Bug 703355 - SELinux is preventing /usr/sbin/semodule from 'write' accesses on the file /root/.xsession-errors.
Summary: SELinux is preventing /usr/sbin/semodule from 'write' accesses on the file /r...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 14
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:94a0810a99b...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-05-10 05:55 UTC by Arivumani Durairaj
Modified: 2011-05-10 06:34 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-05-10 06:34:09 UTC
Type: ---


Attachments (Terms of Use)

Description Arivumani Durairaj 2011-05-10 05:55:19 UTC
SELinux is preventing /usr/sbin/semodule from 'write' accesses on the file /root/.xsession-errors.

*****  Plugin leaks (50.5 confidence) suggests  ******************************

If you want to ignore semodule trying to write access the .xsession-errors file, because you believe it should not need this access.
Then you should report this as a bug.  
You can generate a local policy module to dontaudit this access.
Do
# grep /usr/sbin/semodule /var/log/audit/audit.log | audit2allow -D -M mypol
# semodule -i mypol.pp

*****  Plugin catchall (50.5 confidence) suggests  ***************************

If you believe that semodule should be allowed write access on the .xsession-errors file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep semodule /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c102
                              3
Target Context                unconfined_u:object_r:admin_home_t:s0
Target Objects                /root/.xsession-errors [ file ]
Source                        semodule
Source Path                   /usr/sbin/semodule
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           policycoreutils-2.0.85-28.fc14
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.7-40.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.35.13-91.fc14.x86_64 #1 SMP
                              Tue May 3 13:23:06 UTC 2011 x86_64 x86_64
Alert Count                   2
First Seen                    Tue 10 May 2011 11:20:42 AM IST
Last Seen                     Tue 10 May 2011 11:20:44 AM IST
Local ID                      e99e5db6-66ed-45df-aea8-d1ba1da586aa

Raw Audit Messages
type=AVC msg=audit(1305006644.112:26639): avc:  denied  { write } for  pid=2577 comm="semodule" path="/root/.xsession-errors" dev=dm-0 ino=72775 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file


type=SYSCALL msg=audit(1305006644.112:26639): arch=x86_64 syscall=execve success=yes exit=0 a0=11c8f70 a1=11c9250 a2=11c7f00 a3=1 items=0 ppid=2568 pid=2577 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm=semodule exe=/usr/sbin/semodule subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)

Hash: semodule,semanage_t,admin_home_t,file,write

audit2allow

#============= semanage_t ==============
allow semanage_t admin_home_t:file write;

audit2allow -R

#============= semanage_t ==============
allow semanage_t admin_home_t:file write;

Comment 1 Miroslav Grepl 2011-05-10 06:34:09 UTC
Are you logging in as root via X?  

This is not allowed by SELinux.


Note You need to log in before you can comment on or make changes to this bug.