Bug 625367 - SELinux is preventing /usr/libexec/kde4/kdm_greet "write" access on /usr/libexec/kde4/lnusertemp
SELinux is preventing /usr/libexec/kde4/kdm_greet "write" access on /usr/libe...
Status: CLOSED DUPLICATE of bug 590883
Product: Fedora
Classification: Fedora
Component: kdebase-workspace (Show other bugs)
13
All Linux
low Severity medium
: ---
: ---
Assigned To: Ngo Than
Fedora Extras Quality Assurance
:
Depends On:
Blocks: F14Blocker/F14FinalBlocker
  Show dependency treegraph
 
Reported: 2010-08-19 04:01 EDT by Michal Hlavinka
Modified: 2010-09-30 09:10 EDT (History)
14 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-09-30 09:10:17 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Michal Hlavinka 2010-08-19 04:01:03 EDT
this happens during/just after login, because selinux alert shows up always just after login. I use autologin (with session lock) and user switching

Summary:

SELinux is preventing /usr/libexec/kde4/kdm_greet "write" access on
/usr/libexec/kde4/lnusertemp.

Detailed Description:

SELinux denied access requested by kdm_greet. It is not expected that this
access is required by kdm_greet and this access may signal an intrusion attempt.
It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context                system_u:object_r:bin_t:s0
Target Objects                /usr/libexec/kde4/lnusertemp [ file ]
Source                        kdm_greet
Source Path                   /usr/libexec/kde4/kdm_greet
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           kdm-4.5.0-2.fc13
Target RPM Packages           kdelibs-4.5.0-1.fc13
Policy RPM                    selinux-policy-3.7.19-47.fc13
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     (removed)
Platform                      Linux nbone.mihlnet 2.6.34.4-40.fc13.x86_64 #1 SMP
                              Tue Aug 17 04:57:20 UTC 2010 x86_64 x86_64
Alert Count                   10
First Seen                    Wed 18 Aug 2010 08:56:34 AM CEST
Last Seen                     Wed 18 Aug 2010 06:11:16 PM CEST
Local ID                      a0f7a1e7-d4e1-442f-ac47-3a505b4d8dad
Line Numbers                  

Raw Audit Messages            

node=nbone.mihlnet type=AVC msg=audit(1282147876.74:22491): avc:  denied  { write } for  pid=27911 comm="kdm_greet" name="lnusertemp" dev=sda5 ino=139022 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file

node=nbone.mihlnet type=SYSCALL msg=audit(1282147876.74:22491): arch=c000003e syscall=21 success=no exit=-13 a0=26fef48 a1=2 a2=7fffaf6dc300 a3=34 items=0 ppid=27908 pid=27911 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kdm_greet" exe="/usr/libexec/kde4/kdm_greet" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
Comment 1 Michal Hlavinka 2010-08-26 08:48:55 EDT
I just got the same selinux error in F-14 Alpha
Comment 2 Todd Jackson 2010-09-17 18:35:07 EDT
I get this same error also, Fedora14 Alpha
This is a fresh install.

Summary:

SELinux is preventing /usr/libexec/kde4/kdm_greet "write" access on
/usr/libexec/kde4/lnusertemp.

Detailed Description:

SELinux denied access requested by kdm_greet. It is not expected that this
access is required by kdm_greet and this access may signal an intrusion attempt.
It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context                system_u:object_r:bin_t:s0
Target Objects                /usr/libexec/kde4/lnusertemp [ file ]
Source                        kdm_greet
Source Path                   /usr/libexec/kde4/kdm_greet
Port                          <Unknown>
Host                          f14alpha
Source RPM Packages           kdm-4.5.1-2.fc14
Target RPM Packages           kdelibs-4.5.1-3.fc14
Policy RPM                    selinux-policy-3.9.3-4.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     f14alpha
Platform                      Linux f14alpha 2.6.35.4-12.fc14.x86_64 #1 SMP Fri
                              Aug 27 07:45:05 UTC 2010 x86_64 x86_64
Alert Count                   10
First Seen                    Tue 14 Sep 2010 02:26:31 PM PDT
Last Seen                     Fri 17 Sep 2010 01:19:49 PM PDT
Local ID                      af9eda4b-5fa1-4b27-8bcd-2737e366288d
Line Numbers                  

Raw Audit Messages            

node=f14alpha type=AVC msg=audit(1284754789.962:14): avc:  denied  { write } for  pid=1668 comm="kdm_greet" name="lnusertemp" dev=dm-0 ino=1709931 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file

node=f14alpha type=SYSCALL msg=audit(1284754789.962:14): arch=c000003e syscall=21 success=no exit=-13 a0=aafd38 a1=2 a2=7fff3dab5f10 a3=e8 items=0 ppid=1665 pid=1668 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kdm_greet" exe="/usr/libexec/kde4/kdm_greet" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
Comment 3 Adam Williamson 2010-09-22 09:35:09 EDT
Same denial on boot of a clean installed F14 Beta RC3 KDE spin, x86-64 install. Proposing for F14Blocker: "In most cases, there must be no SELinux 'AVC: denied' messages or abrt crash notifications on initial boot and subsequent login (see Blocker_Bug_FAQ)"

Summary:

SELinux is preventing /usr/libexec/kde4/kdm_greet "write" access on lnusertemp.

Detailed Description:

SELinux denied access requested by kdm_greet. It is not expected that this
access is required by kdm_greet and this access may signal an intrusion attempt.
It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context                system_u:object_r:bin_t:s0
Target Objects                lnusertemp [ file ]
Source                        kdm_greet
Source Path                   /usr/libexec/kde4/kdm_greet
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           kdm-4.5.1-3.fc14
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.3-1.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     (removed)
Platform                      Linux localhost.localdomain
                              2.6.35.4-28.fc14.x86_64 #1 SMP Wed Sep 15 01:56:54
                              UTC 2010 x86_64 x86_64
Alert Count                   5
First Seen                    Wed 22 Sep 2010 03:16:08 PM BST
Last Seen                     Wed 22 Sep 2010 03:16:10 PM BST
Local ID                      83265b5d-9304-463b-8b13-da7118fff251
Line Numbers                  

Raw Audit Messages            

node=localhost.localdomain type=AVC msg=audit(1285164970.178:16): avc:  denied  { write } for  pid=1768 comm="kdm_greet" name="lnusertemp" dev=sdb1 ino=41966 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file

node=localhost.localdomain type=SYSCALL msg=audit(1285164970.178:16): arch=c000003e syscall=21 success=no exit=-13 a0=1c9fdd8 a1=2 a2=7fff65640ec0 a3=e8 items=0 ppid=1765 pid=1768 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kdm_greet" exe="/usr/libexec/kde4/kdm_greet" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)



-- 
Fedora Bugzappers volunteer triage team
https://fedoraproject.org/wiki/BugZappers
Comment 4 Radek Novacek 2010-09-30 09:10:17 EDT

*** This bug has been marked as a duplicate of bug 590883 ***

Note You need to log in before you can comment on or make changes to this bug.