Summary: SELinux is preventing /usr/bin/chsh "execute" access on nxserver. Detailed Description: [SELinux is in permissive mode. This access was not denied.] SELinux denied access requested by chsh. It is not expected that this access is required by chsh and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://(removed).redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context unconfined_u:unconfined_r:chfn_t:s0-s0:c0.c1023 Target Context system_u:object_r:nx_server_exec_t:s0 Target Objects nxserver [ file ] Source chsh Source Path /usr/bin/chsh Port <Unknown> Host (removed) Source RPM Packages util-linux-ng-2.16.2-5.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.32-66.fc12 Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Plugin Name catchall Host Name (removed) Platform Linux (removed) 2.6.31.9-174.fc12.x86_64 #1 SMP Mon Dec 21 05:33:33 UTC 2009 x86_64 x86_64 Alert Count 2 First Seen Thu 14 Jan 2010 12:23:33 CET Last Seen Thu 14 Jan 2010 12:30:36 CET Local ID 1d67d726-c7da-49fd-9641-ac0d92655dac Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1263468636.741:23474): avc: denied { execute } for pid=20753 comm="chsh" name="nxserver" dev=dm-1 ino=428603 scontext=unconfined_u:unconfined_r:chfn_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nx_server_exec_t:s0 tclass=file node=(removed) type=SYSCALL msg=audit(1263468636.741:23474): arch=c000003e syscall=21 success=yes exit=0 a0=7faedbd115a0 a1=1 a2=726576 a3=7fff2067f610 items=0 ppid=20751 pid=20753 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=13 comm="chsh" exe="/usr/bin/chsh" subj=unconfined_u:unconfined_r:chfn_t:s0-s0:c0.c1023 key=(null) Hash String generated from selinux-policy-3.6.32-66.fc12,catchall,chsh,chfn_t,nx_server_exec_t,file,execute audit2allow suggests: #============= chfn_t ============== allow chfn_t nx_server_exec_t:file execute;
Why would chsh be executing the nxserver? Is this the login shell?
it happens on the system start-up. my login shell should be bash but maybe the starting nxserver try to change the shell. but the nxserver is also working with this restriction.
Any chance nxserver is listed in /etc/shells? chsh might be checking which shells are executables? is nxserver in the /etc/passwd?
the nxserver is not in the /etc/shells but in /etc/passwd: nx:x:491:475::/usr/NX/home/nx:/usr/NX/bin/nxserver and I noticed that's the NoMachine server... I completely forgot that I changed to the proprietary one some months ago.
Miroslav, add optional_policy(` nx_exec_server(chfn_t) ') to usermanage.te and ######################################## ## <summary> ## Execute the NX server. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`nx_exec_server',` gen_require(` type nx_server_exec_t; ') can_exec($1, nx_server_exec_t) ') to nx.if
Fixed in selinux-policy-3.6.32-78.fc12
selinux-policy-3.6.32-78.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-78.fc12
selinux-policy-3.6.32-78.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-1207
selinux-policy-3.6.32-78.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.