Bug 240914 - SELinux is preventing /sbin/alsactl (alsa_t) "write" to etc (etc_t).
Summary: SELinux is preventing /sbin/alsactl (alsa_t) "write" to etc (etc_t).
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted   
(Show other bugs)
Version: rawhide
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Ben Levenson
Depends On:
TreeView+ depends on / blocked
Reported: 2007-05-22 20:19 UTC by Mauri Korkeala
Modified: 2007-11-30 22:12 UTC (History)
0 users

Fixed In Version: Current
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-08-22 14:14:00 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

Description Mauri Korkeala 2007-05-22 20:19:53 UTC
Description of problem:

I installed rawhide this evening and then debugged suspend/resume by executing
pm-suspend withdifferent quirks. After I found out working one, I noticed that
following entry exists in the SELinux troubleshooter. I cannot say at which
point the entry was logged.

SELinux is preventing /sbin/alsactl (alsa_t) "write" to etc (etc_t).

Detailed Description
SELinux is preventing /sbin/alsactl (alsa_t) "write" to etc (etc_t). The SELinux
type %TARGET_TYPE, is a generic type for all files in the directory and very few
processes (SELinux Domains) are allowed to write to this SELinux type. This type
of denial usual indicates a mislabeled file. By default a file created in a
directory has the gets the context of the parent directory, but SELinux policy
has rules about the creation of directories, that say if a process running in
one SELinux Domain (D1) creates a file in a directory with a particular SELinux
File Context (F1) the file gets a different File Context (F2). The policy
usually allows the SELinux Domain (D1) the ability to write or append on (F2).
But if for some reason a file (etc) was created with the wrong context, this
domain will be denied. The usual solution to this problem is to reset the file
context on the target file, restorecon -v etc. If the file context does not
change from etc_t, then this is probably a bug in policy. Please file a bug
report against the selinux-policy package. If it does change, you can try your
application again to see if it works. The file context could have been
mislabeled by editing the file or moving the file from a different directory, if
the file keeps getting mislabeled, check the init scripts to see if they are
doing something to mislabel the file.

Allowing Access
You can attempt to fix file context by executing restorecon -v etcThe following
command will allow this access:
restorecon etc

Additional Information
Source Context:  system_u:system_r:alsa_t
Target Context:  system_u:object_r:etc_t
Target Objects:  etc [ dir ]
Affected RPM Packages:  alsa-utils-1.0.14-0.5.rc2.fc7
[application]filesystem-2.4.6-1.fc7 [target]
Policy RPM:  selinux-policy-2.6.4-6.fc7
Selinux Enabled:  True
Policy Type:  targeted
MLS Enabled:  True
Enforcing Mode:  Enforcing
Plugin Name:  plugins.mislabeled_file
Host Name:  localhost.localdomain
Platform:  Linux localhost.localdomain 2.6.21-1.3167.fc7 #1 SMP Thu May 17
23:05:53 EDT 2007 i686 i686
Alert Count:  1
First Seen:  Tue 22 May 2007 09:52:21 PM EEST
Last Seen:  Tue 22 May 2007 09:52:21 PM EEST
Local ID:  6f07ece1-c20b-4b6d-a432-641ebc8fb82f
Line Numbers:  

Raw Audit Messages :avc: denied { write } for comm="alsactl" dev=dm-0 egid=0
euid=0 exe="/sbin/alsactl" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name="etc"
pid=2762 scontext=system_u:system_r:alsa_t:s0 sgid=0
subj=system_u:system_r:alsa_t:s0 suid=0 tclass=dir
tcontext=system_u:object_r:etc_t:s0 tty=(none) uid=0

Comment 1 Daniel Walsh 2007-05-23 13:41:50 UTC
Fixed in selinux-policy-2.6.4-9.fc7

Comment 2 Daniel Walsh 2007-08-22 14:14:00 UTC
Should be fixed in the current release

Note You need to log in before you can comment on or make changes to this bug.