Bug 666454 - SELinux is preventing /usr/sbin/NetworkManager from 'unlink' accesses on the file /etc/hosts.
Summary: SELinux is preventing /usr/sbin/NetworkManager from 'unlink' accesses on the ...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 14
Hardware: x86_64
OS: Linux
low
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:77261c568d4...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-12-30 22:08 UTC by Jim McEvoy
Modified: 2011-08-07 14:37 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-01-03 14:13:05 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Jim McEvoy 2010-12-30 22:08:06 UTC
SELinux is preventing /usr/sbin/NetworkManager from 'unlink' accesses on the file /etc/hosts.

*****  Plugin restorecon (94.8 confidence) suggests  *************************

If you want to fix the label. 
/etc/hosts default label should be net_conf_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /etc/hosts

*****  Plugin catchall_labels (5.21 confidence) suggests  ********************

If you want to allow NetworkManager to have unlink access on the hosts file
Then you need to change the label on /etc/hosts
Do
# semanage fcontext -a -t FILE_TYPE '/etc/hosts'
where FILE_TYPE is one of the following: dhcpc_var_run_t, net_conf_t, pppd_var_run_t, dnsmasq_var_run_t, named_cache_t, NetworkManager_tmp_t, NetworkManager_etc_rw_t, NetworkManager_log_t, dhcpc_state_t, NetworkManager_var_lib_t, NetworkManager_var_run_t, root_t. 
Then execute: 
restorecon -v '/etc/hosts'


*****  Plugin catchall (1.44 confidence) suggests  ***************************

If you believe that NetworkManager should be allowed unlink access on the hosts file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep /usr/sbin/NetworkManager /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:NetworkManager_t:s0
Target Context                unconfined_u:object_r:etc_t:s0
Target Objects                /etc/hosts [ file ]
Source                        NetworkManager
Source Path                   /usr/sbin/NetworkManager
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           NetworkManager-0.8.1-10.git20100831.fc14
Target RPM Packages           setup-2.8.28-1.fc14
Policy RPM                    selinux-policy-3.9.7-19.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.35.10-74.fc14.x86_64 #1 SMP Thu Dec 23
                              16:04:50 UTC 2010 x86_64 x86_64
Alert Count                   8
First Seen                    Thu 30 Dec 2010 12:01:42 PM PST
Last Seen                     Thu 30 Dec 2010 02:03:10 PM PST
Local ID                      8a2fd4bd-b9cc-4f7f-a9f9-a8ab37818c8c

Raw Audit Messages
type=AVC msg=audit(1293746590.419:34644): avc:  denied  { unlink } for  pid=1426 comm="NetworkManager" name="hosts" dev=dm-0 ino=917899 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=unconfined_u:object_r:etc_t:s0 tclass=file

NetworkManager,NetworkManager_t,etc_t,file,unlink
type=SYSCALL msg=audit(1293746590.419:34644): arch=x86_64 syscall=rename success=no exit=EACCES a0=fc55f0 a1=48b319 a2=1033670 a3=1 items=0 ppid=1 pid=1426 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=NetworkManager exe=/usr/sbin/NetworkManager subj=system_u:system_r:NetworkManager_t:s0 key=(null)
NetworkManager,NetworkManager_t,etc_t,file,unlink

#============= NetworkManager_t ==============
allow NetworkManager_t etc_t:file unlink;

Comment 1 Miroslav Grepl 2011-01-03 14:13:05 UTC
The alert told you what to do.

*****  Plugin restorecon (94.8 confidence) suggests  *************************

If you want to fix the label. 
/etc/hosts default label should be net_conf_t.
Then you can run restorecon.
Do

# /sbin/restorecon -v /etc/hosts


If you have an idea how it got the bad label or if this happens again, please reopen bug.

Comment 2 alien_life_form 2011-01-10 08:24:53 UTC
Same problem here, after a clean upgrade FC13->FC14.Diagnostic did not appear before.

Comment 3 Daniel Walsh 2011-01-10 15:59:13 UTC
As long as restorecon works and it does not happen again, there is not much we can do at this point.


Note You need to log in before you can comment on or make changes to this bug.