Summary: SELinux is preventing /usr/sbin/abrtd "read" access on abrt. Detailed Description: SELinux denied access requested by abrtd. It is not expected that this access is required by abrtd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context system_u:system_r:abrt_t:s0-s0:c0.c1023 Target Context system_u:object_r:var_spool_t:s0 Target Objects abrt [ dir ] Source abrtd Source Path /usr/sbin/abrtd Port <Unknown> Host (removed) Source RPM Packages abrt-1.1.3-1.fc14 Target RPM Packages Policy RPM selinux-policy-3.7.19-15.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name (removed) Platform Linux (removed) 2.6.34-11.fc14.i686.PAE #1 SMP Sat May 22 01:03:27 UTC 2010 i686 i686 Alert Count 1 First Seen Sat 22 May 2010 09:41:25 PM EDT Last Seen Sat 22 May 2010 09:41:25 PM EDT Local ID 0e039f3c-e5d5-4718-a282-d01521739f68 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1274578885.302:6): avc: denied { read } for pid=1321 comm="abrtd" name="abrt" dev=sda2 ino=1049785 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=dir node=(removed) type=SYSCALL msg=audit(1274578885.302:6): arch=40000003 syscall=292 success=no exit=-13 a0=5 a1=8064e75 a2=180 a3=0 items=0 ppid=1320 pid=1321 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="abrtd" exe="/usr/sbin/abrtd" subj=system_u:system_r:abrt_t:s0-s0:c0.c1023 key=(null) Hash String generated from catchall,abrtd,abrt_t,var_spool_t,dir,read audit2allow suggests: #============= abrt_t ============== allow abrt_t var_spool_t:dir read;
abrt daemon failed to start. SELinux is also preventing /usr/sbin/abrtd "setaddr" access on abrt. Seems to be a continuation of the same problem that caused bug #593906. abrt daemon hasn't started since the update on 5/20. I executed the commands: # mkdir /var/spool/abrt # restorecon -R -v /var/spool/abrt on 5/20 when the problem first appeared, but it seems it didn't fix everything. I don't use SELinux on my regular installs, so I still quite an amateur at trying to generate local policy modules. Since abrt shouldn't need this type of access, I'll wait to see if it is a bug, or if it is something I should fix myself in SELinux policy. I know if I disable SELinux this alert will go away, but I'd rather learn SELinux by using it on my rawhide install, I just need confirmation if it is a bug or not. Thanks
What policy do you have installed? rpm -q selinux-policy ls -lZd /var/spool/abrt The problem is probably this directory is mislabled. abrt changed the location of the directory from /var/cache to /var/spool. This required a fix to selinux policy to put down the correct label. Secondarily abrt did not put the /var/spool/abrt directory in the payload. So rpm did not create the directory at install time with the correct label. Having an up 2 date policy and abrt package should fix the problem.
Please try this build: http://koji.fedoraproject.org/koji/taskinfo?taskID=2201357 and let me know if it still doesn't work
*** This bug has been marked as a duplicate of bug 593906 ***
[GoinEasy9@Fedora14dw32 ~]$ rpm -q selinux-policy selinux-policy-3.7.19-15.fc13.noarch [GoinEasy9@Fedora14dw32 ~]$ ls -lZd /var/spool/abrt drwxr-xr-x. abrt abrt system_u:object_r:var_spool_t:s0 /var/spool/abrt Will try koji build now.
I already have abrt 1.1.3-1 installed. [GoinEasy9@Fedora14dw32 ~]$ rpm -q abrt abrt-1.1.3-1.fc14.i686 Boot log still shows: Starting abrt daemon: [FAILED] SELinux is preventing /usr/sbin/abrtd "read" access on abrt. SELinux is preventing /usr/sbin/abrtd "setattr" access on abrt. I tried rm -r /var/spool/abrt and mkdir /var/spool/abrt then, restorecon -R -v /var/spool/abrt again with same results.
ls -lZd /var/spool/abrt Could you grab the full avc from /var/log/audit/audit.log
Created attachment 416205 [details] /var/log/audit/audit.log
[GoinEasy9@Fedora14dw32 ~]$ ls -lZd /var/spool/abrt drwxr-xr-x. root root unconfined_u:object_r:var_spool_t:s0 /var/spool/abrt
That is the wrong label. rpm -q selinux-policy
[GoinEasy9@Fedora14dw32 ~]$ rpm -q selinux-policy selinux-policy-3.7.19-15.fc13.noarch Should I remove /var/spool/abrt and reinstall selinux-policy? I see the result of ls -lZd /var/spool/abrt has changed from comment 5, possibly because I experimented as I stated at the bottom of comment 6.
(In reply to comment #11) > [GoinEasy9@Fedora14dw32 ~]$ rpm -q selinux-policy > selinux-policy-3.7.19-15.fc13.noarch > > Should I remove /var/spool/abrt and reinstall selinux-policy? > > I see the result of ls -lZd /var/spool/abrt has changed from comment 5, > possibly because I experimented as I stated at the bottom of comment 6. I am having the same problem [ats@asus ~]$ rpm -q abrt abrt-1.1.3-1.fc14.x86_64 [ats@asus ~]$ ls -lZd /var/spool/abrt drwxr-xr-x. abrt abrt system_u:object_r:var_spool_t:s0 /var/spool/abrt [ats@asus ~]$ rpm -q selinux-policy selinux-policy-3.7.19-15.fc13.noarch
Created attachment 416930 [details] audit.log
Please update to the latest policy in fedora-updates.
(In reply to comment #14) > Please update to the latest policy in fedora-updates. I had selinux-policy-3.7.19-15.fc13 yum offered me no update so I installed selinux-policy-3.7.19-21.fc13 from koji and abrtd upon reboot.
EDIT: abrtd started OK upon reboot
I removed /var/spool/abrt, reinstalled abrt, which resulted in: [GoinEasy9@Fedora14dw32 ~]$ ls -lZd /var/spool/abrt drwxr-xr-x. abrt abrt system_u:object_r:var_spool_t:s0 /var/spool/abrt I then installed selinux-policy-3.7.19-21.fc13 from koji, and the abrtd daemon started after reboot.
Can you bump karma on the selinux-policy