Bug 189561 - cupsd avc denial
cupsd avc denial
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: cups (Show other bugs)
rawhide
All Linux
medium Severity medium
: ---
: ---
Assigned To: Tim Waugh
: Reopened
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2006-04-20 22:48 EDT by Dave Jones
Modified: 2015-01-04 17:26 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-05-22 12:57:08 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Dave Jones 2006-04-20 22:48:21 EDT
on startup..

type=AVC msg=audit(1145584029.314:7): avc:  denied  { setattr } for  pid=2669
comm="cupsd" name="cups" dev=dm-0 ino=10453024
scontext=system_u:system_r:cupsd_t:s0-s0:c0.c255
tcontext=user_u:object_r:var_run_t:s0 tclass=dir
Comment 1 Habig, Alec 2006-04-24 08:08:29 EDT
Similar but a bit different here:

type=AVC msg=audit(1145879719.492:48): avc:  denied  { getattr } for  pid=3377
comm="sh" name="audit" dev=sda1 ino=589290 scontext=root:system_r:cupsd_t tcontex
t=system_u:object_r:auditd_log_t tclass=dir

libselinux-1.23.11-1.1, selinux-policy-targeted-1.27.1-2.28, cups-1.1.23-15.4

Did an autorelabel on the filesystem, didn't help.

  setsebool -P cupsd_disable_trans 1

makes the AVC error go away, but is a pretty blunt instrument.
Comment 2 Daniel Walsh 2006-04-24 20:37:14 EDT
First on is a labeling problem.  

restorecon -R -v /var/run/cups

Any idea how it got mislabled?

On the second,

Disabling cups should not be done.  I know of no reason why cups would getattr
on the auditlog???

Comment 3 Dave Jones 2006-04-25 00:49:32 EDT
no idea how it got mislabelled.  This box got installed with FC5 a few weeks
back, and updated to rawhide a few days after FC5-GA.  I've never booted this
install with selinux=0, and I don't recall even running setenforce on this box
in the last few weeks.
Comment 4 Daniel Walsh 2006-04-25 09:45:42 EDT
Tim does this directory get created outside of the RPM ?

Dan
Comment 5 Tim Waugh 2006-04-25 10:02:26 EDT
Oops, the only reference to this directory in the file manifest is this:

%dir %attr(0511,lp,sys) /var/run/cups/certs

I'll add this before it:

%dir %attr(0755,root,lp) /var/run/cups
Comment 6 Tim Waugh 2006-04-25 10:05:07 EDT
Fixed in CVS.
Comment 8 Tim Waugh 2006-05-12 12:26:35 EDT
Fixed in 1.2.0-1.1.

Note You need to log in before you can comment on or make changes to this bug.