Bug 465955 - SELinux is preventing su (initrc_su_t) "execute" to ./xauth (xauth_exec_t).
SELinux is preventing su (initrc_su_t) "execute" to ./xauth (xauth_exec_t).
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
8
x86_64 Linux
medium Severity low
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-10-07 08:45 EDT by Davide Rondini
Modified: 2008-11-26 12:37 EST (History)
4 users (show)

See Also:
Fixed In Version: F8
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-11-26 12:37:48 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Davide Rondini 2008-10-07 08:45:54 EDT
Description of problem:

After last update of Fedora using Pirut, dated 2008-10-05, after any boot, a setroubleshoot popup appears showing 2 errors as below. I tried to run the suggested restorecon command, the command apparently had success, but at the subsequent boot, the problem reappeared.

Sommario:

SELinux is preventing nm-system-setti (NetworkManager_t) "read" to ./PolicyKit
(hald_var_lib_t).

Descrizione dettagliata:

SELinux denied access requested by nm-system-setti. It is not expected that this
access is required by nm-system-setti and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Abilitazione accesso in corso:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./PolicyKit,

restorecon -v './PolicyKit'

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Informazioni aggiuntive:

Contesto della sorgente       system_u:system_r:NetworkManager_t:s0-s0:c0.c1023
Contesto target               system_u:object_r:hald_var_lib_t:s0
Oggetti target                ./PolicyKit [ dir ]
Source                        nm-system-setti
Source Path                   /usr/sbin/nm-system-settings
Port                          <Sconosciuto>
Host                          quad.casa
Source RPM Packages           NetworkManager-0.7.0-0.11.svn4022.4.fc8
Target RPM Packages           
RPM della policy              selinux-policy-3.0.8-117.fc8
Selinux abilitato             True
Tipo di policy                targeted
MLS abilitato                 True
Modalità Enforcing           Enforcing
Nome plugin                   catchall_file
Host Name                     quad.casa
Piattaforma                   Linux quad.casa 2.6.23.15-137.fc8 #1 SMP Sun Feb
                              10 17:03:13 EST 2008 x86_64 x86_64
Conteggio allerte             3
First Seen                    lun 06 ott 2008 14:08:21 CEST
Last Seen                     mar 07 ott 2008 13:57:14 CEST
Local ID                      2298e25b-8480-4740-b4c1-671a306d3a8f
Numeri di linea               

Messaggi Raw Audit            

host=quad.casa type=AVC msg=audit(1223380634.394:26): avc:  denied  { read } for  pid=3403 comm="nm-system-setti" name="PolicyKit" dev=dm-5 ino=7482361 scontext=system_u:system_r:NetworkManager_t:s0-s0:c0.c1023 tcontext=system_u:object_r:hald_var_lib_t:s0 tclass=dir

host=quad.casa type=SYSCALL msg=audit(1223380634.394:26): arch=c000003e syscall=254 success=no exit=-13 a0=6 a1=33eae0914e a2=306 a3=302a1529f0 items=0 ppid=3402 pid=3403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="nm-system-setti" exe="/usr/sbin/nm-system-settings" subj=system_u:system_r:NetworkManager_t:s0-s0:c0.c1023 key=(null)



Sommario:

SELinux is preventing nm-system-setti (NetworkManager_t) "read" to ./PolicyKit
(hald_var_lib_t).

Descrizione dettagliata:

SELinux denied access requested by nm-system-setti. It is not expected that this
access is required by nm-system-setti and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Abilitazione accesso in corso:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./PolicyKit,

restorecon -v './PolicyKit'

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Informazioni aggiuntive:

Contesto della sorgente       system_u:system_r:NetworkManager_t:s0-s0:c0.c1023
Contesto target               system_u:object_r:hald_var_lib_t:s0
Oggetti target                ./PolicyKit [ dir ]
Source                        nm-system-setti
Source Path                   /usr/sbin/nm-system-settings
Port                          <Sconosciuto>
Host                          quad.casa
Source RPM Packages           NetworkManager-0.7.0-0.11.svn4022.4.fc8
Target RPM Packages           
RPM della policy              selinux-policy-3.0.8-117.fc8
Selinux abilitato             True
Tipo di policy                targeted
MLS abilitato                 True
Modalità Enforcing           Enforcing
Nome plugin                   catchall_file
Host Name                     quad.casa
Piattaforma                   Linux quad.casa 2.6.23.15-137.fc8 #1 SMP Sun Feb
                              10 17:03:13 EST 2008 x86_64 x86_64
Conteggio allerte             3
First Seen                    lun 06 ott 2008 14:08:21 CEST
Last Seen                     mar 07 ott 2008 13:57:14 CEST
Local ID                      2298e25b-8480-4740-b4c1-671a306d3a8f
Numeri di linea               

Messaggi Raw Audit            

host=quad.casa type=AVC msg=audit(1223380634.394:26): avc:  denied  { read } for  pid=3403 comm="nm-system-setti" name="PolicyKit" dev=dm-5 ino=7482361 scontext=system_u:system_r:NetworkManager_t:s0-s0:c0.c1023 tcontext=system_u:object_r:hald_var_lib_t:s0 tclass=dir

host=quad.casa type=SYSCALL msg=audit(1223380634.394:26): arch=c000003e syscall=254 success=no exit=-13 a0=6 a1=33eae0914e a2=306 a3=302a1529f0 items=0 ppid=3402 pid=3403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="nm-system-setti" exe="/usr/sbin/nm-system-settings" subj=system_u:system_r:NetworkManager_t:s0-s0:c0.c1023 key=(null)




Version-Release number of selected component (if applicable):
selinux-policy Version: 3.0.8 Release: 117.fc8
xorg-x11-xauth Version: 1.0.2 Release: 3.fc8



How reproducible:
Standard Fedora 8 installation, with all updates installed.

Steps to Reproduce:
1. Install Fedora 8 and latest updates
2. reboot and login
Comment 1 Daniel Walsh 2008-10-29 14:17:07 EDT
Fixed in selinux-policy-3.0.8-122.fc8
Comment 2 Bug Zapper 2008-11-26 06:13:11 EST
This message is a reminder that Fedora 8 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 8.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '8'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 8's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 8 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 3 Jon Stanley 2008-11-26 12:37:48 EST
As this bug is in MODIFIED, Fedora believes that a fix has been committed that resolves the problem listed in this bug report.

If this is not the case, please re-open this report, noting the version of the package that you reproduced the bug against.

Thanks for the report!

Note You need to log in before you can comment on or make changes to this bug.