Bug 706572 - SELinux is preventing /usr/sbin/NetworkManager from 'read' accesses on the directory /etc/NetworkManager/VPN.
Summary: SELinux is preventing /usr/sbin/NetworkManager from 'read' accesses on the di...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 14
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:abca634568d...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-05-21 06:17 UTC by Don Bower
Modified: 2011-05-23 07:13 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-05-23 07:13:13 UTC
Type: ---


Attachments (Terms of Use)

Description Don Bower 2011-05-21 06:17:32 UTC
SELinux is preventing /usr/sbin/NetworkManager from 'read' accesses on the directory /etc/NetworkManager/VPN.

*****  Plugin restorecon (94.8 confidence) suggests  *************************

If you want to fix the label. 
/etc/NetworkManager/VPN default label should be NetworkManager_var_lib_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /etc/NetworkManager/VPN

*****  Plugin catchall_labels (5.21 confidence) suggests  ********************

If you want to allow NetworkManager to have read access on the VPN directory
Then you need to change the label on /etc/NetworkManager/VPN
Do
# semanage fcontext -a -t FILE_TYPE '/etc/NetworkManager/VPN'
where FILE_TYPE is one of the following: postfix_virtual_t, dovecot_deliver_t, ifconfig_t, sandbox_min_t, sandbox_net_t, sandbox_web_t, user_seunshare_t, xguest_java_t, xguest_mono_t, logwatch_mail_t, cupsd_lpd_t, postfix_map_t, qmail_clean_t, qmail_local_t, qmail_smtpd_t, qmail_start_t, sandbox_xserver_t, automount_t, telepathy_sofiasip_t, fetchmail_t, netlogond_t, puppetmaster_t, amanda_t, amavis_t, device_t, devpts_t, system_mail_t, locale_t, locate_t, logadm_t, mcelog_t, nagios_t, varnishd_t, httpd_squid_script_t, setkey_t, sysadm_t, tvtime_t, tzdata_t, vmware_t, restorecond_t, webadm_t, afs_t, xdm_dbusd_t, aiccu_t, aide_t, alsa_t, gpg_helper_t, amtu_t, apm_t, avahi_t, boinc_t, canna_t, staff_ssh_agent_t, ccs_t, cdcc_t, crack_t, cvs_t, cyrus_t, dccm_t, portreserve_t, dhcpc_t, dmesg_t, etc_t, exim_t, games_t, getty_t, gpg_t, gpm_t, ipsec_t, irc_t, irssi_t, java_t, cpufreqselector_t, readahead_t, mrtg_t, ndc_t, named_cache_t, nrpe_t, pads_t, pam_t, ping_t, postfix_postdrop_t, postfix_postqueue_t, proc_t, qemu_t, quota_t, rdisc_t, ricci_t, rsync_t, rwho_t, spamc_t, src_t, sysfs_t, vpnc_t, xdm_t, xfs_t, xm_t, zebra_t, staff_screen_t, system_dbusd_t, setroubleshoot_fixit_t, entropyd_t, staff_dbusd_t, xenstored_t, device_t, sandbox_min_client_t, postfix_pipe_t, httpd_nagios_script_t, afs_fsserver_t, cpuspeed_t, NetworkManager_tmp_t, nagios_admin_plugin_t, guest_dbusd_t, etc_t, qmail_splogger_t, prelink_cron_system_t, xguest_dbusd_t, cups_pdf_t, freshclam_t, postgresql_t, sysadm_ssh_agent_t, cachefiles_kernel_t, courier_pcp_t, courier_pop_t, httpd_dirsrvadmin_script_t, git_system_t, httpd_suexec_t, matahari_hostd_t, publicfile_t, abrt_helper_t, usbmodules_t, sysctl_net_t, usernetctl_t, certwatch_t, sambagui_t, staff_seunshare_t, nx_server_ssh_t, updfstab_t, certmaster_t, certmonger_t, setfiles_t, user_mail_t, cdrecord_t, user_dbusd_t, sectoolm_t, semanage_t, firewallgui_t, checkpolicy_t, portmap_helper_t, utempter_t, setsebool_t, dhcp_etc_t, cobblerd_t, consoletype_t, telepathy_idle_t, xenconsoled_t, clamscan_t, cmirrord_t, telepathy_mission_control_t, webalizer_t, cronjob_t, crontab_t, cpucontrol_t, logrotate_mail_t, matahari_netd_t, passenger_t, arpwatch_t, cardmgr_t, gconfdefaultsm_t, cgclear_t, sftpd_anon_t, chronyd_t, apcupsd_t, matahari_serviced_t, fingerd_t, gpg_web_t, fprintd_t, udev_tbl_t, ftpdctl_t, httpd_cobbler_script_t, dcerpcd_t, httpd_php_t, dovecot_t, evtchnd_t, gpg_agent_t, telepathy_msn_t, auditctl_t, jabberd_t, kadmind_t, hddtemp_t, spamass_milter_t, iceauth_t, icecast_t, prelude_correlator_t, ncftool_t, openoffice_t, openvpn_t, postgrey_t, denyhosts_t, lockdev_t, mplayer_t, memcached_t, xguest_openoffice_t, irqbalance_t, radiusd_t, rlogind_t, roundup_t, srvsvcd_t, stunnel_t, dirsrv_snmp_t, sulogin_t, dirsrvadmin_t, svc_run_t, syslogd_t, sysstat_t, smbcontrol_t, nut_upsdrvctl_t, rpcbind_t, sandbox_t, portmap_t, yppasswdd_t, NetworkManager_log_t, ptchown_t, var_lib_t, var_run_t, vbetool_t, vdagent_t, vhostmd_t, winbind_t, sysadm_sudo_t, telnetd_t, usbmuxd_t, netlabel_mgmt_t, afs_ptserver_t, oddjob_mkhomedir_t, namespace_init_t, cyphesis_t, gnomesystemmm_t, httpd_mediawiki_script_t, kerneloops_t, varnishlog_t, configfile, httpd_w3c_validator_script_t, piranha_web_t, user_screen_t, greylist_milter_t, user_openoffice_t, httpd_user_script_t, calamaris_t, staff_openoffice_t, accountsd_t, mailman_queue_t, cgconfig_t, dbusd_etc_t, user_home_t, user_java_t, user_mono_t, user_wine_t, var_run_t, ipsec_mgmt_t, run_init_t, sendmail_t, shutdown_t, audisp_remote_t, corosync_t, dovecot_auth_t, dlm_controld_t, gfs_controld_t, smbmount_t, asterisk_t, bitlbee_t, sepgsql_trusted_proc_t, vmware_host_t, checkpc_t, saslauthd_t, awstats_t, aisexec_t, rpm_var_cache_t, gitosis_t, debugfs_t, dnsmasq_t, krb5kdc_t, sysadm_seunshare_t, hotplug_t, gpg_pinentry_t, hwclock_t, newrole_t, zos_remote_t, dcc_client_t, mozilla_t, plymouth_t, proc_net_t, procmail_t, setrans_t, traceroute_t, pegasus_t, prelude_t, privoxy_t, staff_java_t, staff_mono_t, staff_sudo_t, staff_wine_t, var_log_t, wpa_cli_t, httpd_awstats_script_t, munin_system_plugin_t, NetworkManager_var_lib_t, NetworkManager_var_run_t, qmail_send_t, piranha_fos_t, piranha_lvs_t, sandbox_x_t, httpd_apcupsd_cgi_script_t, local_login_t, hald_dccm_t, mysqld_safe_t, ricci_modservice_t, games_srv_t, ricci_modstorage_t, samba_net_t, afs_bosserver_t, httpd_nutups_cgi_script_t, hald_sonypic_t, boinc_project_t, nagios_mail_plugin_t, rpm_var_lib_t, amanda_recover_t, net_conf_t, chrome_sandbox_t, httpd_munin_script_t, telepathy_salut_t, inotifyfs_t, sysadm_passwd_t, sysadm_screen_t, nsplugin_t, bluetooth_helper_t, dcc_dbclean_t, nut_upsd_t, staff_execmem_t, user_execmem_t, podsleuth_t, qmail_remote_t, sysctl_kernel_t, policykit_t, home_cert_t, home_root_t, httpd_sys_script_t, staff_consolehelper_t, svc_multilog_t, ricci_modclusterd_t, logwatch_t, cert_type, git_session_t, mailman_cgi_t, pulseaudio_t, mailman_mail_t, mysqlmanagerd_t, bluetooth_t, mencoder_t, plymouthd_t, smokeping_t, ksmtuned_t, httpd_prewikka_script_t, ricci_modlog_t, ricci_modrpm_t, setroubleshootd_t, nsplugin_config_t, netutils_t, qmail_tcp_env_t, nagios_checkdisk_plugin_t, postfix_master_t, postfix_pickup_t, regex_milter_t, sandbox_x_client_t, dkim_milter_t, admin_crontab_t, hald_acl_t, consolekit_t, pam_console_t, telepathy_sunshine_t, policykit_grant_t, logrotate_t, postfix_local_t, postfix_smtpd_t, update_modules_t, ssh_keysign_t, httpd_git_script_t, nagios_services_plugin_t, qmail_rspawn_t, uml_switch_t, qmail_inject_t, qmail_lspawn_t, courier_tcpd_t, gnomeclock_t, httpd_cvs_script_t, sandbox_net_client_t, NetworkManager_t, munin_mail_plugin_t, qmail_queue_t, sandbox_web_client_t, groupadd_t, loadkeys_t, audisp_t, auditd_t, chkpwd_t, comsat_t, dbskkd_t, dccifd_t, dirsrv_t, fenced_t, gconfd_t, groupd_t, iscsid_t, kismet_t, kpropd_t, ktalkd_t, lsassd_t, lwregd_t, mysqld_t, oddjob_t, openct_t, svc_start_t, fail2ban_t, passwd_t, qdiskd_t, smoltclient_t, racoon_t, soundd_t, telepathy_stream_engine_t, updpwd_t, prelude_lml_t, xguest_t, dmidecode_t, xm_ssh_t, ypbind_t, ypserv_t, zabbix_t, sysctl_crypto_t, abrt_t, acct_t, bin_t, brctl_t, cgred_t, chfn_t, ciped_t, clamd_t, modemmanager_t, clogd_t, cupsd_t, dccd_t, dhcpd_t, dictd_t, ftpd_t, gpsd_t, gssd_t, guest_t, hald_t, howl_t, hplip_t, httpd_t, innd_t, kdump_t, klogd_t, lircd_t, lpd_t, lpr_t, lwiod_t, lwsmd_t, mount_t, mpd_t, munin_t, named_t, nfsd_t, nmbd_t, nscd_t, nslcd_t, ntop_t, ntpd_t, pcscd_t, pingd_t, pppd_t, pptp_t, psad_t, httpd_rotatelogs_t, ptal_t, afs_kaserver_t, qpidd_t, radvd_t, rhgb_t, rpcd_t, rshd_t, rssh_t, munin_disk_plugin_t, sftpd_t, slapd_t, smbd_t, snmpd_t, snort_t, spamd_t, squid_t, ssh_t, sshd_t, sssd_t, staff_t, svirt_t, swat_t, tcpd_t, kdumpgui_t, tftpd_t, tgtd_t, tmp_t, tor_t, httpd_bugzilla_script_t, tuned_t, ulogd_t, uml_t, user_t, postfix_bounce_t, usr_t, uucpd_t, uux_t, selinux_config_t, xauth_t, ypxfr_t, httpd_smokeping_cgi_script_t, nx_server_t, eventlogd_t, policykit_auth_t, ssh_keygen_t, nagios_system_plugin_t, postfix_qmgr_t, postfix_smtp_t, prelude_audisp_t, abrt_t, piranha_pulse_t, courier_authdaemon_t, sysadm_su_t, afs_vlserver_t, hald_mac_t, iptables_t, fsdaemon_t, git_shell_t, lib_t, cachefilesd_t, courier_sqwebmail_t, postfix_cleanup_t, munin_services_plugin_t, postfix_showq_t, jabberd_router_t, root_t, policykit_resolve_t, hostname_t, winbind_helper_t, shorewall_t, showmount_t, user_home_dir_t, telepathy_gabble_t, load_policy_t, nut_upsmon_t, cupsd_config_t, usr_t, hald_keymap_t, httpd_helper_t, rtkit_daemon_t, nscd_var_run_t, root_t. 
Then execute: 
restorecon -v '/etc/NetworkManager/VPN'


