Bug 537219 - abrt-hook-python can't write to dump dir because of selinux rules
Summary: abrt-hook-python can't write to dump dir because of selinux rules
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: abrt
Version: 12
Hardware: i686
OS: Linux
low
medium
Target Milestone: ---
Assignee: Karel Klíč
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:08997608
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-11-12 20:53 UTC by Craig Magina
Modified: 2013-03-03 22:59 UTC (History)
78 users (show)

Fixed In Version: abrt-1.1.13-1.fc12
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-08-17 05:28:45 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
File: backtrace (1.69 KB, text/plain)
2009-11-12 20:54 UTC, Craig Magina
no flags Details

Description Craig Magina 2009-11-12 20:53:58 UTC
abrt detected a crash.

Comment: It crashed after I clicked "yes" for the sending of the core file from a crash of the notification-daemon.
Attached file: backtrace
cmdline: /usr/bin/python /usr/share/abrt/CCMainWindow.py 
component: abrt
executable: /usr/share/abrt/CCMainWindow.py
kernel: 2.6.31.5-127.fc12.i686
package: abrt-gui-0.0.11-2.fc12
uuid: 08997608

Comment 1 Craig Magina 2009-11-12 20:54:00 UTC
Created attachment 369319 [details]
File: backtrace

Comment 2 Jiri Moskovcak 2010-01-27 20:18:12 UTC
Was there any selinux warning when this happened?

Comment 3 Doug Maxey 2010-01-27 20:41:53 UTC
Hmm.  Yes, apparently 3 separate ones:
----------
Summary:

SELinux is preventing /usr/libexec/abrt-hook-python "create" access.

Detailed Description:

[abrt-hook-pytho has a permissive type (abrt_helper_t). This access was not
denied.]

SELinux denied access requested by abrt-hook-pytho. It is not expected that this
access is required by abrt-hook-pytho and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                unconfined_u:unconfined_r:abrt_helper_t:SystemLow-
                              SystemHigh
Target Context                unconfined_u:unconfined_r:abrt_helper_t:SystemLow-
                              SystemHigh
Target Objects                None [ unix_dgram_socket ]
Source                        abrt-hook-pytho
Source Path                   /usr/libexec/abrt-hook-python
Port                          <Unknown>
Host                          willy.enoyolf.org
Source RPM Packages           abrt-addon-python-1.0.4-1.fc12
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.32-69.fc12
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     willy.enoyolf.org
Platform                      Linux willy.enoyolf.org
                              2.6.31.12-174.2.3.fc12.x86_64 #1 SMP Mon Jan 18
                              19:52:07 UTC 2010 x86_64 x86_64
Alert Count                   1
First Seen                    Wed 27 Jan 2010 11:55:49 AM CST
Last Seen                     Wed 27 Jan 2010 11:55:49 AM CST
Local ID                      50774409-7fc9-491a-af3d-7f54ff9b38d1
Line Numbers                  

Raw Audit Messages            

node=willy.enoyolf.org type=AVC msg=audit(1264614949.509:50023): avc:  denied  { create } for  pid=31177 comm="abrt-hook-pytho" scontext=unconfined_u:unconfined_r:abrt_helper_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:abrt_helper_t:s0-s0:c0.c1023 tclass=unix_dgram_socket

node=willy.enoyolf.org type=SYSCALL msg=audit(1264614949.509:50023): arch=c000003e syscall=41 success=yes exit=3 a0=1 a1=80002 a2=0 a3=676f6c2f7665642f items=0 ppid=31111 pid=31177 auid=500 uid=500 gid=500 euid=485 suid=485 fsuid=485 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="abrt-hook-pytho" exe="/usr/libexec/abrt-hook-python" subj=unconfined_u:unconfined_r:abrt_helper_t:s0-s0:c0.c1023 key=(null)



Summary:

SELinux is preventing /usr/libexec/abrt-hook-python "getattr" access on
/var/cache.

Detailed Description:

[abrt-hook-pytho has a permissive type (abrt_helper_t). This access was not
denied.]

