Bug 523399 - avc: denied { entrypoint } for comm="login" path="/bin/bash"
Summary: avc: denied { entrypoint } for comm="login" path="/bin/bash"
Keywords:
Status: CLOSED CANTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-09-15 11:09 UTC by Alexander Todorov
Modified: 2009-09-15 15:13 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-09-15 12:08:27 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Alexander Todorov 2009-09-15 11:09:52 UTC
Description of problem:
SELinux denial with one of the latest rawhide builds:

type=AVC msg=audit(1253010741.671:54): avc:  denied  { entrypoint } for  pid=2885 comm="login" path="/bin/bash" dev=dm-0 ino=7266 scontext=unconfined_u:system_r:hotplug_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=filelimit=320 old=256 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 res=1


Version-Release number of selected component (if applicable):
selinux-policy-3.6.31-3.fc12.noarch

How reproducible:
Always

Steps to Reproduce:
1. Try to login to the system
2.
3.
  
Actual results:
SELinux denial, login crashes (both on console and ssh)

Expected results:
User is able to login.


Additional info:
# ls -lZ /bin/bash
-rwxr-xr-x. root root system_u:object_r:file_t:s0      /bin/bash

Comment 1 Daniel Walsh 2009-09-15 12:08:27 UTC
Looks like your machine is badly mislabeled.

fixfiles restore
reboot

should fix.

Comment 2 Alexander Todorov 2009-09-15 12:49:16 UTC
the fix works although this is a default rawhide install. not sure why system is labeled wrongly.

Comment 3 Daniel Walsh 2009-09-15 15:13:36 UTC
I do not know, there was some bugs in rawhide a week or so ago that installed selinux in disabled mode which would allow files without labels to be created (file_t).  But when you turn selinux back on, it is supposed to force a relabel.


Note You need to log in before you can comment on or make changes to this bug.