Fedora Account System
Red Hat Associate
Red Hat Customer
Zusammenfassung: SELinux is preventing /usr/libexec/abrt-hook-python access to a leaked socket file descriptor. Detaillierte Beschreibung: [abrt-hook-pytho hat einen toleranten Typ (abrt_helper_t). Dieser Zugriff wurde nicht verweigert.] SELinux denied access requested by the abrt-hook-pytho command. It looks like this is either a leaked descriptor or abrt-hook-pytho output was redirected to a file it is not allowed to access. Leaks usually can be ignored since SELinux is just closing the leak and reporting the error. The application does not use the descriptor, so it will run properly. If this is a redirection, you will not get output in the socket. You should generate a bugzilla on selinux-policy, and it will get routed to the appropriate package. You can safely ignore this avc. Zugriff erlauben: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Zusätzliche Informationen: Quellkontext unconfined_u:unconfined_r:abrt_helper_t:s0-s0:c0.c 1023 Zielkontext unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Zielobjekte socket [ socket ] Quelle abrt-hook-pytho Quellen-Pfad /usr/libexec/abrt-hook-python Port <Unbekannt> Host (removed) Quellen-RPM-Pakete abrt-addon-python-1.0.3-1.fc12 Ziel-RPM-Pakete RPM-Richtlinie selinux-policy-3.6.32-69.fc12 SELinux aktiviert True Richtlinienversion targeted Enforcing-Modus Enforcing Plugin-Name leaks Hostname (removed) Plattform Linux (removed) 2.6.31.12-174.2.3.fc12.x86_64 #1 SMP Mon Jan 18 19:52:07 UTC 2010 x86_64 x86_64 Anzahl der Alarme 1 Zuerst gesehen Fr 22 Jan 2010 12:08:50 CET Zuletzt gesehen Fr 22 Jan 2010 12:08:50 CET Lokale ID 41978654-6c67-4842-bfd3-475961f8ea10 Zeilennummern Raw-Audit-Meldungen node=(removed) type=AVC msg=audit(1264158530.900:37): avc: denied { read write } for pid=4984 comm="abrt-hook-pytho" path="socket:[70305]" dev=sockfs ino=70305 scontext=unconfined_u:unconfined_r:abrt_helper_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=socket node=(removed) type=SYSCALL msg=audit(1264158530.900:37): arch=c000003e syscall=59 success=yes exit=0 a0=16620f0 a1=1599830 a2=1641090 a3=20 items=0 ppid=4967 pid=4984 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=475 sgid=475 fsgid=475 tty=(none) ses=1 comm="abrt-hook-pytho" exe="/usr/libexec/abrt-hook-python" subj=unconfined_u:unconfined_r:abrt_helper_t:s0-s0:c0.c1023 key=(null) Hash String generated from selinux-policy-3.6.32-69.fc12,leaks,abrt-hook-pytho,abrt_helper_t,unconfined_t,socket,read,write audit2allow suggests: #============= abrt_helper_t ============== allow abrt_helper_t unconfined_t:socket { read write };
Miroslav, Can you make abrt_domtrans_helper look like the following. interface(`abrt_domtrans_helper',` gen_require(` type abrt_helper_t, abrt_helper_exec_t; ') domtrans_pattern($1, abrt_helper_exec_t, abrt_helper_t) ifdef(`hide_broken_symptoms', ` dontaudit abrt_helper_t $1:socket_class_set { read write }; fs_dontaudit_rw_anon_inodefs_files(abrt_helper_t) ') ') Also add socket to socket_class_set in obj_perm_sets.spt
Fixed in selinux-policy-3.6.32-80.fc12
selinux-policy-3.6.32-82.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-82.fc12
selinux-policy-3.6.32-84.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-1492
selinux-policy-3.6.32-84.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.