*****  Plugin catchall (1.44 confidence) suggests  ***************************

If you believe that NetworkManager should be allowed read access on the VPN directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep NetworkManager /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:NetworkManager_t:s0
Target Context                system_u:object_r:unlabeled_t:s0
Target Objects                /etc/NetworkManager/VPN [ dir ]
Source                        NetworkManager
Source Path                   /usr/sbin/NetworkManager
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           NetworkManager-0.8.4-1.fc14
Target RPM Packages           NetworkManager-0.8.4-1.fc14
Policy RPM                    selinux-policy-3.9.7-40.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.35.13-91.fc14.x86_64 #1 SMP Tue May 3 13:23:06
                              UTC 2011 x86_64 x86_64
Alert Count                   188
First Seen                    Fri 20 May 2011 11:00:19 PM PDT
Last Seen                     Fri 20 May 2011 11:16:39 PM PDT
Local ID                      e4a7e62b-21f0-4397-b642-2d31951cd7d3

Raw Audit Messages
type=AVC msg=audit(1305958599.3:27524): avc:  denied  { read } for  pid=1250 comm="NetworkManager" name="VPN" dev=dm-1 ino=39173 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir


type=SYSCALL msg=audit(1305958599.3:27524): arch=x86_64 syscall=inotify_add_watch success=no exit=EACCES a0=b a1=17f88f0 a2=1002fce a3=1 items=0 ppid=1 pid=1250 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=NetworkManager exe=/usr/sbin/NetworkManager subj=system_u:system_r:NetworkManager_t:s0 key=(null)

Hash: NetworkManager,NetworkManager_t,unlabeled_t,dir,read

audit2allow

#============= NetworkManager_t ==============
allow NetworkManager_t unlabeled_t:dir read;

audit2allow -R

#============= NetworkManager_t ==============
allow NetworkManager_t unlabeled_t:dir read;

Comment 1 Miroslav Grepl 2011-05-23 07:13:13 UTC
It looks like you were trying to setup a label which SELinux does not know. 

Please just run

# restorecon -R -v /etc/NetworkManager/VPN


Note You need to log in before you can comment on or make changes to this bug.