SELinux denied access requested by abrt-hook-pytho. It is not expected that this
access is required by abrt-hook-pytho and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                unconfined_u:unconfined_r:abrt_helper_t:SystemLow-
                              SystemHigh
Target Context                system_u:object_r:fs_t:SystemLow
Target Objects                /var/cache [ filesystem ]
Source                        abrt-hook-pytho
Source Path                   /usr/libexec/abrt-hook-python
Port                          <Unknown>
Host                          willy.enoyolf.org
Source RPM Packages           abrt-addon-python-1.0.4-1.fc12
Target RPM Packages           filesystem-2.4.30-2.fc12
Policy RPM                    selinux-policy-3.6.32-69.fc12
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     willy.enoyolf.org
Platform                      Linux willy.enoyolf.org
                              2.6.31.12-174.2.3.fc12.x86_64 #1 SMP Mon Jan 18
                              19:52:07 UTC 2010 x86_64 x86_64
Alert Count                   1
First Seen                    Wed 27 Jan 2010 11:55:49 AM CST
Last Seen                     Wed 27 Jan 2010 11:55:49 AM CST
Local ID                      08e57ab6-f49e-4364-aa4a-cd47abc545ed
Line Numbers                  

Raw Audit Messages            

node=willy.enoyolf.org type=AVC msg=audit(1264614949.482:50022): avc:  denied  { getattr } for  pid=31177 comm="abrt-hook-pytho" name="/" dev=sdb5 ino=2 scontext=unconfined_u:unconfined_r:abrt_helper_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem

node=willy.enoyolf.org type=SYSCALL msg=audit(1264614949.482:50022): arch=c000003e syscall=137 success=yes exit=128 a0=4021e1 a1=7fff8f95c740 a2=fdf a3=69746361206e6120 items=0 ppid=31111 pid=31177 auid=500 uid=500 gid=500 euid=485 suid=485 fsuid=485 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="abrt-hook-pytho" exe="/usr/libexec/abrt-hook-python" subj=unconfined_u:unconfined_r:abrt_helper_t:s0-s0:c0.c1023 key=(null)


-----------

Summary:

SELinux is preventing /usr/libexec/abrt-hook-python "connect" access.

Detailed Description:

[abrt-hook-pytho has a permissive type (abrt_helper_t). This access was not
denied.]

SELinux denied access requested by abrt-hook-pytho. It is not expected that this
access is required by abrt-hook-pytho and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                unconfined_u:unconfined_r:abrt_helper_t:SystemLow-
                              SystemHigh
Target Context                unconfined_u:unconfined_r:abrt_helper_t:SystemLow-
                              SystemHigh
Target Objects                None [ unix_dgram_socket ]
Source                        abrt-hook-pytho
Source Path                   /usr/libexec/abrt-hook-python
Port                          <Unknown>
Host                          willy.enoyolf.org
Source RPM Packages           abrt-addon-python-1.0.4-1.fc12
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.32-69.fc12
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     willy.enoyolf.org
Platform                      Linux willy.enoyolf.org
                              2.6.31.12-174.2.3.fc12.x86_64 #1 SMP Mon Jan 18
                              19:52:07 UTC 2010 x86_64 x86_64
Alert Count                   2
First Seen                    Wed 27 Jan 2010 11:55:49 AM CST
Last Seen                     Wed 27 Jan 2010 11:55:49 AM CST
Local ID                      2c94b480-0875-46c4-b20d-8887650e6946
Line Numbers                  

Raw Audit Messages            

node=willy.enoyolf.org type=AVC msg=audit(1264614949.510:50024): avc:  denied  { connect } for  pid=31177 comm="abrt-hook-pytho" scontext=unconfined_u:unconfined_r:abrt_helper_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:abrt_helper_t:s0-s0:c0.c1023 tclass=unix_dgram_socket

node=willy.enoyolf.org type=AVC msg=audit(1264614949.510:50024): avc:  denied  { sendto } for  pid=31177 comm="abrt-hook-pytho" path="/dev/log" scontext=unconfined_u:unconfined_r:abrt_helper_t:s0-s0:c0.c1023 tcontext=system_u:system_r:syslogd_t:s0 tclass=unix_dgram_socket

node=willy.enoyolf.org type=SYSCALL msg=audit(1264614949.510:50024): arch=c000003e syscall=42 success=yes exit=128 a0=3 a1=3fd65761a0 a2=6e a3=676f6c2f7665642f items=0 ppid=31111 pid=31177 auid=500 uid=500 gid=500 euid=485 suid=485 fsuid=485 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="abrt-hook-pytho" exe="/usr/libexec/abrt-hook-python" subj=unconfined_u:unconfined_r:abrt_helper_t:s0-s0:c0.c1023 key=(null)

Comment 4 Craig Magina 2010-01-27 22:19:57 UTC
Yes, I had seen many for the abrt application.

