Bug 560836 - SELinux is preventing /usr/bin/kdm "write" access on /root.
Summary: SELinux is preventing /usr/bin/kdm "write" access on /root.
Keywords:
Status: CLOSED DUPLICATE of bug 543970
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: x86_64
OS: Linux
low
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:bea098d8e79...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-02-02 00:18 UTC by Dilamar Martinez
Modified: 2010-02-02 13:39 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-02-02 13:39:22 UTC


Attachments (Terms of Use)

Description Dilamar Martinez 2010-02-02 00:18:28 UTC
Resúmen:

SELinux is preventing /usr/bin/kdm "write" access on /root.

Descripción Detallada:

[SELinux esta en modo permisivo. Este acceso no fue denegado.]

SELinux denied access requested by kdm. It is not expected that this access is
required by kdm and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Permitiendo Acceso:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Información Adicional:

Contexto Fuente               system_u:system_r:xdm_t:s0-s0:c0.c1023
Contexto Destino              system_u:object_r:admin_home_t:s0
Objetos Destino               /root [ dir ]
Fuente                        kdm
Dirección de Fuente          /usr/bin/kdm
Puerto                        <Desconocido>
Nombre de Equipo              (removed)
Paquetes RPM Fuentes          kdm-4.3.90-9.fc13
Paquetes RPM Destinos         filesystem-2.4.31-1.fc13
RPM de Políticas             selinux-policy-3.7.8-2.fc13
SELinux Activado              True
Tipo de Política             targeted
Modo Obediente                Permissive
Nombre de Plugin              catchall
Nombre de Equipo              (removed)
Plataforma                    Linux (removed) 2.6.33-0.20.rc5.git0.fc13.x86_64 #1
                              SMP Fri Jan 22 19:49:17 UTC 2010 x86_64 x86_64
Cantidad de Alertas           9
Visto por Primera Vez         sáb 30 ene 2010 18:11:57 CET
Visto por Última Vez         lun 01 feb 2010 18:00:59 CET
ID Local                      784aa36f-98da-4db5-9a7e-be3389ab0773
Números de Línea            

Mensajes de Auditoría Crudos 

node=(removed) type=AVC msg=audit(1265043659.7:99): avc:  denied  { write } for  pid=13371 comm="kdm" name="root" dev=dm-0 ino=90113 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir

node=(removed) type=AVC msg=audit(1265043659.7:99): avc:  denied  { add_name } for  pid=13371 comm="kdm" name=".xsession-errors-:0" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir

node=(removed) type=AVC msg=audit(1265043659.7:99): avc:  denied  { create } for  pid=13371 comm="kdm" name=".xsession-errors-:0" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=file

node=(removed) type=AVC msg=audit(1265043659.7:99): avc:  denied  { append open } for  pid=13371 comm="kdm" name=".xsession-errors-:0" dev=dm-0 ino=2825 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1265043659.7:99): arch=c000003e syscall=2 success=yes exit=3 a0=2382900 a1=4c1 a2=180 a3=7fff59c89f00 items=0 ppid=13343 pid=13371 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=14 comm="kdm" exe="/usr/bin/kdm" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.7.8-2.fc13,catchall,kdm,xdm_t,admin_home_t,dir,write
audit2allow suggests:

#============= xdm_t ==============
#!!!! The source type 'xdm_t' can write to a 'dir' of the following types:
# xdm_rw_etc_t, root_t, tmp_t, var_t, user_fonts_t, user_tmpfs_t, xdm_spool_t, fonts_cache_t, user_home_dir_t, locale_t, var_auth_t, tmpfs_t, var_spool_t, var_lib_t, user_tmp_t, var_run_t, xdm_tmp_t, auth_cache_t, xdm_tmpfs_t, xserver_log_t, var_log_t, xdm_log_t, pam_var_run_t, xdm_var_lib_t, xdm_var_run_t, xdm_home_t, pam_var_console_t, pcscd_var_run_t, var_lock_t, xkb_var_lib_t, root_t

allow xdm_t admin_home_t:dir { write add_name };
allow xdm_t admin_home_t:file { create open append };

Comment 1 Daniel Walsh 2010-02-02 13:39:22 UTC

*** This bug has been marked as a duplicate of bug 543970 ***


Note You need to log in before you can comment on or make changes to this bug.