Description of problem: * the lpd prints the file successfully, but 1 SELinux denial appears Version-Release number of selected component (if applicable): cups-2.3.3op2-9.fc35.x86_64 cups-client-2.3.3op2-9.fc35.x86_64 cups-filesystem-2.3.3op2-9.fc35.noarch cups-filters-1.28.10-1.fc35.x86_64 cups-filters-libs-1.28.10-1.fc35.x86_64 cups-ipptool-2.3.3op2-9.fc35.x86_64 cups-libs-2.3.3op2-9.fc35.x86_64 cups-lpd-2.3.3op2-9.fc35.x86_64 selinux-policy-35.5-1.fc35.noarch selinux-policy-devel-35.5-1.fc35.noarch selinux-policy-targeted-35.5-1.fc35.noarch How reproducible: * always Steps to Reproduce: 1. get a Fedora 35 machine (targeted policy is active) 2. # systemctl start cups.service 3. # systemctl enable cups-lpd.socket 4. # systemctl start cups-lpd.socket 5. # lpadmin -p test -o printer-is-shared=true -E 6. # DEVICE_URI=lpd://127.0.0.1/test /usr/lib/cups/backend/lpd 1 user test 1 '' /etc/fstab 7. search for SELinux denials Actual results: ---- type=PROCTITLE msg=audit(11/05/2021 04:11:18.023:728) : proctitle=/usr/lib/cups/daemon/cups-lpd type=PATH msg=audit(11/05/2021 04:11:18.023:728) : item=0 name=/proc/1/environ nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(11/05/2021 04:11:18.023:728) : cwd=/ type=SYSCALL msg=audit(11/05/2021 04:11:18.023:728) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0xffffff9c a1=0x7ffc7f4b0f60 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=16668 auid=unset uid=lp gid=lp euid=lp suid=lp fsuid=lp egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-lpd exe=/usr/lib/cups/daemon/cups-lpd subj=system_u:system_r:cupsd_lpd_t:s0 key=(null) type=AVC msg=audit(11/05/2021 04:11:18.023:728) : avc: denied { search } for pid=16668 comm=cups-lpd name=1 dev="proc" ino=13409 scontext=system_u:system_r:cupsd_lpd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=dir permissive=0 ---- Expected results: * no SELinux denials
The same SELinux denial appears in permissive mode: ---- type=PROCTITLE msg=audit(11/05/2021 04:30:31.873:931) : proctitle=/usr/lib/cups/daemon/cups-lpd type=PATH msg=audit(11/05/2021 04:30:31.873:931) : item=0 name=/proc/1/environ inode=13550 dev=00:16 mode=file,400 ouid=root ogid=root rdev=00:00 obj=system_u:system_r:init_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(11/05/2021 04:30:31.873:931) : cwd=/ type=SYSCALL msg=audit(11/05/2021 04:30:31.873:931) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0xffffff9c a1=0x7ffd27408890 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=17628 auid=unset uid=lp gid=lp euid=lp suid=lp fsuid=lp egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-lpd exe=/usr/lib/cups/daemon/cups-lpd subj=system_u:system_r:cupsd_lpd_t:s0 key=(null) type=AVC msg=audit(11/05/2021 04:30:31.873:931) : avc: denied { search } for pid=17628 comm=cups-lpd name=1 dev="proc" ino=13409 scontext=system_u:system_r:cupsd_lpd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=dir permissive=1 ----
I've undrafted the existing PR: https://github.com/fedora-selinux/selinux-policy/pull/773 which should be sufficient because: # sesearch --dontaudit -s daemon -t init_t -ds dontaudit daemon init_t:dir { getattr open search }; dontaudit daemon init_t:fd use; dontaudit daemon init_t:file { getattr ioctl lock open read };
FEDORA-2021-ea3fa543f0 has been submitted as an update to Fedora 35. https://bodhi.fedoraproject.org/updates/FEDORA-2021-ea3fa543f0
FEDORA-2021-ea3fa543f0 has been pushed to the Fedora 35 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-ea3fa543f0` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-ea3fa543f0 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2021-ea3fa543f0 has been pushed to the Fedora 35 stable repository. If problem still persists, please make note of it in this bug report.