Hide Forgot
SELinux is preventing /usr/sbin/cupsd from 'write' accesses on the fichier /etc/cups/ppd/Babayaga.ppd. ***** Plugin restorecon (99.5 confidence) suggests ************************* If you want to fix the label. /etc/cups/ppd/Babayaga.ppd default label should be cupsd_rw_etc_t. Then you can run restorecon. Do # /sbin/restorecon -v /etc/cups/ppd/Babayaga.ppd ***** Plugin catchall (1.49 confidence) suggests *************************** If you believe that cupsd should be allowed write access on the Babayaga.ppd file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep cupsd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:cupsd_t:s0-s0:c0.c1023 Target Context system_u:object_r:tmp_t:s0 Target Objects /etc/cups/ppd/Babayaga.ppd [ file ] Source cupsd Source Path /usr/sbin/cupsd Port <Inconnu> Host (removed) Source RPM Packages cups-1.4.6-15.fc16 Target RPM Packages Policy RPM selinux-policy-3.9.16-23.fc15 Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 2.6.39-0.rc6.git0.0.fc16.x86_64 #1 SMP Wed May 4 16:02:13 UTC 2011 x86_64 x86_64 Alert Count 2 First Seen mar. 10 mai 2011 17:38:26 CEST Last Seen mar. 10 mai 2011 17:39:18 CEST Local ID 358f2da2-deab-414c-989a-3d2e443490be Raw Audit Messages type=AVC msg=audit(1305041958.945:24211): avc: denied { write } for pid=1702 comm="cupsd" name="Babayaga.ppd" dev=dm-1 ino=420 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=SYSCALL msg=audit(1305041958.945:24211): arch=x86_64 syscall=open success=yes exit=ESPIPE a0=7fff5b3a91b6 a1=1 a2=1b6 a3=0 items=0 ppid=1 pid=1702 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cupsd exe=/usr/sbin/cupsd subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null) Hash: cupsd,cupsd_t,tmp_t,file,write audit2allow #============= cupsd_t ============== allow cupsd_t tmp_t:file write; audit2allow -R #============= cupsd_t ============== allow cupsd_t tmp_t:file write;
***** Plugin restorecon (99.5 confidence) suggests ************************* If you want to fix the label. /etc/cups/ppd/Babayaga.ppd default label should be cupsd_rw_etc_t. Then you can run restorecon. Do # /sbin/restorecon -v /etc/cups/ppd/Babayaga.ppd Please run this command which will fix a label. You moved the file to /etc/cups/ppd which caused this issue.
(In reply to comment #1) > Please run this command which will fix a label. You moved the file to > /etc/cups/ppd which caused this issue. Not really, it seems any time you try to modify a printer cups creates a new misklabelled file (this file has been there for ages and relabeled multiple times)
Nicolas what process is creating "Babayaga.ppd"? Since it is being created with a label of tmp_t, I assume it is created by a domain that is not allowed to create tmp_t, in permissive mode or an unconfined domain that does not have a transition rule for tmp. unconfined_t creating a file in a directory labeled tmp_t would create user_tmp_t.
After the file is created in a tmp dir it is being moved to /etc/cups/ppd
It's created by the cups admin console when you modify the settings of a printer with the same name
(don't know where printer settings are hidden in gnome 3, and anyway the cups admin app has always been necessary when the gnomy stuff failed for one reason or another; it's more complete)
Nicolas: what is the package name for the "cups admin console" you referred to in comment #5? There are several applications which configure CUPS: * the CUPS web interface, at http://localhost:631/admin (provided by 'cups') * the GNOME 3 printing panel, account -> System Settings -> Printers (provided by 'control-center') * system-config-printer
It's http://localhost:631/ I'll try to check the gnome3 stuff IIRC it used to be broken too by selinux, but the breakage tends to change from month to month