Bug 419191 - SELinux is preventing /usr/bin/hpijs (cupsd_t) "execute_no_trans" to /usr/bin/hpijs (hplip_exec_t).
Summary: SELinux is preventing /usr/bin/hpijs (cupsd_t) "execute_no_trans" to /usr/bin...
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy   
(Show other bugs)
Version: 7
Hardware: i686
OS: Linux
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
: 422761 (view as bug list)
Depends On:
TreeView+ depends on / blocked
Reported: 2007-12-11 04:20 UTC by Al Takishita
Modified: 2008-01-30 19:19 UTC (History)
3 users (show)

Fixed In Version: Current
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-01-30 19:19:41 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
4 SELinux failures (when permissive) printing an image (9.08 KB, text/plain; charset=UTF-8)
2007-12-11 22:54 UTC, David Baron
no flags Details
policy-cups-spool.patch (528 bytes, patch)
2007-12-13 13:12 UTC, Tim Waugh
no flags Details | Diff

Description Al Takishita 2007-12-11 04:20:07 UTC
Description of problem:
    SELinux is preventing /usr/bin/hpijs (cupsd_t) "execute_no_trans" to
    /usr/bin/hpijs (hplip_exec_t).

Detailed Description
    SELinux denied access requested by /usr/bin/hpijs. It is not expected that
    this access is required by /usr/bin/hpijs and this access may signal an
    intrusion attempt. It is also possible that the specific version or
    configuration of the application is causing it to require additional access.

Allowing Access
    Sometimes labeling problems can cause SELinux denials.  You could try to
    restore the default system file context for /usr/bin/hpijs, restorecon -v
    /usr/bin/hpijs If this does not work, there is currently no automatic way to
    allow this access. Instead,  you can generate a local policy module to allow
    this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
    Or you can disable SELinux protection altogether. Disabling SELinux
    protection is not recommended. Please file a
    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.

Additional Information        

Source Context                system_u:system_r:cupsd_t:SystemLow-SystemHigh
Target Context                system_u:object_r:hplip_exec_t
Target Objects                /usr/bin/hpijs [ file ]
Affected RPM Packages         hpijs-1.7.4a-6.fc7 [application]hpijs-1.7.4a-6.fc7
Policy RPM                    selinux-policy-2.6.4-61.fc7
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Permissive
Plugin Name                   plugins.catchall_file
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain #1 SMP
                              Thu Nov 22 23:05:33 EST 2007 i686 athlon
Alert Count                   3
First Seen                    Mon 10 Dec 2007 06:55:49 PM PST
Last Seen                     Mon 10 Dec 2007 07:14:58 PM PST
Local ID                      a789b652-60bc-44d3-bc07-9fbd093cf32c
Line Numbers                  

Raw Audit Messages            

avc: denied { execute_no_trans } for comm="hpijs" dev=sda2 egid=7 euid=4
exe="/usr/bin/hpijs" exit=0 fsgid=7 fsuid=4 gid=7 items=0 path="/usr/bin/hpijs"
pid=3454 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 sgid=7
subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 suid=4 tclass=file
tcontext=system_u:object_r:hplip_exec_t:s0 tty=(none) uid=4

Version-Release number of selected component (if applicable):

How reproducible:
Send item to print wifi on network printer from laptop.

Steps to Reproduce:
1.Send item to printer wifi from printer
Actual results:
No printer output.

Expected results:
Printer output

Additional info:
Disabling or changing SELinux to "Permissive" allows printer output with SELinux  
icon appearing.
restorecon -v /usr/bin/hpijs did not work.

Comment 1 David Baron 2007-12-11 22:54:45 UTC
Created attachment 284751 [details]
4 SELinux failures (when permissive) printing an image

After I set up an HP OfficeJet 5610, I saw these 4 SELinux failures (when in
permissive mode) when trying to print an image using hp-print or hp-toolbox. 
In enforcing mode, the first one caused printing to fail (but the job stayed in
the queue).

Oddly enough, I didn't have this problem when I was using a PSC 1610, doing
pretty much the same things.

Comment 2 Tim Waugh 2007-12-13 12:26:59 UTC
What does 'rpm -q selinux-policy-targeted' say?

Comment 3 Tim Waugh 2007-12-13 12:28:45 UTC
Oh, never mind, it's selinux-policy-2.6.4-61.fc7.

Comment 4 Tim Waugh 2007-12-13 13:11:24 UTC
dwalsh: I've tried selinux-policy-2.6.4-62.fc7 from koji and it nearly works. 
The only problem is that /var/spool/cups is getting context var_spool_t which is
incorrect.  This line seems to have been removed from cups.fc:

/var/spool/cups(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh)

After doing this:

chcon -R system_u:object_r:print_spool_t /var/spool/cups

then printing to an HP PSC 2210 works fine without any audit messages with
selinux-policy-2.6.4-62.fc7, so we just need to get the file context right on
the spool directory.

Comment 5 Tim Waugh 2007-12-13 13:12:21 UTC
Created attachment 287421 [details]

Here's an incremental patch to do that.

Comment 6 Tim Waugh 2007-12-13 13:13:15 UTC
*** Bug 422761 has been marked as a duplicate of this bug. ***

Comment 7 Daniel Walsh 2007-12-13 15:56:59 UTC
Fixed path in  selinux-policy-2.6.4-63.fc7

Comment 8 Daniel Walsh 2008-01-30 19:19:41 UTC
Bulk closing all bugs in Fedora updates in the modified state.  If you bug is
not fixed, please reopen.

Note You need to log in before you can comment on or make changes to this bug.