Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: Print to pdf via cups-pdf SELinux is preventing cups-pdf from 'create' accesses on the unix_dgram_socket labeled cups_pdf_t. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that cups-pdf should be allowed create access on unix_dgram_socket labeled cups_pdf_t by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'cups-pdf' --raw | audit2allow -M my-cupspdf # semodule -X 300 -i my-cupspdf.pp Additional Information: Source Context system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 Target Context system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 Target Objects Unknown [ unix_dgram_socket ] Source cups-pdf Source Path cups-pdf Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-3.14.5-32.fc32.noarch Local Policy RPM selinux-policy-targeted-3.14.5-32.fc32.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 5.6.7-300.fc32.x86_64 #1 SMP Thu Apr 23 14:13:50 UTC 2020 x86_64 x86_64 Alert Count 3 First Seen 2020-05-03 12:00:12 EDT Last Seen 2020-05-06 14:42:00 EDT Local ID 6980984e-733f-494a-b8d9-cd08ae9bf284 Raw Audit Messages type=AVC msg=audit(1588790520.227:16195): avc: denied { create } for pid=151815 comm="cups-pdf" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0 Hash: cups-pdf,cups_pdf_t,cups_pdf_t,unix_dgram_socket,create Version-Release number of selected component: selinux-policy-targeted-3.14.5-32.fc32.noarch Additional info: component: selinux-policy reporter: libreport-2.12.0 hashmarkername: setroubleshoot kernel: 5.6.7-300.fc32.x86_64 type: libreport
Dan, Apart from the denial, is there any actual problem with how the pdf cups filter works? Would you mind collecting any possible additional denials? setenforce 0 <reproduce the issue> setenforce 1 ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts recent
The data is printed properly to file. Here is the ouput requested: ---- type=AVC msg=audit(05/11/2020 11:01:32.253:41189) : avc: denied { create } for pid=394766 comm=cups-pdf scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1 ---- type=AVC msg=audit(05/11/2020 11:01:32.253:41190) : avc: denied { connect } for pid=394766 comm=cups-pdf scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1 ----
Caught in enforcing mode: ---- type=PROCTITLE msg=audit(05/12/2020 07:59:25.714:871) : proctitle=cups-pdf:/ 1 unconfined-user Fedora 1 LogType=7 PageSize=A4 PDFVer=1.2 Label=2 number-up=1 noCollate Truncate=64 Resolution=300d type=SYSCALL msg=audit(05/12/2020 07:59:25.714:871) : arch=x86_64 syscall=socket success=no exit=EACCES(Permission denied) a0=local a1=SOCK_DGRAM a2=ip a3=0x7ffe9f87c8d8 items=0 ppid=1717 pid=9823 auid=unset uid=root gid=lp euid=root suid=root fsuid=root egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-pdf exe=/usr/lib/cups/backend/cups-pdf subj=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(05/12/2020 07:59:25.714:871) : avc: denied { create } for pid=9823 comm=cups-pdf scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0 ----
Caught in permissive mode: ---- type=PROCTITLE msg=audit(05/12/2020 08:02:15.828:952) : proctitle=cups-pdf:/ 2 unconfined-user Fedora 1 LogType=7 PageSize=A4 PDFVer=1.2 Label=2 number-up=1 noCollate Truncate=64 Resolution=300d type=SYSCALL msg=audit(05/12/2020 08:02:15.828:952) : arch=x86_64 syscall=socket success=yes exit=10 a0=local a1=SOCK_DGRAM a2=ip a3=0x7fffc5abe568 items=0 ppid=1717 pid=10759 auid=unset uid=root gid=lp euid=root suid=root fsuid=root egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-pdf exe=/usr/lib/cups/backend/cups-pdf subj=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(05/12/2020 08:02:15.828:952) : avc: denied { create } for pid=10759 comm=cups-pdf scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1 ---- type=PROCTITLE msg=audit(05/12/2020 08:02:15.828:953) : proctitle=cups-pdf:/ 2 unconfined-user Fedora 1 LogType=7 PageSize=A4 PDFVer=1.2 Label=2 number-up=1 noCollate Truncate=64 Resolution=300d type=SOCKADDR msg=audit(05/12/2020 08:02:15.828:953) : saddr={ saddr_fam=local path=userdb-f7c9ae500fe25f0769d207a8240334ca } type=SYSCALL msg=audit(05/12/2020 08:02:15.828:953) : arch=x86_64 syscall=connect success=no exit=ECONNREFUSED(Connection refused) a0=0xa a1=0x7fffc5abe880 a2=0x2a a3=0x7fffc5abe568 items=0 ppid=1717 pid=10759 auid=unset uid=root gid=lp euid=root suid=root fsuid=root egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-pdf exe=/usr/lib/cups/backend/cups-pdf subj=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(05/12/2020 08:02:15.828:953) : avc: denied { connect } for pid=10759 comm=cups-pdf scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1 ----
