Bug 1729780 - SELinux is preventing gdk-pixbuf-thum from 'write' accesses on the file /home/.ecryptfs/mike/.Private/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhzk-waKwjHy4dYIkbJ19kgk--/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhiQqEJ...
Summary: SELinux is preventing gdk-pixbuf-thum from 'write' accesses on the file /home...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 30
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:00a3b30f918bc6718b7c7989958...
: 1729778 1729779 1729784 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-07-14 14:00 UTC by Michael
Modified: 2019-07-17 06:35 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-07-16 20:45:40 UTC


Attachments (Terms of Use)

Description Michael 2019-07-14 14:00:35 UTC
Description of problem:
SELinux is preventing gdk-pixbuf-thum from 'write' accesses on the file /home/.ecryptfs/mike/.Private/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhzk-waKwjHy4dYIkbJ19kgk--/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhiQqEJ-Y7bj260.BIi9RcdE--/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhCnBG6GgyouK1M332ER.gSk--/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhFkuLGfB5IzRDUQnfcChkFE--/ECRYPTFS_FNEK_ENCRYPTED.FXZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolh2di2gYWEd2Qvazo5TdwwmkUug0qL-ngIQ20Sx8Jz.9w-.

*****  Plugin restorecon (99.5 confidence) suggests   ************************

If you want to fix the label. 
/home/.ecryptfs/mike/.Private/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhzk-waKwjHy4dYIkbJ19kgk--/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhiQqEJ-Y7bj260.BIi9RcdE--/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhCnBG6GgyouK1M332ER.gSk--/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhFkuLGfB5IzRDUQnfcChkFE--/ECRYPTFS_FNEK_ENCRYPTED.FXZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolh2di2gYWEd2Qvazo5TdwwmkUug0qL-ngIQ20Sx8Jz.9w- default label should be ecryptfs_t.
Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly.
Do
# /sbin/restorecon -v /home/.ecryptfs/mike/.Private/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhzk-waKwjHy4dYIkbJ19kgk--/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhiQqEJ-Y7bj260.BIi9RcdE--/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhCnBG6GgyouK1M332ER.gSk--/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhFkuLGfB5IzRDUQnfcChkFE--/ECRYPTFS_FNEK_ENCRYPTED.FXZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolh2di2gYWEd2Qvazo5TdwwmkUug0qL-ngIQ20Sx8Jz.9w-

*****  Plugin catchall (1.49 confidence) suggests   **************************

If you believe that gdk-pixbuf-thum should be allowed write access on the ECRYPTFS_FNEK_ENCRYPTED.FXZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolh2di2gYWEd2Qvazo5TdwwmkUug0qL-ngIQ20Sx8Jz.9w- file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'gdk-pixbuf-thum' --raw | audit2allow -M my-gdkpixbufthum
# semodule -X 300 -i my-gdkpixbufthum.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023
Target Context                unconfined_u:object_r:user_home_t:s0
Target Objects                /home/.ecryptfs/mike/.Private/ECRYPTFS_FNEK_ENCRYP
                              TED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhzk-waKwjHy
                              4dYIkbJ19kgk--/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-C
                              FY-QRePhGJs5iGfrnxQ3xRolhiQqEJ-Y7bj260.BIi9RcdE--/
                              ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGf
                              rnxQ3xRolhCnBG6GgyouK1M332ER.gSk--/ECRYPTFS_FNEK_E
                              NCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhFkuLG
                              fB5IzRDUQnfcChkFE--/ECRYPTFS_FNEK_ENCRYPTED.FXZLF6
                              QZ6-CFY-QRePhGJs5iGfrnxQ3xRolh2di2gYWEd2Qvazo5Tdww
                              mkUug0qL-ngIQ20Sx8Jz.9w- [ file ]
Source                        gdk-pixbuf-thum
Source Path                   gdk-pixbuf-thum
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.14.3-40.fc30.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 5.1.16-300.fc30.x86_64 #1 SMP Wed
                              Jul 3 15:06:51 UTC 2019 x86_64 x86_64
Alert Count                   7
First Seen                    2019-07-14 15:58:40 CEST
Last Seen                     2019-07-14 15:58:42 CEST
Local ID                      2b3abd4c-6844-401c-a826-721b8089d0b6

Raw Audit Messages
type=AVC msg=audit(1563112722.62:355): avc:  denied  { write } for  pid=4903 comm="gdk-pixbuf-thum" path="/home/.ecryptfs/mike/.Private/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhzk-waKwjHy4dYIkbJ19kgk--/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhiQqEJ-Y7bj260.BIi9RcdE--/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhCnBG6GgyouK1M332ER.gSk--/ECRYPTFS_FNEK_ENCRYPTED.FWZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolhFkuLGfB5IzRDUQnfcChkFE--/ECRYPTFS_FNEK_ENCRYPTED.FXZLF6QZ6-CFY-QRePhGJs5iGfrnxQ3xRolh2di2gYWEd2Qvazo5TdwwmkUug0qL-ngIQ20Sx8Jz.9w-" dev="nvme0n1p2" ino=4195234 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0


Hash: gdk-pixbuf-thum,thumb_t,user_home_t,file,write

Version-Release number of selected component:
selinux-policy-3.14.3-40.fc30.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.10.1
hashmarkername: setroubleshoot
kernel:         5.1.16-300.fc30.x86_64
type:           libreport

Comment 1 Michael 2019-07-14 16:28:35 UTC
Happened after home directory migration with ecryptfs-migrate-home.

Seems to be caused when thumbnails are being generated.
However, thumbnails appear okay nevertheless...

Comment 2 Michael 2019-07-15 08:27:00 UTC
Used LUKS instead. Probably the better choice anyway...

Comment 3 Lukas Vrabec 2019-07-16 20:36:17 UTC
*** Bug 1729778 has been marked as a duplicate of this bug. ***

Comment 4 Lukas Vrabec 2019-07-16 20:36:26 UTC
*** Bug 1729779 has been marked as a duplicate of this bug. ***

Comment 5 Lukas Vrabec 2019-07-16 20:36:45 UTC
*** Bug 1729784 has been marked as a duplicate of this bug. ***

Comment 6 Lukas Vrabec 2019-07-16 20:45:40 UTC
Hi Michael, 

You need to label whole user home dir as ecryptfs_t and then allow following boolean to make it working:
# semanage boolean --m --on use_ecryptfs_home_dirs


This is not bug in fedora selinux-policy. 

Thanks,
Lukas.

Comment 7 Christian Kujau 2019-07-17 06:35:17 UTC
Description of problem:
Happened during boot.

Version-Release number of selected component:
selinux-policy-3.14.3-40.fc30.noarch

Additional info:
reporter:       libreport-2.10.1
hashmarkername: setroubleshoot
kernel:         5.1.17-300.fc30.x86_64
type:           libreport


Note You need to log in before you can comment on or make changes to this bug.