Bug 546051 - SELinux prevented kde4-config from writing ./.kde.
Summary: SELinux prevented kde4-config from writing ./.kde.
Keywords:
Status: CLOSED WORKSFORME
Alias: None
Product: Fedora
Classification: Fedora
Component: kdelibs
Version: 12
Hardware: x86_64
OS: Linux
low
medium
Target Milestone: ---
Assignee: Than Ngo
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:5c5f035c557...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-12-09 21:37 UTC by Jeremy Huddleston
Modified: 2010-01-05 19:59 UTC (History)
11 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-01-05 19:59:02 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Jeremy Huddleston 2009-12-09 21:37:32 UTC
Summary:

SELinux prevented kde4-config from writing ./.kde.

Detailed Description:

SELinux prevented kde4-config from writing ./.kde. If ./.kde is a core file, you
may want to allow this. If ./.kde is not a core file, this could signal a
intrusion attempt.

Allowing Access:

Changing the "allow_daemons_dump_core" boolean to true will allow this access:
"setsebool -P allow_daemons_dump_core=1."

Fix Command:

setsebool -P allow_daemons_dump_core=1

Additional Information:

Source Context                system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context                system_u:object_r:root_t:s0
Target Objects                ./.kde [ dir ]
Source                        kde4-config
Source Path                   /usr/bin/kde4-config
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           kdelibs-4.2.3-2.fc10
Target RPM Packages           
Policy RPM                    selinux-policy-3.5.13-59.fc10
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   allow_daemons_dump_core
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.27.24-170.2.68.fc10.x86_64 #1 SMP Wed May 20
                              22:47:23 EDT 2009 x86_64 x86_64
Alert Count                   2
First Seen                    Mon 13 Apr 2009 09:56:56 PM PDT
Last Seen                     Fri 21 Aug 2009 02:34:39 PM PDT
Local ID                      7502d747-ea2d-4f9d-8c1e-3fe4f0319e48
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1250890479.79:6): avc:  denied  { create } for  pid=2619 comm="kde4-config" name=".kde" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=dir

node=(removed) type=SYSCALL msg=audit(1250890479.79:6): arch=c000003e syscall=83 success=no exit=-13 a0=a912c8 a1=1c0 a2=ffffffff a3=7fff1646dda0 items=0 ppid=2618 pid=2619 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kde4-config" exe="/usr/bin/kde4-config" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.5.13-59.fc10,allow_daemons_dump_core,kde4-config,xdm_t,root_t,dir,create
audit2allow suggests:

#============= xdm_t ==============
allow xdm_t root_t:dir create;

Comment 1 Daniel Walsh 2009-12-09 21:55:04 UTC

*** This bug has been marked as a duplicate of bug 538428 ***

Comment 2 Jeremy Huddleston 2010-01-05 03:40:31 UTC
You marked this as a duplicate of another policy bug, but the other bug is for a different policy problem.

In that bug, you stated that the problem was the update had not completed, but I did complete the update.  Furthermore, the "fix" command is invalid.  The application is not writing out a core dump.

Comment 3 Daniel Walsh 2010-01-05 12:57:27 UTC
Sorry, This seems to be a duplicate of 498809.

Which says it was fixed in F11,   Was this fix not put into F12?

Comment 4 Rex Dieter 2010-01-05 13:10:31 UTC
The fix for bug #498809 is indeed present, ie,
/etc/profile.d/kde.(sh|csh) no longer contains any usage of kde4-config.

If the symptoms have returned, the cause must be different.

Comment 5 Jeremy Huddleston 2010-01-05 17:13:08 UTC
I never saw this violation under F11, but it showed up after updating to F12 (along with many others).  I did a restocon on my entire drive which fixed most of these problems (and can hopefully be done by the F13 update).

Looking back, I think that this error was generated *before* the restocon, and I haven't seen an occurrence since.

Comment 6 Daniel Walsh 2010-01-05 19:59:02 UTC
Ok lets pretend it never happened.   :^)

Reopen if it happens again.


Note You need to log in before you can comment on or make changes to this bug.