Bug 523513 - setroubleshoot: SELinux is preventing Xorg (xserver_t) "write" access to device /dev/vga_arbiter.
setroubleshoot: SELinux is preventing Xorg (xserver_t) "write" access to...
Status: CLOSED DUPLICATE of bug 519025
Product: Fedora
Classification: Fedora
Component: udev (Show other bugs)
12
x86_64 Linux
low Severity medium
: ---
: ---
Assigned To: Harald Hoyer
Fedora Extras Quality Assurance
setroubleshoot_trace_hash:1f0a94d55ba...
: Triaged
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-09-15 15:01 EDT by Jesse Leal dos Santos
Modified: 2010-01-26 06:07 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-01-26 06:07:27 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jesse Leal dos Santos 2009-09-15 15:01:44 EDT
The following was filed automatically by setroubleshoot:

Summary:

SELinux is preventing Xorg (xserver_t) "write" access to device
/dev/vga_arbiter.

Detailed Description:

SELinux has denied the Xorg (xserver_t) "write" access to device
/dev/vga_arbiter. /dev/vga_arbiter is mislabeled, this device has the default
label of the /dev directory, which should not happen. All Character and/or Block
Devices should have a label. You can attempt to change the label of the file
using restorecon -v '/dev/vga_arbiter'. If this device remains labeled device_t,
then this is a bug in SELinux policy. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy
package. If you look at the other similar devices labels, ls -lZ /dev/SIMILAR,
and find a type that would work for /dev/vga_arbiter, you can use chcon -t
SIMILAR_TYPE '/dev/vga_arbiter', If this fixes the problem, you can make this
permanent by executing semanage fcontext -a -t SIMILAR_TYPE '/dev/vga_arbiter'
If the restorecon changes the context, this indicates that the application that
created the device, created it without using SELinux APIs. If you can figure out
which application created the device, please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this application.

Allowing Access:

Attempt restorecon -v '/dev/vga_arbiter' or chcon -t SIMILAR_TYPE
'/dev/vga_arbiter'

Additional Information:

Source Context                system_u:system_r:xserver_t:s0-s0:c0.c1023
Target Context                system_u:object_r:device_t:s0
Target Objects                /dev/vga_arbiter [ chr_file ]
Source                        Xorg
Source Path                   /usr/bin/Xorg (deleted)
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.31-3.fc12
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   device
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.31-0.125.4.2.rc5.git2.fc12.x86_64 #1 SMP Tue
                              Aug 11 21:00:45 EDT 2009 x86_64
Alert Count                   0
First Seen                    Tue 15 Sep 2009 01:48:28 PM BRT
Last Seen                     Tue 15 Sep 2009 01:48:28 PM BRT
Local ID                      c5c4b93c-e405-4499-8e8a-b55edd26f31e
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1253033308.593:40311): avc:  denied  { write } for  pid=1420 comm="Xorg" path="/dev/vga_arbiter" dev=tmpfs ino=1069 scontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file

node=(removed) type=SYSCALL msg=audit(1253033308.593:40311): arch=c000003e syscall=16 success=no exit=-25 a0=8 a1=40104d02 a2=7fffa17286a0 a3=7fffa1728430 items=0 ppid=1418 pid=1420 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=4294967295 comm="Xorg" exe=2F7573722F62696E2F586F7267202864656C6574656429 subj=system_u:system_r:xserver_t:s0-s0:c0.c1023 key=(null)


audit2allow suggests:

#============= xserver_t ==============
allow xserver_t device_t:chr_file write;
Comment 1 Daniel Walsh 2009-09-15 15:31:59 EDT
Udev did not create the device with the correct label.

If you run restorecon /dev/vga*

It will fix the label.

udev has to create the devices with the correct label.
Comment 2 Harald Hoyer 2009-09-16 02:53:25 EDT
please provide the output of:

# udevadm info --query=all --name=/dev/vga_arbiter
Comment 3 Bug Zapper 2009-11-16 07:27:08 EST
This bug appears to have been reported against 'rawhide' during the Fedora 12 development cycle.
Changing version to '12'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 5 Harald Hoyer 2010-01-26 06:07:27 EST

*** This bug has been marked as a duplicate of bug 519025 ***

Note You need to log in before you can comment on or make changes to this bug.