Bug 522835 - setroubleshoot: SELinux is preventing /usr/bin/Xorg (deleted) "write" access to device /dev/vga_arbiter.
Summary: setroubleshoot: SELinux is preventing /usr/bin/Xorg (deleted) "write" ac...
Alias: None
Product: Fedora
Classification: Fedora
Component: udev
Version: rawhide
Hardware: i386
OS: Linux
Target Milestone: ---
Assignee: Harald Hoyer
QA Contact: Fedora Extras Quality Assurance
Whiteboard: setroubleshoot_trace_hash:be87c99682d...
: 522836 (view as bug list)
Depends On:
TreeView+ depends on / blocked
Reported: 2009-09-11 17:39 UTC by Ivan Tsvetanov
Modified: 2009-09-11 18:25 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2009-09-11 18:24:38 UTC
Type: ---

Attachments (Terms of Use)

Description Ivan Tsvetanov 2009-09-11 17:39:20 UTC
The following was filed automatically by setroubleshoot:


SELinux is preventing /usr/bin/Xorg (deleted) "write" access to device

Detailed Description:

[Xorg has a permissive type (xserver_t). This access was not denied.]

SELinux has denied Xorg "write" access to device /dev/vga_arbiter.
/dev/vga_arbiter is mislabeled, this device has the default label of the /dev
directory, which should not happen. All Character and/or Block Devices should
have a label. You can attempt to change the label of the file using restorecon
-v '/dev/vga_arbiter'. If this device remains labeled device_t, then this is a
bug in SELinux policy. Please file a bg report. If you look at the other similar
devices labels, ls -lZ /dev/SIMILAR, and find a type that would work for
/dev/vga_arbiter, you can use chcon -t SIMILAR_TYPE '/dev/vga_arbiter', If this
fixes the problem, you can make this permanent by executing semanage fcontext -a
-t SIMILAR_TYPE '/dev/vga_arbiter' If the restorecon changes the context, this
indicates that the application that created the device, created it without using
SELinux APIs. If you can figure out which application created the device, please
file a bug report against this application.

Allowing Access:

Attempt restorecon -v '/dev/vga_arbiter' or chcon -t SIMILAR_TYPE

Additional Information:

Source Context                system_u:system_r:xserver_t:s0-s0:c0.c1023
Target Context                system_u:object_r:device_t:s0
Target Objects                /dev/vga_arbiter [ chr_file ]
Source                        Xorg
Source Path                   /usr/bin/Xorg (deleted)
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.31-2.fc12
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   device
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.31- #1 SMP Tue Aug
                              11 21:20:05 EDT 2009 i686 i686
Alert Count                   1
First Seen                    Fri 11 Sep 2009 09:51:40 PM CEST
Last Seen                     Fri 11 Sep 2009 09:51:40 PM CEST
Local ID                      a6103cd4-5dda-4925-947c-5edba4585738
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1252698700.707:129): avc:  denied  { write } for  pid=2127 comm="Xorg" path="/dev/vga_arbiter" dev=tmpfs ino=1069 scontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file

node=(removed) type=SYSCALL msg=audit(1252698700.707:129): arch=40000003 syscall=4 success=yes exit=23 a0=8 a1=bfd77b4c a2=17 a3=17 items=0 ppid=2126 pid=2127 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty7 ses=4294967295 comm="Xorg" exe=2F7573722F62696E2F586F7267202864656C6574656429 subj=system_u:system_r:xserver_t:s0-s0:c0.c1023 key=(null)

audit2allow suggests:

#============= xserver_t ==============
allow xserver_t device_t:chr_file write;

Comment 1 Daniel Walsh 2009-09-11 18:24:38 UTC
Udev is creating this file with the wrong context?  Or this device was created a while ago and you have not fixed the label.

restorecon /dev/vga_arbiter

Should fix the context.   If it happens again on a reboot please reopen as a udev bug.

Comment 2 Daniel Walsh 2009-09-11 18:25:51 UTC
*** Bug 522836 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.