Bug 523573 - setroubleshoot: SELinux is preventing the sh from using potentially mislabeled files (/root).
Summary: setroubleshoot: SELinux is preventing the sh from using potentially misl...
Status: CLOSED DUPLICATE of bug 523570
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: i386
OS: Linux
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
Whiteboard: setroubleshoot_trace_hash:1776fac9167...
Depends On:
TreeView+ depends on / blocked
Reported: 2009-09-16 01:49 UTC by kylin
Modified: 2009-11-06 23:21 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2009-09-16 12:28:47 UTC

Attachments (Terms of Use)

Description kylin 2009-09-16 01:49:18 UTC
The following was filed automatically by setroubleshoot:


SELinux is preventing the sh from using potentially mislabeled files (/root).


SELinux has denied sh access to potentially mislabeled file(s) (/root). This
means that SELinux will not allow sh to use these files. It is common for users
to edit files in their home directory or tmp directories and then move (mv) them
to system directories. The problem is that the files end up with the wrong file
context which confined applications are not allowed to access.


If you want sh to access this files, you need to relabel them using restorecon
-v '/root'. You might want to relabel the entire directory using restorecon -R
-v '/root'.


源上下文                  unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102
目标上下文               system_u:object_r:admin_home_t:s0
目标对象                  /root [ dir ]
源                           sh
源路径                     /bin/bash
端口                        <未知>
主机                        (removed)
源 RPM 软件包             bash-4.0.28-1.fc12
目标 RPM 软件包          filesystem-2.4.27-1.fc12
策略 RPM                    selinux-policy-3.6.26-8.fc12
启用 Selinux                True
策略类型                  targeted
启用 MLS                    True
Enforcing 模式              Enforcing
插件名称                  home_tmp_bad_labels
主机名                     (removed)
平台                        Linux (removed)
                              2.6.31- #1 SMP Tue
                              Aug 11 21:01:03 EDT 2009 i686 i686
警报计数                  4
第一个                     2009年09月16日 星期三 08时35分40秒
最后一个                  2009年09月16日 星期三 09时37分53秒
本地 ID                     06fa70ac-8294-4f06-8793-94c1929e32b5


node=(removed) type=AVC msg=audit(1253065073.788:27919): avc:  denied  { getattr } for  pid=9857 comm="sh" path="/root" dev=sda7 ino=73586 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir

node=(removed) type=SYSCALL msg=audit(1253065073.788:27919): arch=40000003 syscall=195 success=no exit=-13 a0=9eaf6d8 a1=bf9269e0 a2=a33ff4 a3=0 items=0 ppid=9847 pid=9857 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="sh" exe="/bin/bash" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)

audit2allow suggests:

#============= nsplugin_t ==============
allow nsplugin_t admin_home_t:dir getattr;

Comment 1 Daniel Walsh 2009-09-16 12:28:47 UTC

*** This bug has been marked as a duplicate of bug 523570 ***

Note You need to log in before you can comment on or make changes to this bug.