Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be available on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 517453 - setroubleshoot: SELinux is preventing the dbus-daemon-lau (system_dbusd_t) from executing SetroubleshootFixit.py.
Summary: setroubleshoot: SELinux is preventing the dbus-daemon-lau (system_dbusd_...
Keywords:
Status: CLOSED WORKSFORME
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: i386
OS: Linux
low
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:8b3d5ab45fe...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-08-14 06:50 UTC by Vladimir Ermakov
Modified: 2009-08-14 13:19 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-08-14 13:19:12 UTC
Type: ---


Attachments (Terms of Use)

Description Vladimir Ermakov 2009-08-14 06:50:30 UTC
The following was filed automatically by setroubleshoot:

Summary:

SELinux is preventing the dbus-daemon-lau (system_dbusd_t) from executing
SetroubleshootFixit.py.

Detailed Description:

SELinux has denied the dbus-daemon-lau from executing SetroubleshootFixit.py. If
dbus-daemon-lau is supposed to be able to execute SetroubleshootFixit.py, this
could be a labeling problem. Most confined domains are allowed to execute files
labeled bin_t. So you could change the labeling on this file to bin_t and retry
the application. If this dbus-daemon-lau is not supposed to execute
SetroubleshootFixit.py, this could signal an intrusion attempt.

Allowing Access:

If you want to allow dbus-daemon-lau to execute SetroubleshootFixit.py: chcon -t
bin_t 'SetroubleshootFixit.py' If this fix works, please update the file context
on disk, with the following command: semanage fcontext -a -t bin_t
'SetroubleshootFixit.py' Please specify the full path to the executable, Please
file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against
this selinux-policy to make sure this becomes the default labeling.

Additional Information:

Source Context                system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
Target Context                system_u:object_r:usr_t:s0
Target Objects                SetroubleshootFixit.py [ file ]
Source                        dbus-daemon-lau
Source Path                   /lib/dbus-1/dbus-daemon-launch-helper
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           dbus-1.2.16-4.fc12
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.26-8.fc12
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   execute
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.31-0.125.4.2.rc5.git2.fc12.i686 #1 SMP Tue Aug
                              11 21:20:05 EDT 2009 i686 i686
Alert Count                   0
First Seen                    Fri 14 Aug 2009 10:49:40 AM MSD
Last Seen                     Fri 14 Aug 2009 10:49:40 AM MSD
Local ID                      84366ada-f8e4-4f1d-9f5a-61cb5448880f
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1250232580.899:39): avc:  denied  { execute } for  pid=2165 comm="dbus-daemon-lau" name="SetroubleshootFixit.py" dev=dm-0 ino=88187 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1250232580.899:39): arch=40000003 syscall=11 success=no exit=-13 a0=83d55e0 a1=83d5cc8 a2=83d5008 a3=83d81e8 items=0 ppid=2164 pid=2165 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dbus-daemon-lau" exe="/lib/dbus-1/dbus-daemon-launch-helper" subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)


audit2allow suggests:

#============= system_dbusd_t ==============
allow system_dbusd_t usr_t:file execute;

Comment 1 Miroslav Grepl 2009-08-14 11:04:52 UTC
It looks like labeling problem

Try to execute

# restorecon -R -v /usr/share/setroubleshoot/

Comment 2 Vladimir Ermakov 2009-08-14 11:56:18 UTC
# restorecon -R -v /usr/share/setroubleshoot/Can't stat directory "/home/venom/.gvfs", Permission denied.

Comment 3 Daniel Walsh 2009-08-14 13:05:27 UTC
ls -lZ /usr/share/setroubleshoot/SetroubleshootFixit.py

Comment 4 Vladimir Ermakov 2009-08-14 13:11:28 UTC
# ls -lZ /usr/share/setroubleshoot/SetroubleshootFixit.py
-rwxr-xr-x. root root system_u:object_r:setroubleshoot_fixit_exec_t:s0 /usr/share/setroubleshoot/SetroubleshootFixit.py

Comment 5 Daniel Walsh 2009-08-14 13:19:12 UTC
So it is fixed, now.  Not sure how it got mislabeled.  So I am going to close this bug.  If it happens again, please reopen the bug.


Note You need to log in before you can comment on or make changes to this bug.