Summary: SELinux is preventing /usr/bin/python "write" access on /usr/share/system-config-firewall. Detailed Description: [SELinux is in permissive mode. This access was not denied.] SELinux denied access requested by system-config-f. It is not expected that this access is required by system-config-f and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context system_u:system_r:firewallgui_t:s0-s0:c0.c1023 Target Context system_u:object_r:usr_t:s0 Target Objects /usr/share/system-config-firewall [ dir ] Source system-config-f Source Path /usr/bin/python Port <Unknown> Host (removed) Source RPM Packages python-2.7-7.fc14 Target RPM Packages system-config-firewall-base-1.2.25-1.fc14 Policy RPM selinux-policy-3.8.8-8.fc14 Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Plugin Name catchall Host Name (removed) Platform Linux (removed) 2.6.35-2.fc14.x86_64 #1 SMP Wed Aug 4 19:15:25 UTC 2010 x86_64 x86_64 Alert Count 3 First Seen Wed 04 Aug 2010 07:15:21 PM PDT Last Seen Wed 04 Aug 2010 07:15:21 PM PDT Local ID 0b411366-5eef-45bf-91e5-86c698eefd64 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1280974521.535:20192): avc: denied { write } for pid=30655 comm="system-config-f" name="system-config-firewall" dev=dm-0 ino=37660 scontext=system_u:system_r:firewallgui_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=dir node=(removed) type=AVC msg=audit(1280974521.535:20192): avc: denied { remove_name } for pid=30655 comm="system-config-f" name="fw_dbus.pyc" dev=dm-0 ino=54076 scontext=system_u:system_r:firewallgui_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=dir node=(removed) type=AVC msg=audit(1280974521.535:20192): avc: denied { unlink } for pid=30655 comm="system-config-f" name="fw_dbus.pyc" dev=dm-0 ino=54076 scontext=system_u:system_r:firewallgui_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=file node=(removed) type=SYSCALL msg=audit(1280974521.535:20192): arch=c000003e syscall=87 success=yes exit=0 a0=7fffd98f0920 a1=0 a2=4bd5a245 a3=1 items=0 ppid=30654 pid=30655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="system-config-f" exe="/usr/bin/python" subj=system_u:system_r:firewallgui_t:s0-s0:c0.c1023 key=(null) Hash String generated from catchall,system-config-f,firewallgui_t,usr_t,dir,write audit2allow suggests: #============= firewallgui_t ============== #!!!! The source type 'firewallgui_t' can write to a 'dir' of the following types: # etc_t, firewallgui_tmp_t, tmp_t, system_conf_t allow firewallgui_t usr_t:dir { write remove_name }; allow firewallgui_t usr_t:file unlink;
This is either local customization. Were you editing fw_dbus.py? If not then this is a bug in system-config-firewall, in that it is supposed to ship the compiled python executables. If you run python /usr/share/system-config-firewall/fw_dbus.py The problem will go a way.
*** Bug 622881 has been marked as a duplicate of this bug. ***
Dan, I wasn't directly editing fw_dbus.py, so I ran the command in Comment 1. I reinstalled system-config-firewall since you mentioned there could be a problem with it. Then I opened the Firewall gui again in System > Administration and got this denial again and another one. The second one was 'SELinux is preventing /usr/bin/python "add-name" access on fw_dbus.pyc.' Would you like me to submitt that denial? Also, should I change this bug to system-config-firewall, or open a new one if that's the problem? Thanks, Gene
Yes it is a bug in firewall tool.
The package was built with python 2.6 and python 2.7 wants to recreate the object files. There is an update pending for testing, that should fix this: system-config-firewall-1.2.27-1.fc14. It has been built with python-2.7. The rebuild should have been done by the python rebuild, but there are some python packages that have not been rebuilt: All that do not have files in the site-packages tree as far as I can see so far, because there is no requirement for "python(abi) = 2.6", but it should be in my opinion.
system-config-firewall-1.2.27-1.fc14 has been submitted as an update for Fedora 14. http://admin.fedoraproject.org/updates/system-config-firewall-1.2.27-1.fc14
(In reply to comment #4) > Yes it is a bug in firewall tool. Just for the record (and clarification), the issue is not a bug in system-config-firewall, but rather that this package wasn't rebuilt for Python 2.7 during the recent mass rebuild (which is due to bug #623233). This means that python attempts to rebuild the python modules with invalid (old) .pyc/.pyo files every time a program is run as root, resulting in the SELinux alerts observed.
gdesklet-SlideShow-0.9-8.fc14 has been submitted as an update for Fedora 14. http://admin.fedoraproject.org/updates/gdesklet-SlideShow-0.9-8.fc14
gdesklet-SlideShow-0.9-8.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/gdesklet-SlideShow-0.9-8.fc13
gdesklet-SlideShow-0.9-8.fc13 has been pushed to the Fedora 13 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update gdesklet-SlideShow'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/gdesklet-SlideShow-0.9-8.fc13
gdesklet-SlideShow-0.9-8.fc14 has been pushed to the Fedora 14 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update gdesklet-SlideShow'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/gdesklet-SlideShow-0.9-8.fc14
system-config-firewall-1.2.27-1.fc14 has been pushed to the Fedora 14 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update system-config-firewall'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/system-config-firewall-1.2.27-1.fc14
Thanks, the update described in Comment 12 does fix the AVC Denial. Gene
gdesklet-SlideShow-0.9-8.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.
gdesklet-SlideShow-0.9-8.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.
system-config-firewall-1.2.27-1.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.