Bug 1316447 - SELinux is preventing /usr/libexec/abrt-hook-ccpp from 'write' accesses on the sock_file socket.
Summary: SELinux is preventing /usr/libexec/abrt-hook-ccpp from 'write' accesses on th...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 23
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:4c57fd730d96f84202f9bbdbf70...
: 1321377 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-03-10 09:35 UTC by Tom Ghyselinck
Modified: 2016-04-23 12:59 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-03-10 10:23:51 UTC
Type: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Tom Ghyselinck 2016-03-10 09:35:48 UTC 
Description of problem:
SELinux is preventing /usr/libexec/abrt-hook-ccpp from 'write' accesses on the sock_file socket.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that abrt-hook-ccpp should be allowed write access on the socket sock_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep abrt-hook-ccpp /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:abrt_dump_oops_t:s0
Target Context                system_u:object_r:nscd_var_run_t:s0
Target Objects                socket [ sock_file ]
Source                        abrt-hook-ccpp
Source Path                   /usr/libexec/abrt-hook-ccpp
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    <Unknown>
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.4.3-300.fc23.x86_64 #1 SMP Fri
                              Feb 26 18:45:40 UTC 2016 x86_64 x86_64
Alert Count                   3
First Seen                    2016-03-10 10:31:52 CET
Last Seen                     2016-03-10 10:31:52 CET
Local ID                      ae5b8285-6c22-45ea-b5c9-99d0f5799ec8

Raw Audit Messages
type=AVC msg=audit(1457602312.891:1055): avc:  denied  { write } for  pid=31528 comm="abrt-hook-ccpp" name="socket" dev="tmpfs" ino=20928 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=sock_file permissive=0


type=SYSCALL msg=audit(1457602312.891:1055): arch=x86_64 syscall=connect success=no exit=EACCES a0=6 a1=7ffe9d420a80 a2=6e a3=7fd684882ce0 items=0 ppid=2 pid=31528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=abrt-hook-ccpp exe=/usr/libexec/abrt-hook-ccpp subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null)

Hash: abrt-hook-ccpp,abrt_dump_oops_t,nscd_var_run_t,sock_file,write


Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.4.3-300.fc23.x86_64
type:           libreport
Comment 1 Lukas Vrabec 2016-03-10 10:23:51 UTC 
$ audit2allow -i avc 


#============= abrt_dump_oops_t ==============

#!!!! This avc is allowed in the current policy
allow abrt_dump_oops_t nscd_var_run_t:sock_file write;


What is version of your selinux-policy package? Could you update this package and try to reproduce this issue?
Comment 2 Tom Ghyselinck 2016-03-10 10:56:24 UTC 
Hi,

My package version is:
$ dnf info selinux-policy
Last metadata expiration check performed 14:20:58 ago on Wed Mar  9 21:33:08 2016.
Installed Packages
Name        : selinux-policy
Arch        : noarch
Epoch       : 0
Version     : 3.13.1
Release     : 158.7.fc23
Size        : 18 k
Repo        : @System
From repo   : updates
Summary     : SELinux policy configuration
URL         : http://github.com/TresysTechnology/refpolicy/wiki
License     : GPLv2+
Description : SELinux Base package for SELinux Reference Policy - modular.
            : Based off of reference policy: Checked out revision  2.20091117
Comment 3 Joe B 2016-03-25 22:52:42 UTC 
*** Bug 1321377 has been marked as a duplicate of this bug. ***
Comment 4 vikram goyal 2016-04-23 12:59:29 UTC 
Description of problem:

upgrading with dnf update create this alert.