Comment 5 alextazy0 2010-04-30 08:12:04 UTC
Package: abrt-gui-1.0.9-1.fc12
Architecture: i686
OS Release: Fedora release 12 (Constantine)


How to reproduce
-----
1.reporting a bug about exaile
2.cancelling while "creating a new bug"
3.trying to re-reporting the same bug

Comment 6 Karel Klíč 2010-04-30 08:31:45 UTC
This is a duplicate of #539566, isn't it?
I am working on a fix.

Comment 7 Elcrapocrew 2010-05-11 06:21:58 UTC
Package: abrt-gui-1.0.9-2.fc12
Architecture: i686
OS Release: Fedora release 12 (Constantine)


How to reproduce
-----
1.a file is on my desktop that will not delete when i try it says "The specified location is not supported"
2.now nautilis is freaking out!
3.

Comment 8 Jeremy Whiting 2010-05-20 10:09:52 UTC
Package: abrt-gui-1.0.9-2.fc12
Architecture: x86_64
OS Release: Fedora release 12 (Constantine)


How to reproduce
-----
1. Selected the option to report a kernal crash.
2. Clicked on the "Send report" button.
3. Waited for the report submission window to update.
4. After waiting a few minutes a popup window reports a timeout.
5. The ABRT did not gracefully handle the timeout and crashed itself after a few more minutes. 


Comment
-----
You could try sending a report to a stub server that accepts the connection but does not send a response.

Comment 9 claimpostofficebox 2010-05-20 21:44:29 UTC
Package: abrt-gui-1.0.9-1.fc12
Architecture: x86_64
OS Release: Fedora release 12 (Constantine)


How to reproduce
-----
1.try to send bug report
2.that's all
3.

Comment 10 foo.hazard 2010-05-24 17:17:20 UTC
Package: abrt-gui-1.0.9-2.fc12
Architecture: x86_64
OS Release: Fedora release 12 (Constantine)


How to reproduce
-----
1. Reporting bug.

Comment 11 李秋言 2010-05-28 03:59:18 UTC
Package: abrt-gui-1.1.0-1.fc13
Architecture: x86_64
OS Release: Fedora release 13 (Goddard)


How to reproduce
-----
1.Do nothing
2.
3.

Comment 12 D. Wagner 2010-05-31 06:12:26 UTC
Package: abrt-gui-1.1.0-1.fc13
Architecture: x86_64
OS Release: Fedora release 13 (Goddard)


How to reproduce
-----
I don't know if this is reproducible.


Comment
-----
I started abort manually from System Tools >> Automatic Bug Reporting Tool (or tried to).

Comment 13 Ben Brooks 2010-06-04 20:36:11 UTC
Package: abrt-gui-1.0.9-2.fc12
Architecture: i686
OS Release: Fedora release 12 (Constantine)


Comment
-----
I just tried  to report a bug about the kernel crashing.

Comment 14 Theophanis Kontogiannis 2010-06-08 13:12:20 UTC
Package: abrt-gui-1.1.1-1.fc13
Architecture: x86_64
OS Release: Fedora release 13 (Goddard)


Comment
-----
no idea how to reproduce

Comment 15 Karel Klíč 2010-06-09 15:38:46 UTC
Uncaught Python exceptions are now sent to ABRT daemon via socket.
Fixed in upstream git.
SELinux policy has been updated by Mirek Grepl.

Comment 16 boucher.samuel.c 2010-06-13 21:36:13 UTC
Package: abrt-gui-1.1.1-1.fc13
Architecture: i686
OS Release: Fedora release 13 (Goddard)


How to reproduce
-----
1.tried to fill a bug report
2.other crash
3.


Comment
-----
Moblin 2.2 is VERY buggy

Comment 17 Hendrik Richter 2010-06-23 07:53:13 UTC
Package: abrt-gui-1.1.1-1.fc13
Architecture: i686
OS Release: Fedora release 13 (Goddard)


How to reproduce
-----
1. Start a long "yum upgrade" on a slow connection
2. Crash some apps
3. See abrt-gui crash

Comment 18 Edgar Rodolfo 2010-06-28 08:50:42 UTC
Package: abrt-gui-1.1.0-1.fc13
Architecture: i686
OS Release: Fedora release 13 (Goddard)


How to reproduce
-----
1.inice xfce
2.kernel caido
3.se colgo por uno few minuts, then kernel failed


Comment
-----
fedora 13, kernel caido always when i started fedora 13 in my pc, i have a pc, pentum 4, asrock, 1256M of ram, with fedora 12 all ok no problem, but fedora 13 kernel fall, help me please, from peru

Comment 19 nihed mbarek 2010-07-06 07:23:38 UTC
Package: abrt-gui-1.1.5-1.fc14
Architecture: i686
OS Release: Fedora release 14 (Rawhide)


How to reproduce
-----
1.Repport kernel problems
2.
3.

