Bug 546798 - SELinux is preventing /usr/libexec/gdm-session-worker "create" access on event.1652.17022326.
Summary: SELinux is preventing /usr/libexec/gdm-session-worker "create" access on even...
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 12
Hardware: x86_64
OS: Linux
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
Whiteboard: setroubleshoot_trace_hash:9213216f672...
Depends On:
TreeView+ depends on / blocked
Reported: 2009-12-12 00:02 UTC by Alejandro Ayala
Modified: 2009-12-22 20:42 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2009-12-22 20:42:26 UTC
Type: ---

Attachments (Terms of Use)

Description Alejandro Ayala 2009-12-12 00:02:14 UTC

SELinux is preventing /usr/libexec/gdm-session-worker "create" access on

Descripción Detallada:

SELinux denied access requested by gdm-session-wor. It is not expected that this
access is required by gdm-session-wor and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Permitiendo Acceso:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug

Información Adicional:

Contexto Fuente               system_u:system_r:xdm_t:s0-s0:c0.c1023
Contexto Destino              system_u:object_r:pcscd_var_run_t:s0
Objetos Destino               event.1652.17022326 [ fifo_file ]
Fuente                        gdm-session-wor
Dirección de Fuente          /usr/libexec/gdm-session-worker
Puerto                        <Desconocido>
Nombre de Equipo              (removed)
Paquetes RPM Fuentes          gdm-2.28.1-24.fc12
Paquetes RPM Destinos         
RPM de Políticas             selinux-policy-3.6.32-55.fc12
SELinux Activado              True
Tipo de Política             targeted
Modo Obediente                Enforcing
Nombre de Plugin              catchall
Nombre de Equipo              (removed)
Plataforma                    Linux (removed)
                              #1 SMP Fri Dec 4 00:06:26 EST 2009 x86_64 x86_64
Cantidad de Alertas           743
Visto por Primera Vez         mié 09 dic 2009 21:11:21 CST
Visto por Última Vez         mié 09 dic 2009 21:19:32 CST
ID Local                      4298a4be-6be2-43e9-802c-e6d355dbe081
Números de Línea            

Mensajes de Auditoría Crudos 

node=(removed) type=AVC msg=audit(1260415172.652:128246): avc:  denied  { create } for  pid=1652 comm="gdm-session-wor" name="event.1652.17022326" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:pcscd_var_run_t:s0 tclass=fifo_file

node=(removed) type=SYSCALL msg=audit(1260415172.652:128246): arch=c000003e syscall=133 success=no exit=-13 a0=7fffbe5362f0 a1=11a4 a2=0 a3=ffffffeb items=0 ppid=1558 pid=1652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdm-session-wor" exe="/usr/libexec/gdm-session-worker" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)

Hash String generated from  selinux-policy-3.6.32-55.fc12,catchall,gdm-session-wor,xdm_t,pcscd_var_run_t,fifo_file,create
audit2allow suggests:

#============= xdm_t ==============
allow xdm_t pcscd_var_run_t:fifo_file create;

Comment 1 Daniel Walsh 2009-12-12 12:27:24 UTC
You can add these rules for now using

# grep avc /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Fixed in selinux-policy-3.6.32-59.fc12.noarch

Comment 2 Fedora Update System 2009-12-16 13:54:42 UTC
selinux-policy-3.6.32-59.fc12 has been submitted as an update for Fedora 12.

Comment 3 Fedora Update System 2009-12-18 04:42:53 UTC
selinux-policy-3.6.32-59.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-13384

Note You need to log in before you can comment on or make changes to this bug.