Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: printing error SELinux is preventing brprintconflsr3 from 'execute' accesses on the file /etc/ld.so.cache. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that brprintconflsr3 should be allowed execute access on the ld.so.cache file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep brprintconflsr3 /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:cupsd_t:s0-s0:c0.c1023 Target Context unconfined_u:object_r:ld_so_cache_t:s0 Target Objects /etc/ld.so.cache [ file ] Source brprintconflsr3 Source Path brprintconflsr3 Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages glibc-2.21-7.fc22.x86_64 glibc-2.21-7.fc22.i686 Policy RPM selinux-policy-3.13.1-128.10.fc22.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.1.5-200.fc22.x86_64 #1 SMP Mon Aug 10 23:38:23 UTC 2015 x86_64 x86_64 Alert Count 10 First Seen 2015-08-22 17:45:53 IST Last Seen 2015-08-22 17:45:53 IST Local ID e033f10b-90be-4881-b84f-70841af8a9fd Raw Audit Messages type=AVC msg=audit(1440245753.811:644): avc: denied { execute } for pid=3416 comm="rawtobr3" path="/etc/ld.so.cache" dev="dm-1" ino=397760 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:ld_so_cache_t:s0 tclass=file permissive=0 Hash: brprintconflsr3,cupsd_t,ld_so_cache_t,file,execute Version-Release number of selected component: selinux-policy-3.13.1-128.10.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.1.5-200.fc22.x86_64 type: libreport
*** Bug 1255961 has been marked as a duplicate of this bug. ***
Description of problem: printing on brother laser printer 2250DN Version-Release number of selected component: selinux-policy-3.13.1-128.12.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.1.6-200.fc22.x86_64 type: libreport
Description of problem: Everytime I try to print something this alert pops up, but printing is successful. Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.2.3-200.fc22.x86_64 type: libreport
Same problem: SELinux is preventing brprintconflsr3 from execute access on the file /etc/ld.so.cache. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that brprintconflsr3 should be allowed execute access on the ld.so.cache file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep brprintconflsr3 /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:cupsd_t:s0-s0:c0.c1023 Target Context unconfined_u:object_r:ld_so_cache_t:s0 Target Objects /etc/ld.so.cache [ file ] Source brprintconflsr3 Source Path brprintconflsr3 Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages glibc-2.21-8.fc22.x86_64 glibc-2.21-8.fc22.i686 Policy RPM selinux-policy-3.13.1-128.18.fc22.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.2.5-201.fc22.x86_64 #1 SMP Wed Oct 28 20:00:23 UTC 2015 x86_64 x86_64 Alert Count 70 First Seen 2015-10-25 23:46:19 EDT Last Seen 2015-11-11 07:21:56 EST Local ID 4eeeb37a-73a1-4c04-b3e3-f3a298fc02fe Raw Audit Messages type=AVC msg=audit(1447244516.147:670): avc: denied { execute } for pid=9502 comm="rawtobr3" path="/etc/ld.so.cache" dev="dm-1" ino=1049662 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:ld_so_cache_t:s0 tclass=file permissive=0 Hash: brprintconflsr3,cupsd_t,ld_so_cache_t,file,execute I *still* need to use 'setsebool cups_execmem 1' as per bug https://bugzilla.redhat.com/show_bug.cgi?id=1246184 in order to print at all, and even though print is successful the above alert appears.
This is now worse in Fedora 23. Same error, but now printing does not happen at all. SELinux is preventing brprintconflsr3 from execute access on the file /etc/ld.so.cache. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that brprintconflsr3 should be allowed execute access on the ld.so.cache file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep brprintconflsr3 /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:cupsd_t:s0-s0:c0.c1023 Target Context system_u:object_r:ld_so_cache_t:s0 Target Objects /etc/ld.so.cache [ file ] Source brprintconflsr3 Source Path brprintconflsr3 Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages glibc-2.22-6.fc23.x86_64 glibc-2.22-6.fc23.i686 Policy RPM selinux-policy-3.13.1-155.fc23.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.2.6-301.fc23.x86_64 #1 SMP Fri Nov 20 22:22:41 UTC 2015 x86_64 x86_64 Alert Count 9 First Seen 2015-12-08 00:06:03 EST Last Seen 2015-12-08 00:06:03 EST Local ID a0b21b7c-09c0-40aa-9df9-f50a22bc3675 Raw Audit Messages type=AVC msg=audit(1449551163.283:697): avc: denied { execute } for pid=7609 comm="brprintconflsr3" path="/etc/ld.so.cache" dev="dm-0" ino=1837314 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ld_so_cache_t:s0 tclass=file permissive=0 Hash: brprintconflsr3,cupsd_t,ld_so_cache_t,file,execute
I installed Fedora 23 and cups. I also got the SE alert in the log during printing. Mar 18 22:38:51 me_user audit: AVC avc: denied { execute } for pid=6309 comm="rawtobr3" path="/etc/ld.so.cache" dev="sda2" ino=1181615 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:ld_so_cache_t:s0 tclass=file permissive=0 But the printing succeed. "I *still* need to use 'setsebool cups_execmem 1' as per bug https://bugzilla.redhat.com/show_bug.cgi?id=1246184 in order to print at all, and even though print is successful the above alert appears."
Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.
This problem (with executable brhl3150cdwfilt for Brother printer driver for HL3150CDW) occurs on Fedora 24, so this bug should be reopened.