Comment 20 Philipp Riemer 2010-07-08 19:00:19 UTC
Package: abrt-gui-1.1.1-1.fc13
Architecture: i686
OS Release: Fedora release 13 (Goddard)


Comment
-----
Tried to send an error report but lost the wireless connection. A popup appeared showing the error. After closing it, I wanted to try to send the report again. So I pressed the button and ABRT crashed.

Comment 21 Philipp Riemer 2010-07-08 19:04:30 UTC
Package: abrt-gui-1.1.1-1.fc13
Architecture: i686
OS Release: Fedora release 13 (Goddard)


Comment
-----
Tried to send an error report but lost the wireless connection. A popup appeared showing the error. After closing it, I wanted to try to send the report again. So I pressed the button and ABRT crashed.

Comment 22 D. Wagner 2010-07-09 05:22:32 UTC
Package: abrt-gui-1.1.1-1.fc12
Architecture: x86_64
OS Release: Fedora release 12 (Constantine)


How to reproduce
-----
I don't know how reproducible it is.  When my machine was in the state that triggered this error, I got this error every time I started abrt (so highly consistent and repeatable).  After rebooting, I don't see this error again, so I don't know if I could reproduce it.


Comment
-----
I tried to open abrt.  It refused to start and popped up a dialogue box with a DBus error.  It's possible that the first time abrt got triggered, my network connection was flaky or not connected, but I later was able to get a good network connection, and trying to start abrt even then also failed.

Comment 23 Jim Cromie 2010-07-17 15:43:37 UTC
Package: abrt-gui-1.1.1-1.fc12
Architecture: i686
OS Release: Fedora release 12 (Constantine)


Comment
-----
gui hung when I attempted to report another crash

Comment 24 Patryk Obara 2010-07-29 16:45:15 UTC
Package: abrt-gui-1.1.1-1.fc13
Architecture: x86_64
OS Release: Fedora release 13 (Goddard)


How to reproduce
-----
no steps, unstable behaviour for few minutes before crash, see comment

Comment
-----
I tried to cancel sending gstreamer crash (edit author name to single space in all songs in *ogg album in rhythmbox, gstreamer crashes), but after that abrt started behaving unstable - few gstreamer crashers followed (with rhythmbox still playing, then dbus error, then abrt crashed.

Comment 25 David M. 2010-08-06 22:05:31 UTC
Package: abrt-gui-1.1.1-2.fc13
Architecture: x86_64
OS Release: Fedora release 13 (Goddard)


How to reproduce
-----
1.  tried to send a kernel-oops report
2.  whole thing hung up
3.


Comment
-----
Not sure?????

Comment 26 Fedora Update System 2010-08-11 11:17:31 UTC
abrt-1.1.13-1.fc14 has been submitted as an update for Fedora 14.
http://admin.fedoraproject.org/updates/abrt-1.1.13-1.fc14

Comment 27 Fedora Update System 2010-08-12 12:58:26 UTC
abrt-1.1.13-1.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/abrt-1.1.13-1.fc13

Comment 28 Fedora Update System 2010-08-12 19:52:40 UTC
abrt-1.1.13-1.fc14 has been pushed to the Fedora 14 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update abrt'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/abrt-1.1.13-1.fc14

Comment 29 Bob John 2010-08-13 08:07:31 UTC
Package: abrt-gui-1.1.1-2.fc13
Architecture: i686
OS Release: Fedora release 13 (Goddard)


How to reproduce
-----
1.When I was reporting totem issue, it crashed 
2.It crashed exactly when "Add breeze_growing to CC list" prompt.


Comment
-----
It crashed when I was reporting the totem issues.

Comment 30 Fedora Update System 2010-08-16 14:06:56 UTC
abrt-1.1.13-1.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/abrt-1.1.13-1.fc12

Comment 31 Fedora Update System 2010-08-17 05:27:15 UTC
abrt-1.1.13-1.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 32 Fedora Update System 2010-08-20 13:31:38 UTC
abrt-1.1.13-2.fc14 has been submitted as an update for Fedora 14.
http://admin.fedoraproject.org/updates/abrt-1.1.13-2.fc14

Comment 33 Fedora Update System 2010-08-24 01:12:15 UTC
abrt-1.1.13-2.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 34 Fedora Update System 2010-08-24 21:17:46 UTC
abrt-1.1.13-1.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.