Bug 524412 - setroubleshoot: SELinux is preventing /usr/bin/python "search" access on /root.
Summary: setroubleshoot: SELinux is preventing /usr/bin/python "search" access on /root.
Keywords:
Status: CLOSED DUPLICATE of bug 524384
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: x86_64
OS: Linux
low
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:a33ef3433ee...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-09-19 22:40 UTC by Moisés Ramos
Modified: 2009-09-20 11:46 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-09-20 11:46:06 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Moisés Ramos 2009-09-19 22:40:19 UTC
The following was filed automatically by setroubleshoot:

Resúmen:

SELinux is preventing /usr/bin/python "search" access on /root.

Descripción Detallada:

SELinux denied access requested by system-config-f. It is not expected that this
access is required by system-config-f and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Permitiendo Acceso:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug
report.

Información Adicional:

Contexto Fuente               system_u:system_r:firewallgui_t:s0-s0:c0.c1023
Contexto Destino              unconfined_u:object_r:user_home_dir_t:s0
Objetos Destino               /root [ dir ]
Fuente                        system-config-f
Dirección de Fuente          /usr/bin/python
Puerto                        <Desconocido>
Nombre de Equipo              (removed)
Paquetes RPM Fuentes          python-2.6.2-2.fc12
Paquetes RPM Destinos         filesystem-2.4.30-2.fc12
RPM de Políticas             selinux-policy-3.6.32-6.fc12
SELinux Activado              True
Tipo de Política             targeted
MLS Activado                  True
Modo Obediente                Enforcing
Nombre de Plugin              catchall
Nombre de Equipo              (removed)
Plataforma                    Linux (removed) 2.6.31-33.fc12.x86_64 #1 SMP
                              Thu Sep 17 15:40:43 EDT 2009 x86_64 x86_64
Cantidad de Alertas           1
Visto por Primera Vez         sáb 19 sep 2009 21:09:47 CEST
Visto por Última Vez         sáb 19 sep 2009 21:09:47 CEST
ID Local                      07be9b92-2cfb-4c98-ac0a-78a87349a603
Números de Línea            

Mensajes de Auditoría Crudos 

node=(removed) type=AVC msg=audit(1253387387.430:43): avc:  denied  { search } for  pid=2013 comm="system-config-f" name="root" dev=sda1 ino=284 scontext=system_u:system_r:firewallgui_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir

node=(removed) type=SYSCALL msg=audit(1253387387.430:43): arch=c000003e syscall=4 success=no exit=-2 a0=a235a0 a1=7fff9949b8a0 a2=7fff9949b8a0 a3=6b6361702d657469 items=0 ppid=2012 pid=2013 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="system-config-f" exe="/usr/bin/python" subj=system_u:system_r:firewallgui_t:s0-s0:c0.c1023 key=(null)


audit2allow suggests:

#============= firewallgui_t ==============
allow firewallgui_t user_home_dir_t:dir search;

Comment 1 Daniel Walsh 2009-09-20 11:46:06 UTC

*** This bug has been marked as a duplicate of bug 524384 ***


Note You need to log in before you can comment on or make changes to this bug.