Bug 1367744 - SELinux is preventing gdb from write access on the directory /usr/share/glib-2.0/gdb.
Summary: SELinux is preventing gdb from write access on the directory /usr/share/glib-...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 24
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-17 11:16 UTC by Clodoaldo Pinto Neto
Modified: 2016-09-23 15:26 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-08-20 19:59:05 UTC
Type: Bug


Attachments (Terms of Use)

Description Clodoaldo Pinto Neto 2016-08-17 11:16:17 UTC
# dnf list installed selinux\*
Installed Packages
selinux-policy.noarch                   3.13.1-191.11.fc24          @updates-testing
selinux-policy-targeted.noarch          3.13.1-191.11.fc24          @updates-testing

SELinux is preventing gdb from write access on the directory /usr/share/glib-2.0/gdb.

*****  Plugin catchall_labels (83.8 confidence) suggests   *******************

If you want to allow gdb to have write access on the gdb directory
Then you need to change the label on /usr/share/glib-2.0/gdb
Do
# semanage fcontext -a -t FILE_TYPE '/usr/share/glib-2.0/gdb'
where FILE_TYPE is one of the following: abrt_tmp_t, abrt_upload_watch_tmp_t, abrt_var_cache_t, abrt_var_log_t, abrt_var_run_t, mock_var_lib_t, rpm_var_cache_t, rpm_var_run_t, sosreport_tmp_t, tmp_t, var_log_t, var_run_t, var_spool_t, var_t.
Then execute:
restorecon -v '/usr/share/glib-2.0/gdb'


*****  Plugin catchall (17.1 confidence) suggests   **************************

If you believe that gdb should be allowed write access on the gdb directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'gdb' --raw | audit2allow -M my-gdb
# semodule -X 300 -i my-gdb.pp

Additional Information:
Source Context                system_u:system_r:abrt_t:s0-s0:c0.c1023
Target Context                system_u:object_r:usr_t:s0
Target Objects                /usr/share/glib-2.0/gdb [ dir ]
Source                        gdb
Source Path                   gdb
Port                          <Unknown>
Host                          cl.dkt
Source RPM Packages           
Target RPM Packages           glib2-devel-2.48.1-1.fc24.x86_64
Policy RPM                    selinux-policy-3.13.1-191.11.fc24.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     cl.dkt
Platform                      Linux cl.dkt 4.6.6-300.fc24.x86_64 #1 SMP Wed Aug
                              10 21:07:35 UTC 2016 x86_64 x86_64
Alert Count                   11
First Seen                    2016-08-17 07:59:35 BRT
Last Seen                     2016-08-17 07:59:58 BRT
Local ID                      f78a5dcc-fc6e-4a15-826c-e8297d41eb29

Raw Audit Messages
type=AVC msg=audit(1471431598.852:215): avc:  denied  { write } for  pid=2091 comm="gdb" name="gdb" dev="dm-1" ino=1972462 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=0


Hash: gdb,abrt_t,usr_t,dir,write

Comment 1 Clodoaldo Pinto Neto 2016-08-17 11:51:13 UTC
Downgrading the selinux-policy fixes several issues like a non root user being able to manage network connections and reboot.


Note You need to log in before you can comment on or make changes to this bug.