I also have the issue and https://bugzilla.redhat.com/show_bug.cgi?id=1829853 seems to be a duplicate. No "real" issue detected so far, cups-pdf seems to work as usual, just the warning is unsettling. $ rpm -qa | grep -e cups-pdf -e selinux-policy selinux-policy-3.14.5-38.fc32.noarch cups-pdf-3.0.1-9.fc32.x86_64 selinux-policy-minimum-3.14.5-38.fc32.noarch selinux-policy-targeted-3.14.5-38.fc32.noarch Raw Audit Messages type=AVC msg=audit(1589785422.397:383): avc: denied { create } for pid=8790 comm="cups-pdf" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0 Hash: cups-pdf,cups_pdf_t,cups_pdf_t,unix_dgram_socket,create
*** Bug 1829853 has been marked as a duplicate of this bug. ***
The source code of cups-pdf doesn't create any socket, It must be a dependency that does it and now it uses a different socket type, because the policy already has [1] allow cups_pdf_t self:unix_stream_socket create_stream_socket_perms; for stream sockets. I will try to check the reason of this datagram socket creation, but I am on a heavily locked down country, my land based internet is dead, and phone tethering is at sub 100kb/s speeds, so I am still not using Fedora 32. [1] https://github.com/fedora-selinux/selinux-policy-contrib/blob/b35f071eace9e06117f78cdda3dd6692388dff6f/cups.te#L613
Similar problem has been detected: Have installed the standard cups-pdf package (v3.0.1-9) on Fedora 32. From a Firefox web page, sepected "print", and CUps-PDF as my printer. SELinux alert popped up immediately. Entered the commands (under root) the error dialogue suggested for allowing the function: ausearch -c 'cups-pdf' --raw | audit2allow -M my-cupspdf semodule -X 300 -i my-cupspdf.pp then tried the same print again. A second, identical SELinux alert popped up. ---------------------------------- Expected behavior would be that the Cups-PDF package would set up it's correct permissions. hashmarkername: setroubleshoot kernel: 5.6.18-300.fc32.x86_64 package: selinux-policy-targeted-3.14.5-40.fc32.noarch reason: SELinux is preventing cups-pdf from 'create' accesses on the unix_dgram_socket labeled cups_pdf_t. type: libreport
*** Bug 1862206 has been marked as a duplicate of this bug. ***
Similar problem has been detected: I attempted to print a file with cups-pdf. hashmarkername: setroubleshoot kernel: 5.8.12-200.fc32.x86_64 package: selinux-policy-targeted-3.14.5-43.fc32.noarch reason: SELinux is preventing cups-pdf from 'create' accesses on the unix_dgram_socket labeled cups_pdf_t. type: libreport
I propose this fix. PR:https://github.com/fedora-selinux/selinux-policy-contrib/pull/337 Link to scratch build:https://download.copr.fedorainfracloud.org/results/rfilo/Selinux-policy-f32/fedora-32-x86_64/01694783-selinux-policy/
Bumped to FC33.
(In reply to Richard Fiľo from comment #11) > I propose this fix. > > PR:https://github.com/fedora-selinux/selinux-policy-contrib/pull/337 > > Link to scratch > build:https://download.copr.fedorainfracloud.org/results/rfilo/Selinux- > policy-f32/fedora-32-x86_64/01694783-selinux-policy/ Thanks Richard for your policy patch, do you plan to fix the formatting review on it or do you want I take it from here?
*** Bug 1881243 has been marked as a duplicate of this bug. ***
*** Bug 1895576 has been marked as a duplicate of this bug. ***
Note backporting to F32 is needed, too.
FEDORA-2020-aff0be81b3 has been submitted as an update to Fedora 33. https://bodhi.fedoraproject.org/updates/FEDORA-2020-aff0be81b3
FEDORA-2020-aff0be81b3 has been pushed to the Fedora 33 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-aff0be81b3` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-aff0be81b3 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2020-aff0be81b3 has been pushed to the Fedora 33 stable repository. If problem still persists, please make note of it in this bug report.
Similar problem has been detected: I always happen when creating pdf file - printing to cups-pdf printer. hashmarkername: setroubleshoot kernel: 5.10.7-100.fc32.x86_64 package: selinux-policy-targeted-3.14.5-45.fc32.noarch reason: SELinux is preventing cups-pdf from 'create' accesses on the unix_dgram_socket Neznámé. type: libreport