Bug 252365 - xdm related denials
Summary: xdm related denials
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
(Show other bugs)
Version: rawhide
Hardware: All Linux
low
low
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Keywords: Reopened
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-08-15 17:16 UTC by Orion Poplawski
Modified: 2008-04-06 10:55 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-04-06 10:55:15 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description Orion Poplawski 2007-08-15 17:16:50 UTC
Description of problem:

Aug 15 10:46:39 lynx kernel: audit(1187196399.963:20): avc:  denied  { search }
for  pid=2867 comm="X" name="xauth" dev=sda6 ino=71455
scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023
tcontext=system_u:object_r:xdm_var_run_t:s0 tclass=dir
Aug 15 10:46:40 lynx kernel: audit(1187196400.012:21): avc:  denied  { ptrace }
for  pid=2907 comm="pidof" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process

Version-Release number of selected component (if applicable):
selinux-policy-3.0.5-7.fc8

Comment 1 Orion Poplawski 2007-08-15 17:29:38 UTC
restorecon -r -v /var yields:

restorecon reset /var/run/xauth context
system_u:object_r:xdm_var_run_t:s0->system_u:object_r:var_run_t:s0
restorecon reset /var/run/xauth/A:0-K73P5Q context
system_u:object_r:xdm_var_run_t:s0->system_u:object_r:var_run_t:s0

That seems to fix the xauth errors, but not the pidof errors.  Not sure why the
context isn't set properly during install or initial boot.

Comment 2 Daniel Walsh 2007-08-20 20:49:03 UTC
Fixed in selinux-policy-3.0.5-9

Comment 3 Daniel Walsh 2007-09-12 17:00:42 UTC
ALready fixed in rawhide


Comment 4 Orion Poplawski 2008-04-06 03:55:48 UTC
Seeing 5 of these on boot in current rawhide:

type=1400 audit(1207452763.258:9): avc:  denied  { ptrace } for  pid=3219
comm="pidof" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
tcontext=system_u:system_r:init_t:s0 tclass=process

selinux-policy-3.3.1-26.fc9.noarch

Comment 5 Daniel Walsh 2008-04-06 10:55:15 UTC
You can allow this for now by executing 

# audit2allow -M mypol -i /var/log/audit/audit.log 
# semodule -i mypol.pp

Fixed in selinux-policy-3.3.1-29.fc9


Note You need to log in before you can comment on or make changes to this bug.