Bug 2020531 - SELinux denial appears when printing via lpd (cups-lpd)
Summary: SELinux denial appears when printing via lpd (cups-lpd)
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 35
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 2039449
TreeView+ depends on / blocked
 
Reported: 2021-11-05 08:29 UTC by Milos Malik
Modified: 2022-01-11 17:59 UTC (History)
8 users (show)

Fixed In Version: selinux-policy-35.6-1.fc35
Clone Of:
: 2039449 (view as bug list)
Environment:
Last Closed: 2021-12-04 01:23:38 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Milos Malik 2021-11-05 08:29:08 UTC
Description of problem:
 * the lpd prints the file successfully, but 1 SELinux denial appears

Version-Release number of selected component (if applicable):
cups-2.3.3op2-9.fc35.x86_64
cups-client-2.3.3op2-9.fc35.x86_64
cups-filesystem-2.3.3op2-9.fc35.noarch
cups-filters-1.28.10-1.fc35.x86_64
cups-filters-libs-1.28.10-1.fc35.x86_64
cups-ipptool-2.3.3op2-9.fc35.x86_64
cups-libs-2.3.3op2-9.fc35.x86_64
cups-lpd-2.3.3op2-9.fc35.x86_64
selinux-policy-35.5-1.fc35.noarch
selinux-policy-devel-35.5-1.fc35.noarch
selinux-policy-targeted-35.5-1.fc35.noarch

How reproducible:
 * always

Steps to Reproduce:
1. get a Fedora 35 machine (targeted policy is active)
2. # systemctl start cups.service
3. # systemctl enable cups-lpd.socket
4. # systemctl start cups-lpd.socket
5. # lpadmin -p test -o printer-is-shared=true -E
6. # DEVICE_URI=lpd://127.0.0.1/test /usr/lib/cups/backend/lpd 1 user test 1 '' /etc/fstab
7. search for SELinux denials

Actual results:
----
type=PROCTITLE msg=audit(11/05/2021 04:11:18.023:728) : proctitle=/usr/lib/cups/daemon/cups-lpd 
type=PATH msg=audit(11/05/2021 04:11:18.023:728) : item=0 name=/proc/1/environ nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(11/05/2021 04:11:18.023:728) : cwd=/ 
type=SYSCALL msg=audit(11/05/2021 04:11:18.023:728) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0xffffff9c a1=0x7ffc7f4b0f60 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=16668 auid=unset uid=lp gid=lp euid=lp suid=lp fsuid=lp egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-lpd exe=/usr/lib/cups/daemon/cups-lpd subj=system_u:system_r:cupsd_lpd_t:s0 key=(null) 
type=AVC msg=audit(11/05/2021 04:11:18.023:728) : avc:  denied  { search } for  pid=16668 comm=cups-lpd name=1 dev="proc" ino=13409 scontext=system_u:system_r:cupsd_lpd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=dir permissive=0 
----

Expected results:
 * no SELinux denials

Comment 1 Milos Malik 2021-11-05 08:31:52 UTC
The same SELinux denial appears in permissive mode:
----
type=PROCTITLE msg=audit(11/05/2021 04:30:31.873:931) : proctitle=/usr/lib/cups/daemon/cups-lpd 
type=PATH msg=audit(11/05/2021 04:30:31.873:931) : item=0 name=/proc/1/environ inode=13550 dev=00:16 mode=file,400 ouid=root ogid=root rdev=00:00 obj=system_u:system_r:init_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(11/05/2021 04:30:31.873:931) : cwd=/ 
type=SYSCALL msg=audit(11/05/2021 04:30:31.873:931) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0xffffff9c a1=0x7ffd27408890 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=17628 auid=unset uid=lp gid=lp euid=lp suid=lp fsuid=lp egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-lpd exe=/usr/lib/cups/daemon/cups-lpd subj=system_u:system_r:cupsd_lpd_t:s0 key=(null) 
type=AVC msg=audit(11/05/2021 04:30:31.873:931) : avc:  denied  { search } for  pid=17628 comm=cups-lpd name=1 dev="proc" ino=13409 scontext=system_u:system_r:cupsd_lpd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=dir permissive=1 
----

Comment 6 Zdenek Pytela 2021-11-05 16:23:36 UTC
I've undrafted the existing PR:
https://github.com/fedora-selinux/selinux-policy/pull/773

which should be sufficient because:
# sesearch --dontaudit -s daemon -t init_t -ds
dontaudit daemon init_t:dir { getattr open search };
dontaudit daemon init_t:fd use;
dontaudit daemon init_t:file { getattr ioctl lock open read };

Comment 7 Fedora Update System 2021-11-29 16:03:27 UTC
FEDORA-2021-ea3fa543f0 has been submitted as an update to Fedora 35. https://bodhi.fedoraproject.org/updates/FEDORA-2021-ea3fa543f0

Comment 8 Fedora Update System 2021-11-30 02:19:04 UTC
FEDORA-2021-ea3fa543f0 has been pushed to the Fedora 35 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-ea3fa543f0`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-ea3fa543f0

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2021-12-04 01:23:38 UTC
FEDORA-2021-ea3fa543f0 has been pushed to the Fedora 35 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.