Résumé: SELinux is preventing /usr/bin/xauth "read" access on /usr/share/google-gadgets/resources.gg. Description détaillée: [xauth a un type permissif (xauth_t). Cet accès n'a pas été refusé.] SELinux denied access requested by xauth. It is not expected that this access is required by xauth and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Autoriser l'accès: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug report. Informations complémentaires: Contexte source unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 Contexte cible system_u:object_r:usr_t:s0 Objets du contexte /usr/share/google-gadgets/resources.gg [ file ] source xauth Chemin de la source /usr/bin/xauth Port <Inconnu> Hôte (removed) Paquetages RPM source xorg-x11-xauth-1.0.2-7.fc12 Paquetages RPM cible google-gadgets-0.11.1-1.fc12 Politique RPM selinux-policy-3.6.32-49.fc12 Selinux activé True Type de politique targeted Mode strict Enforcing Nom du plugin catchall Nom de l'hôte (removed) Plateforme Linux (removed) 2.6.31.6-145.fc12.x86_64 #1 SMP Sat Nov 21 15:57:45 EST 2009 x86_64 x86_64 Compteur d'alertes 7 Première alerte jeu. 03 déc. 2009 10:06:35 CET Dernière alerte jeu. 03 déc. 2009 10:32:01 CET ID local 514f0dc0-9f5b-4ea7-b93a-7e65a237191e Numéros des lignes Messages d'audit bruts node=(removed) type=AVC msg=audit(1259832721.496:1041): avc: denied { read } for pid=15814 comm="xauth" path="/usr/share/google-gadgets/resources.gg" dev=sda1 ino=263435 scontext=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=file node=(removed) type=SYSCALL msg=audit(1259832721.496:1041): arch=c000003e syscall=59 success=yes exit=0 a0=7ffff122571c a1=13b77f0 a2=12b9dd0 a3=8 items=0 ppid=15805 pid=15814 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 key=(null) Hash String generated from selinux-policy-3.6.32-49.fc12,catchall,xauth,xauth_t,usr_t,file,read audit2allow suggests: #============= xauth_t ============== allow xauth_t usr_t:file read;
This is a leaked file descroptor from google-gadgets, most likely. You can ignore it as all that happened is SELinux closed it and the command finished successfully. xauth definitely does not know anything about /usr/share/google-gadgets/resources.gg You should report this as a bug to google, to close all file descriptors before fork/exec fcntl(fd, F_SETFD, FD_CLOEXEC) I can allow it for now, just to eliminate the AVC. Fixed in selinux-policy-3.6.32-54.fc12
selinux-policy-3.6.32-55.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-55.fc12
selinux-policy-3.6.32-55.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-12650
selinux-policy-3.6.32-55.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.