Red Hat Bugzilla – Bug 1473999
SELinux is preventing abrt-action-gen from 'read' accesses on the file libmono.so.
Last modified: 2017-09-13 00:53:49 EDT
Description of problem: SELinux is preventing abrt-action-gen from 'read' accesses on the file libmono.so. ***** Plugin catchall (100. confidence) suggests ************************** If вы считаете, что abrt-action-gen следует разрешить доступ read к libmono.so file по умолчанию. Then рекомендуется создать отчет об ошибке. Чтобы разрешить доступ, можно создать локальный модуль политики. Do allow this access for now by executing: # ausearch -c 'abrt-action-gen' --raw | audit2allow -M my-abrtactiongen # semodule -X 300 -i my-abrtactiongen.pp Additional Information: Source Context system_u:system_r:abrt_t:s0-s0:c0.c1023 Target Context unconfined_u:object_r:unlabeled_t:s0 Target Objects libmono.so [ file ] Source abrt-action-gen Source Path abrt-action-gen Port <Неизвестно> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-260.1.fc26.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.11.10-300.fc26.x86_64 #1 SMP Wed Jul 12 17:05:39 UTC 2017 x86_64 x86_64 Alert Count 20 First Seen 2017-07-23 03:27:44 MSK Last Seen 2017-07-23 03:27:44 MSK Local ID aff6aeb0-1d4d-44d3-9bc6-84b50d78f4cd Raw Audit Messages type=AVC msg=audit(1500769664.582:351): avc: denied { read } for pid=11961 comm="eu-unstrip" name="libmono.so" dev="dm-4" ino=31719549 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:unlabeled_t:s0 tclass=file permissive=0 Hash: abrt-action-gen,abrt_t,unlabeled_t,file,read Version-Release number of selected component: selinux-policy-3.13.1-260.1.fc26.noarch Additional info: component: selinux-policy reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.10-300.fc26.x86_64 type: libreport Potential duplicate: bug 1240604
Description of problem: This kind of se alert happens a lot. Especially when I am compiling small example programs or programs of a project I create. I develop in C using either make or the autotools. I cannot fathom what I am doing wrong to cause these SE alerts. The previous one was not abrt, but eu-unstrip iirc. It looks like the cause is creating an executable with proper chmod attributes, but improper SE linux attributes. I do not know what to change to get this right. Version-Release number of selected component: selinux-policy-3.13.1-260.8.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.9-300.fc26.x86_64 type: libreport