Red Hat Bugzilla – Bug 419191
SELinux is preventing /usr/bin/hpijs (cupsd_t) "execute_no_trans" to /usr/bin/hpijs (hplip_exec_t).
Last modified: 2008-01-30 14:19:41 EST
Description of problem: Summary SELinux is preventing /usr/bin/hpijs (cupsd_t) "execute_no_trans" to /usr/bin/hpijs (hplip_exec_t). Detailed Description SELinux denied access requested by /usr/bin/hpijs. It is not expected that this access is required by /usr/bin/hpijs and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /usr/bin/hpijs, restorecon -v /usr/bin/hpijs If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Additional Information Source Context system_u:system_r:cupsd_t:SystemLow-SystemHigh Target Context system_u:object_r:hplip_exec_t Target Objects /usr/bin/hpijs [ file ] Affected RPM Packages hpijs-1.7.4a-6.fc7 [application]hpijs-1.7.4a-6.fc7 [target] Policy RPM selinux-policy-2.6.4-61.fc7 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name plugins.catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.23.8-34.fc7 #1 SMP Thu Nov 22 23:05:33 EST 2007 i686 athlon Alert Count 3 First Seen Mon 10 Dec 2007 06:55:49 PM PST Last Seen Mon 10 Dec 2007 07:14:58 PM PST Local ID a789b652-60bc-44d3-bc07-9fbd093cf32c Line Numbers Raw Audit Messages avc: denied { execute_no_trans } for comm="hpijs" dev=sda2 egid=7 euid=4 exe="/usr/bin/hpijs" exit=0 fsgid=7 fsuid=4 gid=7 items=0 path="/usr/bin/hpijs" pid=3454 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 sgid=7 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 suid=4 tclass=file tcontext=system_u:object_r:hplip_exec_t:s0 tty=(none) uid=4 Version-Release number of selected component (if applicable): How reproducible: Send item to print wifi on network printer from laptop. Steps to Reproduce: 1.Send item to printer wifi from printer 2. 3. Actual results: No printer output. Expected results: Printer output Additional info: Disabling or changing SELinux to "Permissive" allows printer output with SELinux icon appearing. restorecon -v /usr/bin/hpijs did not work.
Created attachment 284751 [details] 4 SELinux failures (when permissive) printing an image After I set up an HP OfficeJet 5610, I saw these 4 SELinux failures (when in permissive mode) when trying to print an image using hp-print or hp-toolbox. In enforcing mode, the first one caused printing to fail (but the job stayed in the queue). Oddly enough, I didn't have this problem when I was using a PSC 1610, doing pretty much the same things.
What does 'rpm -q selinux-policy-targeted' say?
Oh, never mind, it's selinux-policy-2.6.4-61.fc7.
dwalsh: I've tried selinux-policy-2.6.4-62.fc7 from koji and it nearly works. The only problem is that /var/spool/cups is getting context var_spool_t which is incorrect. This line seems to have been removed from cups.fc: /var/spool/cups(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh) After doing this: chcon -R system_u:object_r:print_spool_t /var/spool/cups then printing to an HP PSC 2210 works fine without any audit messages with selinux-policy-2.6.4-62.fc7, so we just need to get the file context right on the spool directory.
Created attachment 287421 [details] policy-cups-spool.patch Here's an incremental patch to do that.
*** Bug 422761 has been marked as a duplicate of this bug. ***
Fixed path in selinux-policy-2.6.4-63.fc7
Bulk closing all bugs in Fedora updates in the modified state. If you bug is not fixed, please reopen.