Bug 523513 - setroubleshoot: SELinux is preventing Xorg (xserver_t) "write" access to device /dev/vga_arbiter.
Summary: setroubleshoot: SELinux is preventing Xorg (xserver_t) "write" access to...
Status: CLOSED DUPLICATE of bug 519025
Alias: None
Product: Fedora
Classification: Fedora
Component: udev
Version: 12
Hardware: x86_64
OS: Linux
Target Milestone: ---
Assignee: Harald Hoyer
QA Contact: Fedora Extras Quality Assurance
Whiteboard: setroubleshoot_trace_hash:1f0a94d55ba...
Depends On:
TreeView+ depends on / blocked
Reported: 2009-09-15 19:01 UTC by Jesse Leal dos Santos
Modified: 2010-01-26 11:07 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2010-01-26 11:07:27 UTC
Type: ---

Attachments (Terms of Use)

Description Jesse Leal dos Santos 2009-09-15 19:01:44 UTC
The following was filed automatically by setroubleshoot:


SELinux is preventing Xorg (xserver_t) "write" access to device

Detailed Description:

SELinux has denied the Xorg (xserver_t) "write" access to device
/dev/vga_arbiter. /dev/vga_arbiter is mislabeled, this device has the default
label of the /dev directory, which should not happen. All Character and/or Block
Devices should have a label. You can attempt to change the label of the file
using restorecon -v '/dev/vga_arbiter'. If this device remains labeled device_t,
then this is a bug in SELinux policy. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy
package. If you look at the other similar devices labels, ls -lZ /dev/SIMILAR,
and find a type that would work for /dev/vga_arbiter, you can use chcon -t
SIMILAR_TYPE '/dev/vga_arbiter', If this fixes the problem, you can make this
permanent by executing semanage fcontext -a -t SIMILAR_TYPE '/dev/vga_arbiter'
If the restorecon changes the context, this indicates that the application that
created the device, created it without using SELinux APIs. If you can figure out
which application created the device, please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this application.

Allowing Access:

Attempt restorecon -v '/dev/vga_arbiter' or chcon -t SIMILAR_TYPE

Additional Information:

Source Context                system_u:system_r:xserver_t:s0-s0:c0.c1023
Target Context                system_u:object_r:device_t:s0
Target Objects                /dev/vga_arbiter [ chr_file ]
Source                        Xorg
Source Path                   /usr/bin/Xorg (deleted)
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.31-3.fc12
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   device
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.31- #1 SMP Tue
                              Aug 11 21:00:45 EDT 2009 x86_64
Alert Count                   0
First Seen                    Tue 15 Sep 2009 01:48:28 PM BRT
Last Seen                     Tue 15 Sep 2009 01:48:28 PM BRT
Local ID                      c5c4b93c-e405-4499-8e8a-b55edd26f31e
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1253033308.593:40311): avc:  denied  { write } for  pid=1420 comm="Xorg" path="/dev/vga_arbiter" dev=tmpfs ino=1069 scontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file

node=(removed) type=SYSCALL msg=audit(1253033308.593:40311): arch=c000003e syscall=16 success=no exit=-25 a0=8 a1=40104d02 a2=7fffa17286a0 a3=7fffa1728430 items=0 ppid=1418 pid=1420 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=4294967295 comm="Xorg" exe=2F7573722F62696E2F586F7267202864656C6574656429 subj=system_u:system_r:xserver_t:s0-s0:c0.c1023 key=(null)

audit2allow suggests:

#============= xserver_t ==============
allow xserver_t device_t:chr_file write;

Comment 1 Daniel Walsh 2009-09-15 19:31:59 UTC
Udev did not create the device with the correct label.

If you run restorecon /dev/vga*

It will fix the label.

udev has to create the devices with the correct label.

Comment 2 Harald Hoyer 2009-09-16 06:53:25 UTC
please provide the output of:

# udevadm info --query=all --name=/dev/vga_arbiter

Comment 3 Bug Zapper 2009-11-16 12:27:08 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 12 development cycle.
Changing version to '12'.

More information and reason for this action is here:

Comment 5 Harald Hoyer 2010-01-26 11:07:27 UTC

*** This bug has been marked as a duplicate of bug 519025 ***

Note You need to log in before you can comment on or make changes to this bug.