Résumé: SELinux is preventing /usr/libexec/vino-server "name_bind" access . Description détaillée: SELinux denied access requested by vino-server. It is not expected that this access is required by vino-server and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Autoriser l'accès: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Informations complémentaires: Contexte source staff_u:staff_r:staff_t:s0-s0:c0.c1023 Contexte cible system_u:object_r:vnc_port_t:s0 Objets du contexte None [ tcp_socket ] source vino-server Chemin de la source /usr/libexec/vino-server Port 5954 Hôte (removed) Paquetages RPM source vino-2.28.1-1.fc12 Paquetages RPM cible Politique RPM selinux-policy-3.6.32-108.fc12 Selinux activé True Type de politique targeted Mode strict Enforcing Nom du plugin catchall Nom de l'hôte (removed) Plateforme Linux (removed) 2.6.32.11-99.fc12.x86_64 #1 SMP Mon Apr 5 19:59:38 UTC 2010 x86_64 x86_64 Compteur d'alertes 110 Première alerte lun 12 avr 2010 16:21:16 EDT Dernière alerte lun 12 avr 2010 16:21:17 EDT ID local 19ae83a0-5fa4-41f6-af57-8ce17f6c8972 Numéros des lignes Messages d'audit bruts node=(removed) type=AVC msg=audit(1271103677.14:122): avc: denied { name_bind } for pid=2252 comm="vino-server" src=5954 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:vnc_port_t:s0 tclass=tcp_socket node=(removed) type=SYSCALL msg=audit(1271103677.14:122): arch=c000003e syscall=49 success=no exit=-13 a0=f a1=7fffdf3df330 a2=10 a3=7fffdf3df2ac items=0 ppid=2127 pid=2252 auid=500 uid=500 gid=501 euid=500 suid=500 fsuid=500 egid=501 sgid=501 fsgid=501 tty=(none) ses=1 comm="vino-server" exe="/usr/libexec/vino-server" subj=staff_u:staff_r:staff_t:s0-s0:c0.c1023 key=(null) Hash String generated from catchall,vino-server,staff_t,vnc_port_t,tcp_socket,name_bind audit2allow suggests: #============= staff_t ============== allow staff_t vnc_port_t:tcp_socket name_bind;
Miroslav, you are going to need to grab the corenetwork.te.in file from F13.
Miroslav you probably want to grab all of the corenetwork files. We found a bug when handling ranges of ports.
Sorry if it's a stupid question but... can it explain this AVC : https://bugzilla.redhat.com/show_bug.cgi?id=565374(In reply to comment #2) > Miroslav you probably want to grab all of the corenetwork files. We found a > bug when handling ranges of ports.
staff_t is supposed to be allowed to run user apps as server, if the port is > 1024 and the boolean user_tcp_server is turned on. SELinux policy has two attributes associated with port types. All port types have the attribute of port_type and ports less then 1024 have an attribute reserved_port_type. The policy says something like if user_tcp_server { allow staff_t { port_type -reserved_port_type }:tcp_socket name_bind; } But there is a bug in policy that is defining vnc_port_t as a reserved_port_type, even though none of the ports is less then 1024. The bug is in the handling of port ranges, and is fixed in the latest F13 corenetwork.*
Thank you for the informative answer Daniel ! (In reply to comment #2) > Miroslav you probably want to grab all of the corenetwork files. We found a > bug when handling ranges of ports. > The bug is in the handling of port ranges, and is fixed in the latest F13 > corenetwork.* Does that mean an update would be available too for F12 ?
Yes, I will fix it also in F12.
Fixed in selinux-policy-3.6.32-112.fc12
selinux-policy-3.6.32-113.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-113.fc12
selinux-policy-3.6.32-113.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-113.fc12
selinux-policy-3.6.32-113.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.