Following were the updates:

Apr 23 18:20:49 INFO Upgraded: expat-2.1.1-1.fc23.x86_64
Apr 23 18:20:56 INFO Installed: kernel-core-4.4.7-300.fc23.x86_64
Apr 23 18:21:06 INFO Installed: kernel-modules-4.4.7-300.fc23.x86_64
Apr 23 18:21:07 INFO Upgraded: libsolv-0.6.20-1.fc23.x86_64
Apr 23 18:21:09 INFO Upgraded: setroubleshoot-server-3.3.5-3.fc23.x86_64
Apr 23 18:21:10 INFO Upgraded: pygtk2-2.24.0-14.fc23.x86_64
Apr 23 18:21:12 INFO Upgraded: bluez-5.39-1.fc23.x86_64
Apr 23 18:21:12 INFO Upgraded: libreport-filesystem-2.6.4-2.fc23.x86_64
Apr 23 18:21:13 INFO Upgraded: libreport-2.6.4-2.fc23.x86_64
Apr 23 18:21:14 INFO Upgraded: abrt-libs-2.8.0-4.fc23.x86_64
Apr 23 18:21:14 INFO Upgraded: libreport-web-2.6.4-2.fc23.x86_64
Apr 23 18:21:15 INFO Upgraded: libreport-python3-2.6.4-2.fc23.x86_64
Apr 23 18:21:16 INFO Upgraded: libreport-plugin-ureport-2.6.4-2.fc23.x86_64
Apr 23 18:21:16 INFO Upgraded: abrt-python3-2.8.0-4.fc23.x86_64
Apr 23 18:21:19 INFO Upgraded: abrt-2.8.0-4.fc23.x86_64
Apr 23 18:21:20 INFO Upgraded: abrt-dbus-2.8.0-4.fc23.x86_64
Apr 23 18:21:21 INFO Upgraded: abrt-retrace-client-2.8.0-4.fc23.x86_64
Apr 23 18:21:21 INFO Upgraded: libreport-plugin-bugzilla-2.6.4-2.fc23.x86_64
Apr 23 18:21:22 INFO Upgraded: abrt-plugin-bodhi-2.8.0-4.fc23.x86_64
Apr 23 18:21:22 INFO Upgraded: abrt-addon-xorg-2.8.0-4.fc23.x86_64
Apr 23 18:21:23 INFO Upgraded: abrt-addon-python3-2.8.0-4.fc23.x86_64
Apr 23 18:21:23 INFO Upgraded: libreport-plugin-reportuploader-2.6.4-2.fc23.x86_64
Apr 23 18:21:25 INFO Upgraded: libreport-gtk-2.6.4-2.fc23.x86_64
Apr 23 18:21:26 INFO Upgraded: abrt-gui-libs-2.8.0-4.fc23.x86_64
Apr 23 18:21:29 INFO Upgraded: gnome-abrt-1.2.2-2.fc23.x86_64
Apr 23 18:21:29 INFO Upgraded: libreport-fedora-2.6.4-2.fc23.x86_64
Apr 23 18:21:29 INFO Upgraded: libreport-plugin-logger-2.6.4-2.fc23.x86_64
Apr 23 18:21:30 INFO Upgraded: abrt-gui-2.8.0-4.fc23.x86_64
Apr 23 18:21:30 INFO Upgraded: libreport-plugin-kerneloops-2.6.4-2.fc23.x86_64
Apr 23 18:21:31 INFO Upgraded: abrt-addon-kerneloops-2.8.0-4.fc23.x86_64
Apr 23 18:21:32 INFO Upgraded: abrt-addon-vmcore-2.8.0-4.fc23.x86_64
Apr 23 18:21:33 INFO Upgraded: abrt-addon-pstoreoops-2.8.0-4.fc23.x86_64
Apr 23 18:21:35 INFO Upgraded: abrt-addon-coredump-helper-2.8.0-4.fc23.x86_64
Apr 23 18:21:36 INFO Upgraded: abrt-addon-ccpp-2.8.0-4.fc23.x86_64
Apr 23 18:21:36 INFO Upgraded: libreport-cli-2.6.4-2.fc23.x86_64
Apr 23 18:21:36 INFO Upgraded: abrt-tui-2.8.0-4.fc23.x86_64
