Bug 1266903 - SELinux is preventing hp-config_usb_p from 'create' accesses on the directory __pycache__.
SELinux is preventing hp-config_usb_p from 'create' accesses on the directory...
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: hplip (Show other bugs)
23
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Tim Waugh
Fedora Extras Quality Assurance
abrt_hash:89726dcfb58eab31be97b001933...
:
: 1267399 1276838 (view as bug list)
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-09-28 09:03 EDT by Martín Cigorraga
Modified: 2016-02-18 21:40 EST (History)
16 users (show)

See Also:
Fixed In Version: hplip-3.15.9-3.fc23 hplip-3.15.9-2.fc22
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-11-26 15:56:12 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Launchpad 1427652 None None None Never

  None (edit)
Description Martín Cigorraga 2015-09-28 09:03:18 EDT
Description of problem:
I ejected a plugged pendrive in Nautilus.
SELinux is preventing hp-config_usb_p from 'create' accesses on the directory __pycache__.

*****  Plugin catchall_labels (83.8 confidence) suggests   *******************

If you want to allow hp-config_usb_p to have create access on the __pycache__ directory
Then you need to change the label on __pycache__
Do
# semanage fcontext -a -t FILE_TYPE '__pycache__'
where FILE_TYPE is one of the following: cupsd_log_t, cupsd_rw_etc_t, cupsd_tmp_t, cupsd_var_run_t, print_spool_t. 
Then execute: 
restorecon -v '__pycache__'


*****  Plugin catchall (17.1 confidence) suggests   **************************

If you believe that hp-config_usb_p should be allowed create access on the __pycache__ directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep hp-config_usb_p /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:cupsd_t:s0-s0:c0.c1023
Target Context                system_u:object_r:usr_t:s0
Target Objects                __pycache__ [ dir ]
Source                        hp-config_usb_p
Source Path                   hp-config_usb_p
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-147.fc23.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.2.1-300.fc23.x86_64 #1 SMP Mon
                              Sep 21 22:13:13 UTC 2015 x86_64 x86_64
Alert Count                   7
First Seen                    2015-09-28 10:01:03 ART
Last Seen                     2015-09-28 10:01:03 ART
Local ID                      50d91273-51fa-4659-a22a-eefe49a106b7

Raw Audit Messages
type=AVC msg=audit(1443445263.810:736): avc:  denied  { create } for  pid=28794 comm="hp-config_usb_p" name="__pycache__" scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=0


Hash: hp-config_usb_p,cupsd_t,usr_t,dir,create

Version-Release number of selected component:
selinux-policy-3.13.1-147.fc23.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.2.1-300.fc23.x86_64
type:           libreport
Comment 1 Tim Waugh 2015-10-23 10:35:33 EDT
*** Bug 1267399 has been marked as a duplicate of this bug. ***
Comment 2 Tim Waugh 2015-10-23 10:41:35 EDT
Probably just needs to run the Python interpreter with the -B switch in /usr/bin/hp-config_usb_printer.
Comment 3 Mikhail 2015-11-05 08:30:26 EST
Description of problem:
plug usb printer

Version-Release number of selected component:
selinux-policy-3.13.1-152.fc23.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.3-300.fc23.i686
type:           libreport
Comment 4 Martín Cigorraga 2015-11-08 13:37:24 EST
Description of problem:
Unplugged the pendrive after ejecting it from Nautilus

Version-Release number of selected component:
selinux-policy-3.13.1-153.fc23.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.5-300.fc23.x86_64
type:           libreport
Comment 5 Jiri Popelka 2015-11-23 11:00:12 EST
*** Bug 1276838 has been marked as a duplicate of this bug. ***
Comment 6 Fedora Update System 2015-11-23 11:03:00 EST
hplip-3.15.9-2.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-bd4f598976
Comment 7 Fedora Update System 2015-11-23 11:03:00 EST
hplip-3.15.9-3.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-a2d026bbf6
Comment 8 Fedora Update System 2015-11-23 19:53:58 EST
hplip-3.15.9-2.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'dnf --enablerepo=updates-testing update hplip'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-bd4f598976
Comment 9 Fedora Update System 2015-11-23 21:22:48 EST
hplip-3.15.9-3.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'dnf --enablerepo=updates-testing update hplip'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-a2d026bbf6
Comment 10 Fedora Update System 2015-11-26 15:56:07 EST
hplip-3.15.9-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 11 Alex Villacís Lasso 2015-12-05 21:14:40 EST
Description of problem:
Printed a few documents on an HP Desktop inkjet printer. SELinux denial message appeared when printer was turned off after all printing was done.

Version-Release number of selected component:
selinux-policy-3.13.1-155.fc23.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.6-301.fc23.x86_64
type:           libreport
Comment 12 Martín Cigorraga 2015-12-08 13:05:22 EST
Description of problem:
Ejected an HPv160 pendrive from Nautilus and unplugged it.

Version-Release number of selected component:
selinux-policy-3.13.1-155.fc23.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.6-301.fc23.x86_64
type:           libreport
Comment 13 Fedora Update System 2015-12-10 22:21:28 EST
hplip-3.15.9-2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 14 Dimitri Papadopoulos 2015-12-11 12:26:51 EST
Description of problem:
After powering off HP Photosmart 5525 scanner/printer

Version-Release number of selected component:
selinux-policy-3.13.1-155.fc23.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.6-301.fc23.x86_64
type:           libreport
Comment 15 tunomarsan 2016-02-18 21:40:52 EST
Description of problem:
Aparece el error al intentar instalar programas desde la aplicación software, tarda mucho tiempo intentando instalar para que al final arroje ese error y se trunque


Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.3-300.fc23.x86_64
type:           libreport

Note You need to log in before you can comment on or make changes to this bug.