.13.7-200.fc20.i686+PAE type: libreport
#============= vmtools_helper_t ============== #!!!! This avc is allowed in the current policy allow vmtools_helper_t bin_t:file execute_no_trans;
selinux-policy-3.12.1-149.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-149.fc20
Package selinux-policy-3.12.1-149.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-149.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-4604/selinux-policy-3.12.1-149.fc20 then log in and leave karma (feedback).
selinux-policy-3.12.1-149.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.