Apr 23 18:21:37 INFO Upgraded: abrt-cli-2.8.0-4.fc23.x86_64
Apr 23 18:21:37 INFO Upgraded: abrt-desktop-2.8.0-4.fc23.x86_64
Apr 23 18:21:38 INFO Upgraded: setroubleshoot-3.3.5-3.fc23.x86_64
Apr 23 18:21:39 INFO Upgraded: libreport-anaconda-2.6.4-2.fc23.x86_64
Apr 23 18:21:39 INFO Upgraded: bluez-cups-5.39-1.fc23.x86_64
Apr 23 18:21:39 INFO Upgraded: pygtk2-libglade-2.24.0-14.fc23.x86_64
Apr 23 18:21:39 INFO Installed: kernel-4.4.7-300.fc23.x86_64
Apr 23 18:21:57 INFO Upgraded: google-chrome-stable-50.0.2661.86-1.x86_64
Apr 23 18:21:58 INFO Upgraded: xpad-4.8.0-1.fc23.x86_64
Apr 23 18:21:58 INFO Upgraded: parted-3.2-18.fc23.x86_64
Apr 23 18:21:59 INFO Upgraded: libtasn1-4.8-1.fc23.x86_64
Apr 23 18:22:01 INFO Upgraded: libinput-1.2.4-1.fc23.x86_64
Apr 23 18:22:03 INFO Upgraded: kernel-headers-4.4.7-300.fc23.x86_64
Apr 23 18:22:04 INFO Upgraded: hwdata-0.288-1.fc23.noarch
Apr 23 18:22:05 INFO Upgraded: bluez-libs-5.39-1.fc23.x86_64
Apr 23 18:22:05 INFO Cleanup: abrt-desktop-2.8.0-3.fc23.x86_64
Apr 23 18:22:05 INFO Cleanup: abrt-cli-2.8.0-3.fc23.x86_64
Apr 23 18:22:05 INFO Cleanup: abrt-addon-vmcore-2.8.0-3.fc23.x86_64
Apr 23 18:22:07 INFO Cleanup: libreport-anaconda-2.6.4-1.fc23.x86_64
Apr 23 18:22:07 INFO Cleanup: abrt-addon-python3-2.8.0-3.fc23.x86_64
Apr 23 18:22:07 INFO Erased: kernel-4.4.5-300.fc23.x86_64
Apr 23 18:22:08 INFO Cleanup: libreport-fedora-2.6.4-1.fc23.x86_64
Apr 23 18:22:05 INFO Cleanup: abrt-addon-vmcore-2.8.0-3.fc23.x86_64
Apr 23 18:22:07 INFO Cleanup: libreport-anaconda-2.6.4-1.fc23.x86_64
Apr 23 18:22:07 INFO Cleanup: abrt-addon-python3-2.8.0-3.fc23.x86_64
Apr 23 18:22:07 INFO Erased: kernel-4.4.5-300.fc23.x86_64
Apr 23 18:22:08 INFO Cleanup: libreport-fedora-2.6.4-1.fc23.x86_64
Apr 23 18:22:08 INFO Cleanup: google-chrome-stable-50.0.2661.75-1.x86_64
Apr 23 18:22:09 INFO Cleanup: abrt-gui-2.8.0-3.fc23.x86_64
Apr 23 18:22:09 INFO Cleanup: abrt-addon-ccpp-2.8.0-3.fc23.x86_64
Apr 23 18:22:10 INFO Cleanup: gnome-abrt-1.2.2-1.fc23.x86_64
Apr 23 18:22:11 INFO Cleanup: abrt-tui-2.8.0-3.fc23.x86_64
Apr 23 18:22:11 INFO Cleanup: abrt-addon-pstoreoops-2.8.0-3.fc23.x86_64
Apr 23 18:22:12 INFO Cleanup: abrt-addon-kerneloops-2.8.0-3.fc23.x86_64
Apr 23 18:22:13 INFO Cleanup: abrt-plugin-bodhi-2.8.0-3.fc23.x86_64
Apr 23 18:22:13 INFO Cleanup: libreport-plugin-kerneloops-2.6.4-1.fc23.x86_64
Apr 23 18:22:13 INFO Cleanup: libreport-plugin-bugzilla-2.6.4-1.fc23.x86_64
