Bug 1832521 - SELinux is preventing cups-pdf from 'create' accesses on the unix_dgram_socket labeled cups_pdf_t.
Summary: SELinux is preventing cups-pdf from 'create' accesses on the unix_dgram_socke...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 33
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Richard Fiľo
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:ff71487c30bf6a168bd871e0648...
: 1829853 1862206 1881243 1895576 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-05-06 18:43 UTC by dan
Modified: 2021-01-19 20:11 UTC (History)
16 users (show)

Fixed In Version: selinux-policy-3.14.6-31.fc33
Clone Of:
Environment:
Last Closed: 2020-12-12 01:04:49 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description dan 2020-05-06 18:43:14 UTC
Description of problem:
Print to pdf via cups-pdf
SELinux is preventing cups-pdf from 'create' accesses on the unix_dgram_socket labeled cups_pdf_t.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that cups-pdf should be allowed create access on unix_dgram_socket labeled cups_pdf_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'cups-pdf' --raw | audit2allow -M my-cupspdf
# semodule -X 300 -i my-cupspdf.pp

Additional Information:
Source Context                system_u:system_r:cups_pdf_t:s0-s0:c0.c1023
Target Context                system_u:system_r:cups_pdf_t:s0-s0:c0.c1023
Target Objects                Unknown [ unix_dgram_socket ]
Source                        cups-pdf
Source Path                   cups-pdf
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-3.14.5-32.fc32.noarch
Local Policy RPM              selinux-policy-targeted-3.14.5-32.fc32.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 5.6.7-300.fc32.x86_64 #1 SMP Thu
                              Apr 23 14:13:50 UTC 2020 x86_64 x86_64
Alert Count                   3
First Seen                    2020-05-03 12:00:12 EDT
Last Seen                     2020-05-06 14:42:00 EDT
Local ID                      6980984e-733f-494a-b8d9-cd08ae9bf284

Raw Audit Messages
type=AVC msg=audit(1588790520.227:16195): avc:  denied  { create } for  pid=151815 comm="cups-pdf" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0


Hash: cups-pdf,cups_pdf_t,cups_pdf_t,unix_dgram_socket,create

Version-Release number of selected component:
selinux-policy-targeted-3.14.5-32.fc32.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.12.0
hashmarkername: setroubleshoot
kernel:         5.6.7-300.fc32.x86_64
type:           libreport

Comment 1 Zdenek Pytela 2020-05-07 16:48:00 UTC
Dan,

Apart from the denial, is there any actual problem with how the pdf cups filter works?

Would you mind collecting any possible additional denials?

setenforce 0
<reproduce the issue>
setenforce 1

ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts recent

Comment 2 dan 2020-05-11 15:04:21 UTC
The data is printed properly to file.

Here is the ouput requested:

----
type=AVC msg=audit(05/11/2020 11:01:32.253:41189) : avc:  denied  { create } for  pid=394766 comm=cups-pdf scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1 
----
type=AVC msg=audit(05/11/2020 11:01:32.253:41190) : avc:  denied  { connect } for  pid=394766 comm=cups-pdf scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1 
----

Comment 3 Milos Malik 2020-05-12 06:01:02 UTC
Caught in enforcing mode:
----
type=PROCTITLE msg=audit(05/12/2020 07:59:25.714:871) : proctitle=cups-pdf:/ 1 unconfined-user Fedora 1 LogType=7 PageSize=A4 PDFVer=1.2 Label=2 number-up=1 noCollate Truncate=64 Resolution=300d 
type=SYSCALL msg=audit(05/12/2020 07:59:25.714:871) : arch=x86_64 syscall=socket success=no exit=EACCES(Permission denied) a0=local a1=SOCK_DGRAM a2=ip a3=0x7ffe9f87c8d8 items=0 ppid=1717 pid=9823 auid=unset uid=root gid=lp euid=root suid=root fsuid=root egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-pdf exe=/usr/lib/cups/backend/cups-pdf subj=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(05/12/2020 07:59:25.714:871) : avc:  denied  { create } for  pid=9823 comm=cups-pdf scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0 
----

Comment 4 Milos Malik 2020-05-12 06:04:58 UTC
Caught in permissive mode:
----
type=PROCTITLE msg=audit(05/12/2020 08:02:15.828:952) : proctitle=cups-pdf:/ 2 unconfined-user Fedora 1 LogType=7 PageSize=A4 PDFVer=1.2 Label=2 number-up=1 noCollate Truncate=64 Resolution=300d 
type=SYSCALL msg=audit(05/12/2020 08:02:15.828:952) : arch=x86_64 syscall=socket success=yes exit=10 a0=local a1=SOCK_DGRAM a2=ip a3=0x7fffc5abe568 items=0 ppid=1717 pid=10759 auid=unset uid=root gid=lp euid=root suid=root fsuid=root egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-pdf exe=/usr/lib/cups/backend/cups-pdf subj=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(05/12/2020 08:02:15.828:952) : avc:  denied  { create } for  pid=10759 comm=cups-pdf scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1 
----
type=PROCTITLE msg=audit(05/12/2020 08:02:15.828:953) : proctitle=cups-pdf:/ 2 unconfined-user Fedora 1 LogType=7 PageSize=A4 PDFVer=1.2 Label=2 number-up=1 noCollate Truncate=64 Resolution=300d 
type=SOCKADDR msg=audit(05/12/2020 08:02:15.828:953) : saddr={ saddr_fam=local path=userdb-f7c9ae500fe25f0769d207a8240334ca } 
type=SYSCALL msg=audit(05/12/2020 08:02:15.828:953) : arch=x86_64 syscall=connect success=no exit=ECONNREFUSED(Connection refused) a0=0xa a1=0x7fffc5abe880 a2=0x2a a3=0x7fffc5abe568 items=0 ppid=1717 pid=10759 auid=unset uid=root gid=lp euid=root suid=root fsuid=root egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-pdf exe=/usr/lib/cups/backend/cups-pdf subj=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(05/12/2020 08:02:15.828:953) : avc:  denied  { connect } for  pid=10759 comm=cups-pdf scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1 
----

Comment 5 Eric L. 2020-05-18 07:07:22 UTC
I also have the issue and https://bugzilla.redhat.com/show_bug.cgi?id=1829853 seems to be a duplicate.

