Description of problem: After last update of Fedora using Pirut, dated 2008-10-05, after any boot, a setroubleshoot popup appears showing 2 errors as below. I tried to run the suggested restorecon command, the command apparently had success, but at the subsequent boot, the problem reappeared. Sommario: SELinux is preventing nm-system-setti (NetworkManager_t) "read" to ./PolicyKit (hald_var_lib_t). Descrizione dettagliata: SELinux denied access requested by nm-system-setti. It is not expected that this access is required by nm-system-setti and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Abilitazione accesso in corso: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./PolicyKit, restorecon -v './PolicyKit' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Informazioni aggiuntive: Contesto della sorgente system_u:system_r:NetworkManager_t:s0-s0:c0.c1023 Contesto target system_u:object_r:hald_var_lib_t:s0 Oggetti target ./PolicyKit [ dir ] Source nm-system-setti Source Path /usr/sbin/nm-system-settings Port <Sconosciuto> Host quad.casa Source RPM Packages NetworkManager-0.7.0-0.11.svn4022.4.fc8 Target RPM Packages RPM della policy selinux-policy-3.0.8-117.fc8 Selinux abilitato True Tipo di policy targeted MLS abilitato True Modalità Enforcing Enforcing Nome plugin catchall_file Host Name quad.casa Piattaforma Linux quad.casa 2.6.23.15-137.fc8 #1 SMP Sun Feb 10 17:03:13 EST 2008 x86_64 x86_64 Conteggio allerte 3 First Seen lun 06 ott 2008 14:08:21 CEST Last Seen mar 07 ott 2008 13:57:14 CEST Local ID 2298e25b-8480-4740-b4c1-671a306d3a8f Numeri di linea Messaggi Raw Audit host=quad.casa type=AVC msg=audit(1223380634.394:26): avc: denied { read } for pid=3403 comm="nm-system-setti" name="PolicyKit" dev=dm-5 ino=7482361 scontext=system_u:system_r:NetworkManager_t:s0-s0:c0.c1023 tcontext=system_u:object_r:hald_var_lib_t:s0 tclass=dir host=quad.casa type=SYSCALL msg=audit(1223380634.394:26): arch=c000003e syscall=254 success=no exit=-13 a0=6 a1=33eae0914e a2=306 a3=302a1529f0 items=0 ppid=3402 pid=3403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="nm-system-setti" exe="/usr/sbin/nm-system-settings" subj=system_u:system_r:NetworkManager_t:s0-s0:c0.c1023 key=(null) Sommario: SELinux is preventing nm-system-setti (NetworkManager_t) "read" to ./PolicyKit (hald_var_lib_t). Descrizione dettagliata: SELinux denied access requested by nm-system-setti. It is not expected that this access is required by nm-system-setti and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Abilitazione accesso in corso: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./PolicyKit, restorecon -v './PolicyKit' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Informazioni aggiuntive: Contesto della sorgente system_u:system_r:NetworkManager_t:s0-s0:c0.c1023 Contesto target system_u:object_r:hald_var_lib_t:s0 Oggetti target ./PolicyKit [ dir ] Source nm-system-setti Source Path /usr/sbin/nm-system-settings Port <Sconosciuto> Host quad.casa Source RPM Packages NetworkManager-0.7.0-0.11.svn4022.4.fc8 Target RPM Packages RPM della policy selinux-policy-3.0.8-117.fc8 Selinux abilitato True Tipo di policy targeted MLS abilitato True Modalità Enforcing Enforcing Nome plugin catchall_file Host Name quad.casa Piattaforma Linux quad.casa 2.6.23.15-137.fc8 #1 SMP Sun Feb 10 17:03:13 EST 2008 x86_64 x86_64 Conteggio allerte 3 First Seen lun 06 ott 2008 14:08:21 CEST Last Seen mar 07 ott 2008 13:57:14 CEST Local ID 2298e25b-8480-4740-b4c1-671a306d3a8f Numeri di linea Messaggi Raw Audit host=quad.casa type=AVC msg=audit(1223380634.394:26): avc: denied { read } for pid=3403 comm="nm-system-setti" name="PolicyKit" dev=dm-5 ino=7482361 scontext=system_u:system_r:NetworkManager_t:s0-s0:c0.c1023 tcontext=system_u:object_r:hald_var_lib_t:s0 tclass=dir host=quad.casa type=SYSCALL msg=audit(1223380634.394:26): arch=c000003e syscall=254 success=no exit=-13 a0=6 a1=33eae0914e a2=306 a3=302a1529f0 items=0 ppid=3402 pid=3403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="nm-system-setti" exe="/usr/sbin/nm-system-settings" subj=system_u:system_r:NetworkManager_t:s0-s0:c0.c1023 key=(null) Version-Release number of selected component (if applicable): selinux-policy Version: 3.0.8 Release: 117.fc8 xorg-x11-xauth Version: 1.0.2 Release: 3.fc8 How reproducible: Standard Fedora 8 installation, with all updates installed. Steps to Reproduce: 1. Install Fedora 8 and latest updates 2. reboot and login
Fixed in selinux-policy-3.0.8-122.fc8
This message is a reminder that Fedora 8 is nearing its end of life. Approximately 30 (thirty) days from now Fedora will stop maintaining and issuing updates for Fedora 8. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '8'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 8's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 8 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora please change the 'version' of this bug to the applicable version. If you are unable to change the version, please add a comment here and someone will do it for you. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping
As this bug is in MODIFIED, Fedora believes that a fix has been committed that resolves the problem listed in this bug report. If this is not the case, please re-open this report, noting the version of the package that you reproduced the bug against. Thanks for the report!