Apr 23 18:22:14 INFO Cleanup: abrt-addon-xorg-2.8.0-3.fc23.x86_64
Apr 23 18:22:14 INFO Cleanup: setroubleshoot-3.3.5-2.fc23.x86_64
Apr 23 18:22:15 INFO Cleanup: libreport-gtk-2.6.4-1.fc23.x86_64
Apr 23 18:22:15 INFO Cleanup: libreport-plugin-reportuploader-2.6.4-1.fc23.x86_64
Apr 23 18:22:16 INFO Cleanup: abrt-gui-libs-2.8.0-3.fc23.x86_64
Apr 23 18:22:16 INFO Cleanup: abrt-addon-coredump-helper-2.8.0-3.fc23.x86_64
Apr 23 18:22:16 INFO Cleanup: abrt-retrace-client-2.8.0-3.fc23.x86_64
Apr 23 18:22:17 INFO Cleanup: libsolv-0.6.19-2.fc23.x86_64
Apr 23 18:22:18 INFO Cleanup: abrt-dbus-2.8.0-3.fc23.x86_64
Apr 23 18:22:19 INFO Cleanup: abrt-python3-2.8.0-3.fc23.x86_64
Apr 23 18:22:19 INFO Cleanup: abrt-2.8.0-3.fc23.x86_64
Apr 23 18:22:21 INFO Cleanup: libreport-plugin-ureport-2.6.4-1.fc23.x86_64
Apr 23 18:22:21 INFO Cleanup: libreport-web-2.6.4-1.fc23.x86_64
Apr 23 18:22:26 INFO Cleanup: abrt-libs-2.8.0-3.fc23.x86_64
Apr 23 18:22:27 INFO Cleanup: libreport-python3-2.6.4-1.fc23.x86_64
Apr 23 18:22:27 INFO Cleanup: libreport-cli-2.6.4-1.fc23.x86_64
Apr 23 18:22:28 INFO Erased: kernel-modules-4.4.5-300.fc23.x86_64
Apr 23 18:22:35 INFO Cleanup: libreport-plugin-logger-2.6.4-1.fc23.x86_64
Apr 23 18:22:36 INFO Cleanup: libreport-2.6.4-1.fc23.x86_64
Apr 23 18:22:37 INFO Cleanup: pygtk2-libglade-2.24.0-12.fc23.x86_64
Apr 23 18:22:37 INFO Cleanup: bluez-cups-5.38-1.fc23.x86_64
Apr 23 18:22:37 INFO Cleanup: libreport-filesystem-2.6.4-1.fc23.x86_64
Apr 23 18:22:37 INFO Cleanup: kernel-headers-4.4.6-301.fc23.x86_64
Apr 23 18:22:38 INFO Cleanup: hwdata-0.287-1.fc23.noarch
Apr 23 18:22:39 INFO Cleanup: bluez-5.38-1.fc23.x86_64
Apr 23 18:22:40 INFO Cleanup: pygtk2-2.24.0-12.fc23.x86_64
Apr 23 18:22:41 INFO Erased: kernel-core-4.4.5-300.fc23.x86_64
Apr 23 18:22:42 INFO Cleanup: expat-2.1.0-12.fc23.x86_64
Apr 23 18:22:43 INFO Cleanup: setroubleshoot-server-3.3.5-2.fc23.x86_64
Apr 23 18:22:44 INFO Cleanup: xpad-4.7.0-1.fc23.x86_64
Apr 23 18:22:44 INFO Cleanup: parted-3.2-17.fc23.x86_64
Apr 23 18:22:45 INFO Cleanup: libtasn1-4.5-2.fc23.x86_64
Apr 23 18:22:45 INFO Cleanup: libinput-1.2.3-1.fc23.x86_64
Apr 23 18:22:46 INFO Cleanup: bluez-libs-5.38-1.fc23.x86_64

Version-Release number of selected component:
selinux-policy-3.13.1-158.14.fc23.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.4.6-301.fc23.x86_64
type:           libreport
Note You need to log in before you can comment on or make changes to this bug.