Bug 713916 - SELinux is preventing /usr/bin/aria2c from 'read' accesses on the chr_file random.
Summary: SELinux is preventing /usr/bin/aria2c from 'read' accesses on the chr_file ra...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 14
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:98a6ad53b28...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-06-16 18:55 UTC by Michael Wiktowy
Modified: 2011-10-07 21:30 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-10-07 21:30:51 UTC
Type: ---


Attachments (Terms of Use)

Description Michael Wiktowy 2011-06-16 18:55:33 UTC
SELinux is preventing /usr/bin/aria2c from 'read' accesses on the chr_file random.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that aria2c should be allowed read access on the random chr_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep aria2c /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:abrt_t:s0-s0:c0.c1023
Target Context                system_u:object_r:random_device_t:s0
Target Objects                random [ chr_file ]
Source                        aria2c
Source Path                   /usr/bin/aria2c
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           aria2-1.9.4-1.fc14
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.7-40.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.35.13-92.fc14.x86_64 #1 SMP Sat May 21
                              17:26:25 UTC 2011 x86_64 x86_64
Alert Count                   1
First Seen                    Thu 16 Jun 2011 03:50:54 PM ART
Last Seen                     Thu 16 Jun 2011 03:50:54 PM ART
Local ID                      d4ae2041-bbc7-4c75-adb9-cfbacba15743

Raw Audit Messages
type=AVC msg=audit(1308250254.934:34565): avc:  denied  { read } for  pid=5102 comm="aria2c" name="random" dev=devtmpfs ino=4082 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file


type=SYSCALL msg=audit(1308250254.934:34565): arch=x86_64 syscall=access success=no exit=EACCES a0=32e8066548 a1=4 a2=0 a3=0 items=0 ppid=5093 pid=5102 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=aria2c exe=/usr/bin/aria2c subj=system_u:system_r:abrt_t:s0-s0:c0.c1023 key=(null)

Hash: aria2c,abrt_t,random_device_t,chr_file,read

audit2allow

#============= abrt_t ==============
allow abrt_t random_device_t:chr_file read;

audit2allow -R

#============= abrt_t ==============
allow abrt_t random_device_t:chr_file read;

Comment 1 Michael Wiktowy 2011-06-16 19:04:07 UTC
This is very likely caused by the yum-fast-downloader plugin being installed on my system.

Apparently, the abrt policy, when attempting to download the debug rpms via yum, does not play well with aria2c used by yum-fast-downloader.

Possibly the new option to send the traceback to a debug server would alleviate this in F15 but this is not available in F14.

Comment 2 Dominick Grift 2011-06-16 20:44:59 UTC
I dont have this aria2c app installed on my system so i guess abrt does not depends on it atleast in rawhide.

Nonetheless i added this to master branch:

http://git.fedorahosted.org/git/?p=selinux-policy.git;a=commitdiff;h=9ca17b9f3c9bfa05b8057d0a73870a693cec8d82

Comment 3 Michael Wiktowy 2011-06-17 03:42:18 UTC
Thanks.

It is a url downloader like wget but can take advantage of parallel downloads and torrent files. So it opens up possibilities for yum.

Aria2c is in the regular repos but I don't think yum-fast-download is yet.

Comment 4 Daniel Walsh 2011-06-17 18:12:16 UTC
I guess the question is why does Aria2c use /dev/rand versus /dev/urand?

Comment 5 Michael Wiktowy 2011-06-18 18:58:58 UTC
I can see a low quality random source being sufficient for load-balancing mirrors but according to http://aria2.sourceforge.net/ , Aria2c does support bittorrent encryption. Do other torrent clients need high quality random sources for this support?


Note You need to log in before you can comment on or make changes to this bug.