Fedora Account System
Red Hat Associate
Red Hat Customer
Summary: SELinux is preventing /usr/bin/mpd "read" access on /home/wlan/Music. Detailed Description: [mpd has a permissive type (mpd_t). This access was not denied.] SELinux denied access requested by mpd. It is not expected that this access is required by mpd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context unconfined_u:system_r:mpd_t:s0 Target Context unconfined_u:object_r:user_home_t:s0 Target Objects /home/wlan/Music [ dir ] Source mpd Source Path /usr/bin/mpd Port <Unknown> Host (removed) Source RPM Packages mpd-0.15.8-1.fc13 Target RPM Packages Policy RPM selinux-policy-3.7.19-28.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name (removed) Platform Linux desktop.local 2.6.33.5-124.fc13.x86_64 #1 SMP Fri Jun 11 09:38:12 UTC 2010 x86_64 x86_64 Alert Count 1 First Seen Fri 25 Jun 2010 02:37:50 PM SAMT Last Seen Fri 25 Jun 2010 02:37:50 PM SAMT Local ID bd6c81cb-e909-4998-90a1-b671f807f49b Line Numbers Raw Audit Messages node=desktop.local type=AVC msg=audit(1277462270.635:20401): avc: denied { read } for pid=2269 comm="mpd" name="Music" dev=dm-3 ino=131093 scontext=unconfined_u:system_r:mpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir node=desktop.local type=SYSCALL msg=audit(1277462270.635:20401): arch=c000003e syscall=2 success=yes exit=73014444160 a0=7fb5e00008c0 a1=90800 a2=0 a3=11 items=0 ppid=1 pid=2269 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="mpd" exe="/usr/bin/mpd" subj=unconfined_u:system_r:mpd_t:s0 key=(null) Hash String generated from catchall,mpd,mpd_t,user_home_t,dir,read audit2allow suggests: #============= mpd_t ============== allow mpd_t user_home_t:dir read;
I was thinking about that while I was creating mpd policy. The default location for MPD music is /var/lib/mpd/music directory. But I guess I can add a new boolean for MPD which will allow it.
Add a type for this directory and then allow it to read. Don't add a boolean type audio_home_t; Put this in usedom definitions. Send me a patch....
Fixed in selinux-policy-3.7.19-32.fc13
selinux-policy-3.7.19-33.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/selinux-policy-3.7.19-33.fc13
selinux-policy-3.7.19-33.fc13 has been pushed to the Fedora 13 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/selinux-policy-3.7.19-33.fc13
selinux-policy-3.7.19-33.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.
(In reply to comment #5) > selinux-policy-3.7.19-33.fc13 has been pushed to the Fedora 13 testing > repository. If problems still persist, please make note of it in this bug > report. > If you want to test the update, you can install it with > su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can > provide feedback for this update here: > http://admin.fedoraproject.org/updates/selinux-policy-3.7.19-33.fc13 Hi! I tried this, but it did not fix the problem. Now, how do I downgrade back to the non-test SELinux?
(In reply to comment #7) > > Hi! I tried this, but it did not fix the problem. Does it mean the same problem still persists? What AVC messages are you seeing?
(In reply to comment #8) > (In reply to comment #7) > > > > > Hi! I tried this, but it did not fix the problem. > Does it mean the same problem still persists? What AVC messages are you seeing? Yes. I saw the same errors, along with quite a few others. I have decided to use MPlayer to listen to internet radio instead.
What is your outputs of # matchpathcon /home/wlan/Music and # rpm -qa selinux-policy-\* Could you attach these AVC messages. I would like to know where the problem is. Thanks.
Not that exactly. I have no folder "/home/wlan/Music". What I mean is, I have the same problem as the user who submitted this. [silent@TERMINAL-BMRF-9 ~]$ sudo matchpathcon /home/wlan/Music [sudo] password for silent: /home/wlan/Music unconfined_u:object_r:audio_home_t:s0 [silent@TERMINAL-BMRF-9 ~]$ sudo matchpathcon /home/silent/Audio /home/silent/Audio unconfined_u:object_r:user_home_t:s0 [silent@TERMINAL-BMRF-9 ~]$ rpm -qa selinux-policy-\* selinux-policy-targeted-3.7.19-51.fc13.noarch
Excellent analysis. SELinux is all about labels. We allow MPD to read audio content with the "audio_home_t" label in home directories. But you have your audio content labelled as "user_home_t". So you need to set the label. # chcon -R -t audio_home_t /home/silent/Audio will fix. Dan, I will add HOME_DIR/Audio(/.*)? gen_context(system_u:object_r:audio_home_t,s0)
(In reply to comment #12) > Excellent analysis. > > SELinux is all about labels. We allow MPD to read audio content with the > "audio_home_t" label in home directories. But you have your audio content > labelled as "user_home_t". So you need to set the label. > > # chcon -R -t audio_home_t /home/silent/Audio > > will fix. > > > Dan, > I will add > > HOME_DIR/Audio(/.*)? gen_context(system_u:object_r:audio_home_t,s0) I still can't use MPD. SELinux complains about quite a few things, including pulseaudio. I've never used SELinux before, my last distro was Mint.
Could you send me your /var/log/audit/audit.log? If you are interested http://docs.fedoraproject.org/en-US/Fedora/13/html/Security-Enhanced_Linux/ http://danwalsh.livejournal.com/ http://sradvan.fedorapeople.org/SELinux_FAQ/
Sure.
Miroslav what is the standard directory for this? Is this user defined?
Oops, I missed your question. Anyways, you are right, it is not the standard directory. I was thinking about Music dir, which is the standard dir, but the problem is about Audio dir.