Bug 1078983
| Summary: | /tmp/.X11-unix selinux file context wrong when Xvfb runs before Xorg | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Andreas Luik <andreas.luik> | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED CANTFIX | QA Contact: | Milos Malik <mmalik> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 6.5 | CC: | andreas.luik, dwalsh, mmalik | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2015-02-25 12:31:17 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Andreas Luik
2014-03-20 16:55:02 UTC
What AVC are you getting with [root@laptest tmp]# ls -dZ /tmp/.X11-unix drwxrwxrwt. root root unconfined_u:object_r:user_tmp_t:s0 /tmp/.X11-unix ? The problem is we are not able to set the correct labeling in RHEL6 if you run it as a user. (In reply to Miroslav Grepl from comment #2) When the wrong settings are in effect: No AVCs are reported with the default settings. With "semodule -DB" enabled, a lot of AVCs are reported when logging in, I've added an attachment. I think the relevant ones are: type=AVC msg=audit(1395676556.665:88): avc: denied { rlimitinh } for pid=3221 comm="udisks-daemon" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:devicekit_disk_t:s0-s0:c0.c1023 tclass=process type=AVC msg=audit(1395676556.665:88): avc: denied { siginh } for pid=3221 comm="udisks-daemon" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:devicekit_disk_t:s0-s0:c0.c1023 tclass=process type=AVC msg=audit(1395676556.665:88): avc: denied { noatsecure } for pid=3221 comm="udisks-daemon" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:devicekit_disk_t:s0-s0:c0.c1023 tclass=process type=AVC msg=audit(1395676556.906:89): avc: denied { rlimitinh } for pid=3358 comm="packagekitd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0-s0:c0.c1023 tclass=process type=AVC msg=audit(1395676556.906:89): avc: denied { siginh } for pid=3358 comm="packagekitd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0-s0:c0.c1023 tclass=process type=AVC msg=audit(1395676556.906:89): avc: denied { noatsecure } for pid=3358 comm="packagekitd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0-s0:c0.c1023 tclass=process Anyways, I think it is not possible to fix this problem by SElinux policies. The wrong file context of /tmp/.X11-unix must be prevented/fixed somehow. Please have a look at https://bugzilla.redhat.com/show_bug.cgi?id=499183 especially comments 22 and 23. Created attachment 878129 [details] audit.log AVCs as described in comment #3 (In reply to Miroslav Grepl from comment #2) > The problem is we are not able to set the correct labeling in RHEL6 if you > run it as a user. Additional information: Xvfb does also not set the correct context for /tmp/.X11-unix if started by "root". I have now implemented the following workaround, which avoids the problem: create the directory with the correct file context before starting Xvfb: mkdir -m 1777 /tmp/.X11-unix test -x /sbin/restorecon && /sbin/restorecon /tmp/.X11-unix su nobody -s /bin/sh -c '/usr/bin/Xvfb :9 -screen 0 640x480x24 -dpi 100 -ac -s 0' We will need to go with this workaround in RHEL6. |