Bug 1401368 - SELinux is preventing teamviewerd from using the 'execmem' accesses on a process.
Summary: SELinux is preventing teamviewerd from using the 'execmem' accesses on a proc...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 25
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:40553c3c8832ca6c55b5ed38e4c...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-12-05 03:38 UTC by Justin W. Flory (he/him)
Modified: 2016-12-06 15:38 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-12-05 13:48:57 UTC
Type: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Justin W. Flory (he/him) 2016-12-05 03:38:09 UTC 
Description of problem:
SELinux is preventing teamviewerd from using the 'execmem' accesses on a process.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that teamviewerd should be allowed execmem access on processes labeled init_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'teamviewerd' --raw | audit2allow -M my-teamviewerd
# semodule -X 300 -i my-teamviewerd.pp

Additional Information:
Source Context                system_u:system_r:init_t:s0
Target Context                system_u:system_r:init_t:s0
Target Objects                Unknown [ process ]
Source                        teamviewerd
Source Path                   teamviewerd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    <Unknown>
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.7.4-200.fc24.x86_64 #1 SMP Thu
                              Sep 15 18:42:09 UTC 2016 x86_64 x86_64
Alert Count                   110
First Seen                    2016-08-22 20:51:12 EDT
Last Seen                     2016-12-02 11:44:35 EST
Local ID                      e90959c8-8a48-4ce1-89f4-dd264f46635f

Raw Audit Messages
type=AVC msg=audit(1480697075.153:236): avc:  denied  { execmem } for  pid=1559 comm="teamviewerd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=process permissive=0


Hash: teamviewerd,init_t,init_t,process,execmem


Additional info:
reporter:       libreport-2.8.0
hashmarkername: setroubleshoot
kernel:         4.8.10-300.fc25.x86_64
type:           libreport

Potential duplicate: bug 1334085
Comment 1 Lukas Vrabec 2016-12-05 13:48:57 UTC 
How did you start teamviewed? We don't have policy for it in our repo, so it should run as unconfined_service_t. 

Could you start it using:
# systemctl start unconfined_service_t

I'm looking in fedora repo and I cannot find this package there.
Comment 2 Rich 2016-12-06 15:38:37 UTC 
Description of problem:
I believe teamviewer should be permitted by default.

Version-Release number of selected component:
selinux-policy-3.13.1-191.18.fc24.noarch

Additional info:
reporter:       libreport-2.8.0
hashmarkername: setroubleshoot
kernel:         4.8.10-300.fc25.x86_64
type:           libreport
Note You need to log in before you can comment on or make changes to this bug.