Bug 1173477 - SELinux is preventing /usr/bin/bash from execute_no_trans access on the file /usr/lib64/ld-2.17.so.
Summary: SELinux is preventing /usr/bin/bash from execute_no_trans access on the file ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: icecream
Version: 19
Hardware: Unspecified
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Michal Schmidt
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 1173522 1173523 1173525 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-12-12 08:52 UTC by Slawomir Czarko
Modified: 2015-01-03 19:10 UTC (History)
1 user (show)

Fixed In Version: icecream-1.0.1-11.20140822git.fc19
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-01-03 18:58:46 UTC


Attachments (Terms of Use)

Description Slawomir Czarko 2014-12-12 08:52:31 UTC
SELinux is preventing /usr/bin/bash from execute_no_trans access on the file /usr/lib64/ld-2.17.so.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that bash should be allowed execute_no_trans access on the ld-2.17.so file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep ldd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:iceccd_t:s0
Target Context                system_u:object_r:ld_so_t:s0
Target Objects                /usr/lib64/ld-2.17.so [ file ]
Source                        ldd
Source Path                   /usr/bin/bash
Port                          <Unknown>
Host                          researchpc2.ezono.net
Source RPM Packages           bash-4.2.53-1.fc19.x86_64
Target RPM Packages           glibc-2.17-21.fc19.x86_64
Policy RPM                    selinux-policy-3.12.1-74.26.fc19.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     researchpc2.ezono.net
Platform                      Linux researchpc2.ezono.net
                              3.14.23-100.fc19.x86_64 #1 SMP Thu Oct 30 18:36:00
                              UTC 2014 x86_64 x86_64
Alert Count                   1
First Seen                    2014-12-12 09:43:26 CET
Last Seen                     2014-12-12 09:43:26 CET
Local ID                      b0789ff5-ddd2-4c1c-99b3-913daaba81f8

Raw Audit Messages
type=AVC msg=audit(1418373806.457:1263): avc:  denied  { execute_no_trans } for  pid=9223 comm="ldd" path="/usr/lib64/ld-2.17.so" dev="dm-0" ino=393232 scontext=system_u:system_r:iceccd_t:s0 tcontext=system_u:object_r:ld_so_t:s0 tclass=file


type=SYSCALL msg=audit(1418373806.457:1263): arch=x86_64 syscall=execve success=no exit=EACCES a0=b060d0 a1=b06130 a2=b0f230 a3=8 items=0 ppid=9221 pid=9223 auid=4294967295 uid=990 gid=987 euid=990 suid=990 fsuid=990 egid=987 sgid=987 fsgid=987 tty=(none) ses=4294967295 comm=ldd exe=/usr/bin/bash subj=system_u:system_r:iceccd_t:s0 key=(null)

Hash: ldd,iceccd_t,ld_so_t,file,execute_no_trans

Comment 1 Michal Schmidt 2014-12-12 12:12:14 UTC
Did this start appearing recently after updating the icecream package? What version of icecream is this?

When does this appear? During iceccd startup? Or when trying to build a project using iceccd? Or when iceccd processes build requests from other machines?

Comment 2 Michal Schmidt 2014-12-12 12:23:45 UTC
I see comm is "ldd". Only icecc-create-env should run ldd. But that's supposed to run under context iceccd_createenv_t, not iceccd_t.

The problem is icecc-create-env was moved from /usr/libexec to /usr/bin, but the policy was not changed and the script is now mislabeled. I'll fix this.

Comment 3 Slawomir Czarko 2014-12-12 12:31:23 UTC
Yes, it started happening recently, maybe few weeks ago.

icecream-1.0.1-9.20140822git.fc19.x86_64

It happens first time I run g++ for a local build. After that it won't happen until system is rebooted.

Comment 4 Michal Schmidt 2014-12-12 13:12:53 UTC
*** Bug 1173522 has been marked as a duplicate of this bug. ***

Comment 5 Michal Schmidt 2014-12-12 13:13:24 UTC
*** Bug 1173523 has been marked as a duplicate of this bug. ***

Comment 6 Michal Schmidt 2014-12-12 13:13:26 UTC
*** Bug 1173525 has been marked as a duplicate of this bug. ***

Comment 7 Michal Schmidt 2014-12-12 13:40:39 UTC
Now building:
http://koji.fedoraproject.org/koji/taskinfo?taskID=8360065

Comment 8 Slawomir Czarko 2014-12-12 13:52:09 UTC
Installing the 64-bit RPM from koji (comment 7) results in another SELinux message.

SELinux is preventing /usr/bin/bash from read access on the file meminfo.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that bash should be allowed read access on the meminfo file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep icecc-scheduler /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:icecc_scheduler_t:s0
Target Context                system_u:object_r:proc_t:s0
Target Objects                meminfo [ file ]
Source                        icecc-scheduler
Source Path                   /usr/bin/bash
Port                          <Unknown>
Host                          gaia.garous.net
Source RPM Packages           bash-4.2.53-1.fc19.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-74.26.fc19.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     gaia.garous.net
Platform                      Linux gaia.garous.net 3.14.23-100.fc19.x86_64 #1
                              SMP Thu Oct 30 18:36:00 UTC 2014 x86_64 x86_64
Alert Count                   1
First Seen                    2014-12-12 14:49:44 CET
Last Seen                     2014-12-12 14:49:44 CET
Local ID                      86425b1a-6dc9-4d97-8710-db2f6da3596b

Raw Audit Messages
type=AVC msg=audit(1418392184.360:645): avc:  denied  { read } for  pid=6252 comm="icecc-scheduler" name="meminfo" dev="proc" ino=4026531987 scontext=system_u:system_r:icecc_scheduler_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file


type=SYSCALL msg=audit(1418392184.360:645): arch=x86_64 syscall=open success=no exit=EACCES a0=3b9397c26e a1=80000 a2=1b6 a3=0 items=0 ppid=1 pid=6252 auid=4294967295 uid=988 gid=985 euid=988 suid=988 fsuid=988 egid=985 sgid=985 fsgid=985 tty=(none) ses=4294967295 comm=icecc-scheduler exe=/usr/bin/bash subj=system_u:system_r:icecc_scheduler_t:s0 key=(null)

Hash: icecc-scheduler,icecc_scheduler_t,proc_t,file,read

Comment 10 Slawomir Czarko 2014-12-12 15:07:19 UTC
icecream-1.0.1-11.20140822git.fc19.x86_64 install OK and so far no SELinux messages when running g++.

Comment 11 Fedora Update System 2014-12-13 00:09:17 UTC
icecream-1.0.1-11.20140822git.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/icecream-1.0.1-11.20140822git.fc21

Comment 12 Fedora Update System 2014-12-13 00:11:21 UTC
icecream-1.0.1-11.20140822git.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/icecream-1.0.1-11.20140822git.fc20

Comment 13 Fedora Update System 2014-12-13 00:12:40 UTC
icecream-1.0.1-11.20140822git.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/icecream-1.0.1-11.20140822git.fc19

Comment 14 Fedora Update System 2014-12-15 04:31:16 UTC
Package icecream-1.0.1-11.20140822git.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing icecream-1.0.1-11.20140822git.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-16978/icecream-1.0.1-11.20140822git.fc19
then log in and leave karma (feedback).

Comment 15 Fedora Update System 2015-01-03 18:58:46 UTC
icecream-1.0.1-11.20140822git.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 16 Fedora Update System 2015-01-03 19:02:40 UTC
icecream-1.0.1-11.20140822git.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 17 Fedora Update System 2015-01-03 19:10:37 UTC
icecream-1.0.1-11.20140822git.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.