Bug 541639 - SELinux is preventing /usr/bin/kdm "write" access on /root.
Summary: SELinux is preventing /usr/bin/kdm "write" access on /root.
Keywords:
Status: CLOSED DUPLICATE of bug 543970
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 12
Hardware: i386
OS: Linux
low
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:2abd7afcc03...
: 544116 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-11-26 15:19 UTC by tan_shiruban
Modified: 2009-12-06 02:22 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-12-04 11:52:36 UTC


Attachments (Terms of Use)

Description tan_shiruban 2009-11-26 15:19:08 UTC
Résumé:

SELinux is preventing /usr/bin/kdm "write" access on /root.

Description détaillée:

SELinux denied access requested by kdm. It is not expected that this access is
required by kdm and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Autoriser l'accès:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug
report.

Informations complémentaires:

Contexte source               system_u:system_r:xdm_t:s0-s0:c0.c1023
Contexte cible                system_u:object_r:admin_home_t:s0
Objets du contexte            /root [ dir ]
source                        kdm
Chemin de la source           /usr/bin/kdm
Port                          <Inconnu>
Hôte                         (removed)
Paquetages RPM source         kdm-4.3.3-7.fc12
Paquetages RPM cible          filesystem-2.4.30-2.fc12
Politique RPM                 selinux-policy-3.6.32-46.fc12
Selinux activé               True
Type de politique             targeted
Mode strict                   Enforcing
Nom du plugin                 catchall
Nom de l'hôte                (removed)
Plateforme                    Linux (removed) 2.6.31.5-127.fc12.i686.PAE
                              #1 SMP Sat Nov 7 21:25:57 EST 2009 i686 i686
Compteur d'alertes            8
Première alerte              jeu. 26 nov. 2009 14:48:21 CET
Dernière alerte              jeu. 26 nov. 2009 16:08:49 CET
ID local                      6999de38-03b0-4ba5-bae2-8bfacc546c52
Numéros des lignes           

Messages d'audit bruts        

node=(removed) type=AVC msg=audit(1259248129.399:21145): avc:  denied  { write } for  pid=2852 comm="kdm" name="root" dev=dm-0 ino=81761 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir

node=(removed) type=SYSCALL msg=audit(1259248129.399:21145): arch=40000003 syscall=5 success=no exit=-13 a0=bffe801b a1=c1 a2=180 a3=1 items=0 ppid=2128 pid=2852 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="kdm" exe="/usr/bin/kdm" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.6.32-46.fc12,catchall,kdm,xdm_t,admin_home_t,dir,write
audit2allow suggests:

#============= xdm_t ==============
allow xdm_t admin_home_t:dir write;

Comment 1 Miroslav Grepl 2009-11-27 14:36:36 UTC
Are you trying to login as root?

Comment 2 Simon Lewis 2009-12-02 19:24:29 UTC
I sometimes have to log in as root to have the full functionality in konqueror when used as a file manager.

There is no d-bus support in konqueror when started using "kdesu konqueror" from a standard user account...

Comment 3 Miroslav Grepl 2009-12-04 11:46:09 UTC
*** Bug 544116 has been marked as a duplicate of this bug. ***

Comment 4 Miroslav Grepl 2009-12-04 11:52:36 UTC
It is not a good idea to login as root via X Windows,  this is not supported in
SELinux.

*** This bug has been marked as a duplicate of bug 543970 ***


Note You need to log in before you can comment on or make changes to this bug.