No "real" issue detected so far, cups-pdf seems to work as usual, just the warning is unsettling.

$ rpm -qa | grep -e cups-pdf -e selinux-policy
selinux-policy-3.14.5-38.fc32.noarch
cups-pdf-3.0.1-9.fc32.x86_64
selinux-policy-minimum-3.14.5-38.fc32.noarch
selinux-policy-targeted-3.14.5-38.fc32.noarch

Raw Audit Messages
type=AVC msg=audit(1589785422.397:383): avc:  denied  { create } for  pid=8790 comm="cups-pdf" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0

Hash: cups-pdf,cups_pdf_t,cups_pdf_t,unix_dgram_socket,create

Comment 6 Robert Marcano 2020-05-18 15:18:48 UTC
*** Bug 1829853 has been marked as a duplicate of this bug. ***

Comment 7 Robert Marcano 2020-05-18 15:28:55 UTC
The source code of cups-pdf doesn't create any socket, It must be a dependency that does it and now it uses a different socket type, because the policy already has [1]

  allow cups_pdf_t self:unix_stream_socket create_stream_socket_perms;

for stream sockets.

I will try to check the reason of this datagram socket creation, but I am on a heavily locked down country, my land based internet is dead, and phone tethering is at sub 100kb/s speeds, so I am still not using Fedora 32.  

[1] https://github.com/fedora-selinux/selinux-policy-contrib/blob/b35f071eace9e06117f78cdda3dd6692388dff6f/cups.te#L613

Comment 8 James E. LaBarre 2020-06-24 17:52:22 UTC
Similar problem has been detected:

Have installed the standard cups-pdf package (v3.0.1-9) on Fedora 32.

From a Firefox web page, sepected "print", and CUps-PDF as my printer.  SELinux alert popped up immediately.

Entered the commands (under root) the error dialogue suggested for allowing the function:

ausearch -c 'cups-pdf' --raw | audit2allow -M my-cupspdf
semodule -X 300 -i my-cupspdf.pp

then tried the same print again.  A second, identical SELinux alert popped up.

----------------------------------

Expected behavior would be that the Cups-PDF package would set up it's correct permissions.

hashmarkername: setroubleshoot
kernel:         5.6.18-300.fc32.x86_64
package:        selinux-policy-targeted-3.14.5-40.fc32.noarch
reason:         SELinux is preventing cups-pdf from 'create' accesses on the unix_dgram_socket labeled cups_pdf_t.
type:           libreport

Comment 9 Zdenek Pytela 2020-08-11 15:38:13 UTC
*** Bug 1862206 has been marked as a duplicate of this bug. ***

Comment 10 Jerry James 2020-10-02 22:40:26 UTC
Similar problem has been detected:

I attempted to print a file with cups-pdf.

hashmarkername: setroubleshoot
kernel:         5.8.12-200.fc32.x86_64
package:        selinux-policy-targeted-3.14.5-43.fc32.noarch
reason:         SELinux is preventing cups-pdf from 'create' accesses on the unix_dgram_socket labeled cups_pdf_t.
type:           libreport

Comment 12 dan 2020-10-28 16:48:35 UTC
Bumped to FC33.

Comment 13 Robert Marcano 2020-11-03 13:15:24 UTC
(In reply to Richard Fiľo from comment #11)
> I propose this fix.
> 
> PR:https://github.com/fedora-selinux/selinux-policy-contrib/pull/337
> 
> Link to scratch
> build:https://download.copr.fedorainfracloud.org/results/rfilo/Selinux-
> policy-f32/fedora-32-x86_64/01694783-selinux-policy/

Thanks Richard for your policy patch, do you plan to fix the formatting review on it or do you want I take it from here?

Comment 14 Robert Marcano 2020-11-03 14:13:04 UTC
*** Bug 1881243 has been marked as a duplicate of this bug. ***

Comment 15 Zdenek Pytela 2020-11-09 08:19:49 UTC
*** Bug 1895576 has been marked as a duplicate of this bug. ***

Comment 16 Zdenek Pytela 2020-11-09 08:21:26 UTC
Note backporting to F32 is needed, too.

Comment 17 Fedora Update System 2020-12-09 14:37:01 UTC
FEDORA-2020-aff0be81b3 has been submitted as an update to Fedora 33. https://bodhi.fedoraproject.org/updates/FEDORA-2020-aff0be81b3

Comment 18 Fedora Update System 2020-12-11 00:04:13 UTC
FEDORA-2020-aff0be81b3 has been pushed to the Fedora 33 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-aff0be81b3`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-aff0be81b3

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 19 Fedora Update System 2020-12-12 01:04:49 UTC
FEDORA-2020-aff0be81b3 has been pushed to the Fedora 33 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 20 Jaroslav Škarvada 2021-01-19 20:11:22 UTC
Similar problem has been detected:

I always happen when creating pdf file - printing to cups-pdf printer.

hashmarkername: setroubleshoot
kernel:         5.10.7-100.fc32.x86_64
package:        selinux-policy-targeted-3.14.5-45.fc32.noarch
reason:         SELinux is preventing cups-pdf from 'create' accesses on the unix_dgram_socket Neznámé.
type:           libreport


Note You need to log in before you can comment on or make changes to this bug.