Bug 395831 - SELinux denied access requested by /usr/sbin/semodule.
SELinux denied access requested by /usr/sbin/semodule.
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
7
i686 Linux
low Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2007-11-22 11:43 EST by Michael Schumann
Modified: 2008-01-30 14:19 EST (History)
0 users

See Also:
Fixed In Version: Current
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-01-30 14:19:56 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Michael Schumann 2007-11-22 11:43:13 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; de; rv:1.8.1.9) Gecko/20071105 Fedora/2.0.0.9-1.fc7 Firefox/2.0.0.9

Description of problem:
Summary
    SELinux is preventing /usr/sbin/semodule (semanage_t) "write" to
    pipe:[57087] (rpm_t).

Detailed Description
    SELinux denied access requested by /usr/sbin/semodule. It is not expected
    that this access is required by /usr/sbin/semodule and this access may
    signal an intrusion attempt. It is also possible that the specific version
    or configuration of the application is causing it to require additional
    access.

Allowing Access
    You can generate a local policy module to allow this access - see
    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
    SELinux protection altogether. Disabling SELinux protection is not
    recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
    against this package.

Additional Information        

Source Context                system_u:system_r:semanage_t
Target Context                system_u:system_r:rpm_t
Target Objects                pipe:[57087] [ fifo_file ]
Affected RPM Packages         policycoreutils-2.0.16-15.fc7 [application]
Policy RPM                    selinux-policy-2.6.4-49.fc7
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   plugins.catchall
Host Name                     urka1.urkanet
Platform                      Linux urka1.urkanet 2.6.22.9-91.fc7 #1 SMP Thu Sep
                              27 23:10:59 EDT 2007 i686 i686
Alert Count                   2
First Seen                    Do 22 Nov 2007 12:26:50 CET
Last Seen                     Do 22 Nov 2007 12:26:51 CET
Local ID                      bf625acc-6f24-43be-8d53-9806970c21a1
Line Numbers                  

Raw Audit Messages            

avc: denied { write } for comm="semodule" dev=pipefs egid=0 euid=0
exe="/usr/sbin/semodule" exit=0 fsgid=0 fsuid=0 gid=0 items=0 name=""
path="pipe:[57087]" pid=8779 scontext=system_u:system_r:semanage_t:s0 sgid=0
subj=system_u:system_r:semanage_t:s0 suid=0 tclass=fifo_file
tcontext=system_u:system_r:rpm_t:s0 tty=(none) uid=0



Version-Release number of selected component (if applicable):
policycoreutils-2.0.16-15.fc7 [application]; selinux-policy-2.6.4-49.fc7

How reproducible:
Didn't try


Steps to Reproduce:
1. Have seen this bug only once
2.
3.

Actual Results:


Expected Results:


Additional info:
Comment 1 Daniel Walsh 2007-11-26 11:14:43 EST
You can allow this for now by executing 

# audit2allow -M mypol -i /var/log/audit/audit.log 
# semodule -i mypol.pp

Fixed in selinux-policy-2.6.4-59.fc7
Comment 2 Daniel Walsh 2008-01-30 14:19:56 EST
Bulk closing all bugs in Fedora updates in the modified state.  If you bug is
not fixed, please reopen.

Note You need to log in before you can comment on or make changes to this bug.