Bug 248147 (Smeagol) - SELinux is preventing /usr/bin/mono (mono_t) "write" to fscreate (getty_t).
Summary: SELinux is preventing /usr/bin/mono (mono_t) "write" to fscreate (getty_t).
Keywords:
Status: CLOSED INSUFFICIENT_DATA
Alias: Smeagol
Product: Fedora
Classification: Fedora
Component: mono
Version: 7
Hardware: x86_64
OS: Linux
low
low
Target Milestone: ---
Assignee: Xavier Lamien
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-07-13 13:55 UTC by Mark
Modified: 2008-08-02 23:40 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-04-25 04:18:51 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Mark 2007-07-13 13:55:30 UTC
Description of problem:
Summary
    SELinux is preventing /usr/bin/mono (mono_t) "write" to fscreate (getty_t).

Detailed Description
    SELinux denied access requested by /usr/bin/mono. It is not expected that
    this access is required by /usr/bin/mono and this access may signal an
    intrusion attempt. It is also possible that the specific version or
    configuration of the application is causing it to require additional access.

Allowing Access
    Sometimes labeling problems can cause SELinux denials.  You could try to
    restore the default system file context for fscreate, restorecon -v fscreate
    If this does not work, there is currently no automatic way to allow this
    access. Instead,  you can generate a local policy module to allow this
    access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you
    can disable SELinux protection altogether. Disabling SELinux protection is
    not recommended. Please file a
    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.

Additional Information        

Source Context                user_u:system_r:mono_t
Target Context                system_u:system_r:getty_t
Target Objects                fscreate [ file ]
Affected RPM Packages         mono-core-1.2.3-3.fc7 [application]
Policy RPM                    selinux-policy-2.6.4-26.fc7
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   plugins.catchall_file
Host Name                     europa
Platform                      Linux europa 2.6.21-1.3228.fc7 #1 SMP Tue Jun 12
                              14:56:37 EDT 2007 x86_64 x86_64
Alert Count                   3
First Seen                    Thu 12 Jul 2007 09:53:03 PM EST
Last Seen                     Thu 12 Jul 2007 09:53:17 PM EST
Local ID                      fa2ba029-3d00-4b5c-bbc1-6bb6e9b8ec7a
Line Numbers                  

Raw Audit Messages            

avc: denied { write } for comm="beagled" dev=proc egid=500 euid=500
exe="/usr/bin/mono" exit=-13 fsgid=500 fsuid=500 gid=500 items=0 name="fscreate"
pid=9146 scontext=user_u:system_r:mono_t:s0 sgid=500
subj=user_u:system_r:mono_t:s0 suid=500 tclass=file
tcontext=system_u:system_r:getty_t:s0 tty=(none) uid=500



Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 1 Alexander Larsson 2007-07-24 07:57:15 UTC
Seems to be beagle related.
I dunno what "fscreate" is though... Maybe its xattr writing? Do you have xattrs
enabled?

Comment 2 Brian Powell 2008-04-25 04:18:51 UTC
The information we've requested above is required in order
to review this problem report further and diagnose/fix the
issue if it is still present.  Since there have not been any
updates to the report since thirty (30) days or more since we
requested additional information, we're assuming the problem
is either no longer present in the current Fedora release, or
that there is no longer any interest in tracking the problem.

Setting status to "CLOSED INSUFFICIENT_DATA".  If you still
experience this problem after updating to our latest Fedora
release and can provide the information previously requested, 
please feel free to reopen the bug report.

Thank you in advance.

Note that maintenance for Fedora 7 will end 30 days after the GA of Fedora 9.


Note You need to log in before you can comment on or make changes to this bug.