Bug 1075945 - SELinux is preventing /usr/bin/vmware-user-suid-wrapper from 'execute_no_trans' accesses on the file .
Summary: SELinux is preventing /usr/bin/vmware-user-suid-wrapper from 'execute_no_tran...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 20
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:e18e5cf55ca8c76ae549ea9af6e...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-03-13 09:10 UTC by Joerg Hendricks
Modified: 2014-04-10 08:01 UTC (History)
7 users (show)

Fixed In Version: selinux-policy-3.12.1-149.fc20
Clone Of:
Environment:
Last Closed: 2014-04-09 13:21:55 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Joerg Hendricks 2014-03-13 09:10:01 UTC
Description of problem:
SELinux is preventing /usr/bin/vmware-user-suid-wrapper from 'execute_no_trans' accesses on the file .

*****  Plugin catchall (100. confidence) suggests   **************************

If sie denken, dass es vmware-user-suid-wrapper standardmässig erlaubt sein sollte, execute_no_trans Zugriff auf  file zu erhalten.
Then sie sollten dies als Fehler melden.
Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen.
Do
zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen:
# grep vmware-user-sui /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c
                              0.c1023
Target Context                system_u:object_r:bin_t:s0
Target Objects                 [ file ]
Source                        vmware-user-sui
Source Path                   /usr/bin/vmware-user-suid-wrapper
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           open-vm-tools-desktop-9.4.0-1.fc20.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-127.fc20.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.13.6-200.fc20.x86_64 #1 SMP Fri
                              Mar 7 17:02:28 UTC 2014 x86_64 x86_64
Alert Count                   1
First Seen                    2014-03-13 09:54:14 CET
Last Seen                     2014-03-13 09:54:14 CET
Local ID                      daa904e4-f70d-4c18-b78a-8dcefb771681

Raw Audit Messages
type=AVC msg=audit(1394700854.405:373): avc:  denied  { execute_no_trans } for  pid=1735 comm="vmware-user-sui" path="/usr/bin/vmtoolsd" dev="dm-1" ino=401136 scontext=unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file


type=SYSCALL msg=audit(1394700854.405:373): arch=x86_64 syscall=execve success=no exit=EACCES a0=7fff74941f80 a1=7fff74941f40 a2=7fff749430b8 a3=14 items=0 ppid=1 pid=1735 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=1 tty=(none) comm=vmware-user-sui exe=/usr/bin/vmware-user-suid-wrapper subj=unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c0.c1023 key=(null)

Hash: vmware-user-sui,vmtools_helper_t,bin_t,file,execute_no_trans

Additional info:
reporter:       libreport-2.2.0
hashmarkername: setroubleshoot
kernel:         3.13.6-200.fc20.x86_64
type:           libreport

Comment 1 gaazkam 2014-03-16 13:30:04 UTC
I got a similar error, only the 'execute' action was prevented, not 'execute_no_trans':

SELinux is preventing /usr/bin/vmware-user-suid-wrapper from execute access on the file .

*****  Plugin catchall (100. confidence) suggests   **************************

If aby vmware-user-suid-wrapper powinno mieć domyślnie execute dostęp do  file.
Then proszę to zgłosić jako błąd.
Można utworzyć lokalny moduł polityki, aby umożliwić ten dostęp.
Do
można tymczasowo zezwolić na ten dostęp wykonując polecenia:
# grep vmware-user-sui /var/log/audit/audit.log | audit2allow -M mojapolityka
# semodule -i mojapolityka.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c
                              0.c1023
Target Context                system_u:object_r:bin_t:s0
Target Objects                 [ file ]
Source                        vmware-user-sui
Source Path                   /usr/bin/vmware-user-suid-wrapper
Port                          <Unknown>
Host                          (...)
Source RPM Packages           open-vm-tools-desktop-9.4.0-1.fc20.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-127.fc20.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (...)
Platform                      Linux (...) 3.13.6-200.fc20.x86_64 #1 SMP Fri
                              Mar 7 17:02:28 UTC 2014 x86_64 x86_64
Alert Count                   1
First Seen                    2014-03-16 13:25:02 CET
Last Seen                     2014-03-16 13:25:02 CET
Local ID                      4a1d61e2-db88-48f0-9981-26dda4d633b4

Raw Audit Messages
type=AVC msg=audit(1394972702.797:384): avc:  denied  { execute } for  pid=1887 comm="vmware-user-sui" name="vmtoolsd" dev="dm-1" ino=1975021 scontext=unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file


type=SYSCALL msg=audit(1394972702.797:384): arch=x86_64 syscall=execve success=no exit=EACCES a0=7fff73614ad0 a1=7fff73614a90 a2=7fff73615c08 a3=14 items=0 ppid=1 pid=1887 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=1 tty=(none) comm=vmware-user-sui exe=/usr/bin/vmware-user-suid-wrapper subj=unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c0.c1023 key=(null)

Hash: vmware-user-sui,vmtools_helper_t,bin_t,file,execute

Comment 3 Daniel Walsh 2014-03-16 21:55:31 UTC
commit bf79f0cb2ec00444c981b078dcba5dfc9cc04871
 fixes this in git.

