요약: SELinux is preventing gdm-binary (xdm_t) "unlink" to ./force-display-on-active-vt (var_spool_t). 상세 설명: SELinux is preventing gdm-binary (xdm_t) "unlink" to ./force-display-on-active-vt (var_spool_t). The SELinux type var_spool_t, is a generic type for all files in the directory and very few processes (SELinux Domains) are allowed to write to this SELinux type. This type of denial usual indicates a mislabeled file. By default a file created in a directory has the gets the context of the parent directory, but SELinux policy has rules about the creation of directories, that say if a process running in one SELinux Domain (D1) creates a file in a directory with a particular SELinux File Context (F1) the file gets a different File Context (F2). The policy usually allows the SELinux Domain (D1) the ability to write, unlink, and append on (F2). But if for some reason a file (./force-display-on-active-vt) was created with the wrong context, this domain will be denied. The usual solution to this problem is to reset the file context on the target file, restorecon -v './force-display-on-active-vt'. If the file context does not change from var_spool_t, then this is probably a bug in policy. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy package. If it does change, you can try your application again to see if it works. The file context could have been mislabeled by editing the file or moving the file from a different directory, if the file keeps getting mislabeled, check the init scripts to see if they are doing something to mislabel the file. 액세스 허용: You can attempt to fix file context by executing restorecon -v './force-display-on-active-vt' Fix 명령 : restorecon './force-display-on-active-vt' 자세한 정보: 소스 문맥 system_u:system_r:xdm_t:s0-s0:c0.c1023 대상 문맥 system_u:object_r:var_spool_t:s0 대상 객체 ./force-display-on-active-vt [ file ] 소스 gdm-binary 소스 경로 /usr/sbin/gdm-binary 포트 <알려지지 않음> 호스트 (removed) 소스 RPM 패키지 gdm-2.24.1-4.fc10 대상 RPM 패키지 정책 RPM selinux-policy-3.5.13-59.fc10 Selinux 활성화 True 정책 유형 targeted 강제 모드 Enforcing 플러그인명 mislabeled_file 호스트명 (removed) 플랫폼 Linux (removed) 2.6.27.24-170.2.68.fc10.x86_64 #1 SMP Wed May 20 22:47:23 EDT 2009 x86_64 x86_64 통지 카운트 7 초기 화면 2009년 04월 30일 (목) 오후 09시 44분 52초 마지막 화면 2009년 06월 01일 (월) 오전 10시 08분 13초 로컬 ID 814f27a0-93ff-43ef-a13b-ed50e0b60a5f 줄 번호 원 감사 메세지 node=(removed) type=AVC msg=audit(1243818493.597:8): avc: denied { unlink } for pid=2625 comm="gdm-binary" name="force-display-on-active-vt" dev=sda1 ino=401434 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=file node=(removed) type=SYSCALL msg=audit(1243818493.597:8): arch=c000003e syscall=87 success=no exit=-13 a0=41bf88 a1=0 a2=1 a3=8101010101010100 items=0 ppid=1 pid=2625 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdm-binary" exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) Hash String generated from mislabeled_file,gdm-binary,xdm_t,var_spool_t,file,unlink audit2allow suggests: #============= xdm_t ============== allow xdm_t var_spool_t:file unlink;
*** This bug has been marked as a duplicate of bug 538428 ***