Summary: SELinux is preventing /usr/libexec/polkit-1/polkitd "search" access on /root/.config. Detailed Description: [SELinux is in permissive mode. This access was not denied.] SELinux denied access requested by polkitd. It is not expected that this access is required by polkitd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context system_u:system_r:policykit_t:s0-s0:c0.c1023 Target Context system_u:object_r:gnome_home_t:s0 Target Objects /root/.config [ dir ] Source polkitd Source Path /usr/libexec/polkit-1/polkitd Port <Unknown> Host (removed) Source RPM Packages polkit-0.95-0.git20090913.3.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.32-78.fc12 Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Plugin Name catchall Host Name (removed) Platform Linux (removed) 2.6.31.12-174.2.3.fc12.x86_64 #1 SMP Mon Jan 18 19:52:07 UTC 2010 x86_64 x86_64 Alert Count 3 First Seen IST 16:20:39 2010 ינו 28 ה' Last Seen IST 16:20:39 2010 ינו 28 ה' Local ID 9467cfa7-8847-4b26-ab45-8266db404e4b Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1264688439.908:7): avc: denied { search } for pid=1510 comm="polkitd" name=".config" dev=sda6 ino=1540128 scontext=system_u:system_r:policykit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:gnome_home_t:s0 tclass=dir node=(removed) type=AVC msg=audit(1264688439.908:7): avc: denied { read } for pid=1510 comm="polkitd" name="user-dirs.dirs" dev=sda6 ino=1540129 scontext=system_u:system_r:policykit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:gnome_home_t:s0 tclass=file node=(removed) type=AVC msg=audit(1264688439.908:7): avc: denied { open } for pid=1510 comm="polkitd" name="user-dirs.dirs" dev=sda6 ino=1540129 scontext=system_u:system_r:policykit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:gnome_home_t:s0 tclass=file node=(removed) type=SYSCALL msg=audit(1264688439.908:7): arch=c000003e syscall=2 success=yes exit=4294967424 a0=1e7b830 a1=0 a2=0 a3=1d items=0 ppid=1509 pid=1510 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="polkitd" exe="/usr/libexec/polkit-1/polkitd" subj=system_u:system_r:policykit_t:s0-s0:c0.c1023 key=(null) Hash String generated from selinux-policy-3.6.32-78.fc12,catchall,polkitd,policykit_t,gnome_home_t,dir,search audit2allow suggests: #============= policykit_t ============== allow policykit_t gnome_home_t:dir search; allow policykit_t gnome_home_t:file { read open };
Miroslav, I think we should change to gnome_read_config(policykit_t) elad, did you log in as root via X? Not a good idea. You can just remove that directory and policykit will stop complaining. rm -R /root/.config
the last time i connected as root via X was two years ago, when i was new to Linux. and i did it only once. I saw this message when I logged in as my normal user (not root).
Right but I think the file might be left around since then. Anyways it would have been blocked if you were in enforcing mode and removing the directory should not cause you a problem. Miroslav will have a fix out in a couple of weeks, I am sure.
Fixed in selinux-policy-3.6.32-79.fc12
selinux-policy-3.6.32-82.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-82.fc12
selinux-policy-3.6.32-84.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-1492
I tried to install the update and got an error. Here is a copy of the yum session: su -c 'yum --enablerepo=updates-testing update selinux-policy' Password: Loaded plugins: dellsysidplugin2, presto, refresh-packagekit updates-testing/metalink | 6.7 kB 00:00 http://fedora.fastsoft.net/pub/linux/fedora/linux/updates/testing/12/i386/repodata/repomd.xml: [Errno 14] PYCURL ERROR 6 - "" Trying other mirror. updates-testing | 4.4 kB 00:00 updates-testing/primary_db | 921 kB 00:27 Setting up Update Process No Packages marked for Update
It probably has not reached your mirror yet.
Successfully installed the update, but still get the same warnings at startup. Do I need to force relabel? I've tried a couple times but not since I applied updated policies. I'll also remove the /root/.config file again.
Are you sure you are getting the same error? What does this output? # ausearch -m avc -ts recent -i
I shall muddy the waters a bit. When I received the first selinux report of this problem I was running with selinux set to permissive and during the next boot I received another selinux warning. I then changed selinux to enforcing. It seems strange - but, I have not received any selinux interventions on numerous subsequent boots. And I have not installed the update.
That is because permissive and enforcing work slightly differently. If I am enforcing mode and mypolicy dontaudit's search by process a_t of a directory of type b_t, the app a_t will stop and go down a different code path. In permissive mode a_t will be allowed to read b_t directory and will proceed to try to read files label b_t. If we don't have dontaudit rules for process a_t reading files b_t, avc messages will get generated.
>> Are you sure you are getting the same error? >> >> What does this output? >> # ausearch -m avc -ts recent -i $ ausearch -m avc -ts recent -i Error opening config file (Permission denied) NOTE - using built-in logs: /var/log/audit/audit.log Error opening /var/log/audit/audit.log (Permission denied) $
Set selinux to enforcing mode. Upon reboot, SELinux popped up with a message about two warnings about potential issues. However, when I click to show the error details, SELinux pops up with a 0 problems detected, 0 of 0 display. I'm a bit confused.
Chris you need to run ausearch as root. There is a new setroubleshoot bug which will stop reporting old avcs as new.
I installed the update with su -c 'yum --enablerepo=updates-testing update selinux-policy' and got no more complaints since then. Thanks a lot for the fix !
Daniel: Ran ausearch as root: [chris@ChrisDELL ~]$ su Password: [root@ChrisDELL chris]# ausearch -m avc -ts recent -i <no matches> [root@ChrisDELL chris]# exit exit
Good that means SELinux is not complaining about anything. You can also try the new setroubleshoot. #yum update setroubleshoot\* --enablerepo=updates-testing
selinux-policy-3.6.32-84.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.