Comment 5 Tony Grimes 2014-03-21 12:13:50 UTC
Description of problem:
This happens on start of GUI.

Additional info:
reporter:       libreport-2.2.0
hashmarkername: setroubleshoot
kernel:         3.13.6-200.fc20.x86_64
type:           libreport

Comment 6 Sean Beeson 2014-03-25 04:48:23 UTC
Description of problem:
when logging in to Gnome this error occurs. Applying the suggested fix in SELinux Alert Browser does not fix the issue either. That is # grep vmware-user-sui /var/log/audit/audit.log | audit2allow -M mypol does not fix it. 

Additional info:
reporter:       libreport-2.2.0
hashmarkername: setroubleshoot
kernel:         3.13.6-200.fc20.x86_64
type:           libreport

Comment 7 sugarspoon8 2014-03-28 20:54:51 UTC
Description of problem:
Reboot, Login, SELinux notification appears every time...

running 3.13.7-200.fc20.i686

.............From bug report  1057488------
Assigned to Miroslav Grepl
 Fedora Update System 2014-03-12 08:16:11 EDT

selinux-policy-3.12.1-127.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Status: ON_QA → CLOSED
Fixed In Version: selinux-policy-3.12.1-122.fc20 → selinux-policy-3.12.1-127.fc20
Resolution: --- → ERRATA
Last Closed: 2014-02-12 09:44:50 → 2014-03-12 08:16:11
.............................


SELinux is preventing /usr/bin/vmware-user-suid-wrapper from execute_no_trans access on the file .

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that vmware-user-suid-wrapper should be allowed execute_no_trans access on the  file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep vmware-user-sui /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c
                              0.c1023
Target Context                system_u:object_r:bin_t:s0
Target Objects                 [ file ]
Source                        vmware-user-sui
Source Path                   /usr/bin/vmware-user-suid-wrapper
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           open-vm-tools-desktop-9.4.0-1.fc20.i686
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-135.fc20.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux localhost.localdomain
                              3.13.7-200.fc20.i686+PAE #1 SMP Mon Mar 24
                              22:18:14 UTC 2014 i686 i686
Alert Count                   1
First Seen                    2014-03-28 16:42:43 EDT
Last Seen                     2014-03-28 16:42:43 EDT
Local ID                      0182960f-8105-4da5-b194-2f688c5d00a4

Raw Audit Messages
type=AVC msg=audit(1396039363.879:359): avc:  denied  { execute_no_trans } for  pid=1790 comm="vmware-user-sui" path="/usr/bin/vmtoolsd" dev="dm-1" ino=939207 scontext=unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file


type=SYSCALL msg=audit(1396039363.879:359): arch=i386 syscall=execve success=no exit=EACCES a0=bfe9ef7c a1=bfe9ef5c a2=bfea005c a3=bfe9ef7c items=0 ppid=1 pid=1790 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=1 tty=(none) comm=vmware-user-sui exe=/usr/bin/vmware-user-suid-wrapper subj=unconfined_u:unconfined_r:vmtools_helper_t:s0-s0:c0.c1023 key=(null)

Hash: vmware-user-sui,vmtools_helper_t,bin_t,file,execute_no_trans

SELinux is preventing /usr/bin/vmware-user-suid-wrapper from execute_no_trans access on the file .

Plugin: catchall 
you want to allow vmware-user-suid-wrapper to have execute_no_trans access on
the fileIf you believe that vmware-user-suid-wrapper should be allowed execute_no_trans access on the  file by default.
You should report this as a bug.
You can generate a local policy module to allow this access.
Allow this access for now by executing:
# grep vmware-user-sui /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


Additional info:
reporter:       libreport-2.2.0
hashmarkername: setroubleshoot
kernel:         3.13.7-200.fc20.i686+PAE
type:           libreport

Comment 8 Miroslav Grepl 2014-03-31 07:43:28 UTC
#============= vmtools_helper_t ==============

#!!!! This avc is allowed in the current policy
allow vmtools_helper_t bin_t:file execute_no_trans;

Comment 9 Fedora Update System 2014-03-31 14:05:25 UTC
selinux-policy-3.12.1-149.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-149.fc20

Comment 10 Fedora Update System 2014-04-02 09:03:34 UTC
Package selinux-policy-3.12.1-149.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-149.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-4604/selinux-policy-3.12.1-149.fc20
then log in and leave karma (feedback).

Comment 11 Fedora Update System 2014-04-09 13:21:55 UTC
selinux-policy-3.12.1-149.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.