Bug 769810 - SELinux is preventing /usr/libexec/kde4/lnusertemp from create access
Summary: SELinux is preventing /usr/libexec/kde4/lnusertemp from create access
Keywords:
Status: CLOSED INSUFFICIENT_DATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 16
Hardware: i686
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Ben Levenson
URL:
Whiteboard:
: 772325 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-12-22 11:04 UTC by Mike C
Modified: 2012-09-18 13:43 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2012-09-18 13:43:03 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Mike C 2011-12-22 11:04:04 UTC
Description of problem:
Having previously used kde and currently using xfce as soon as login to xfce get an selinux avc

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.10.0-67.fc16.noarch

How reproducible:
Every time

Steps to Reproduce:
1. Login to xfce
2.
3.
  
Actual results:
selinux troubleshooter opens and contains the following details:
SELinux is preventing /usr/libexec/kde4/lnusertemp from create access on the directory .kde.

*****  Plugin catchall_boolean (89.3 confidence) suggests  *******************

If you want to enable polyinstantiated directory support.
Then you must tell SELinux about this by enabling the 'allow_polyinstantiation' boolean.
Do
setsebool -P allow_polyinstantiation 1

*****  Plugin catchall (11.6 confidence) suggests  ***************************

If you believe that lnusertemp should be allowed create access on the .kde directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep lnusertemp /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context                system_u:object_r:admin_home_t:s0
Target Objects                .kde [ dir ]
Source                        lnusertemp
Source Path                   /usr/libexec/kde4/lnusertemp
Port                          <Unknown>
Host                          samsung2
Source RPM Packages           kdelibs-4.7.3-5.fc16
Target RPM Packages           
Policy RPM                    selinux-policy-3.10.0-67.fc16
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     samsung2
Platform                      Linux samsung2 3.1.5-6.fc16.i686.PAE #1 SMP Thu
                              Dec 15 16:19:31 UTC 2011 i686 i686
Alert Count                   4
First Seen                    Mon 19 Dec 2011 07:58:50 PM GMT
Last Seen                     Thu 22 Dec 2011 10:49:03 AM GMT
Local ID                      57d7af8a-2535-4193-a8ae-fb7fb2445495

Raw Audit Messages
type=AVC msg=audit(1324550943.870:75): avc:  denied  { create } for  pid=1715 comm="lnusertemp" name=".kde" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir


type=SYSCALL msg=audit(1324550943.870:75): arch=i386 syscall=mkdir success=no exit=EACCES a0=bfec3779 a1=1c0 a2=bfec3779 a3=bfec3718 items=0 ppid=1709 pid=1715 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=lnusertemp exe=/usr/libexec/kde4/lnusertemp subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)

Hash: lnusertemp,xdm_t,admin_home_t,dir,create

audit2allow

#============= xdm_t ==============
#!!!! This avc can be allowed using the boolean 'allow_polyinstantiation'

allow xdm_t admin_home_t:dir create;

audit2allow -R

#============= xdm_t ==============
#!!!! This avc can be allowed using the boolean 'allow_polyinstantiation'

allow xdm_t admin_home_t:dir create;


Expected results:
No selinux troubleshoot popping into the notification area at login

Additional info:

f16 fully up to date. 3.1.5-6.fc16.i686.PAE

Comment 1 Mike C 2011-12-22 11:25:14 UTC
I decided to log in to kde to see if it was a problem there - no avc.

When I logged back in to xfce there was no further selinux troubleshooter appearance either!  So I now don't know what the interactions are here that led to the problem in the first place?

Comment 2 Daniel Walsh 2011-12-22 15:12:39 UTC
restorecon -R -v /root

Should fix this for good.

Comment 3 Mike C 2011-12-22 16:02:06 UTC
Thanks Dan - I just want to check that it is indeed the /root dir in the command, and not / or ~/ before executing it.

Comment 4 Carl G. 2012-01-16 22:11:18 UTC
*** Bug 772325 has been marked as a duplicate of this bug. ***

Comment 5 Artur Szymczak 2012-09-18 09:07:50 UTC
restorecon doesn't help. AVC still occur.

$ sudo find / -context system_u:object_r:admin_home_t:s0
/root
/root/.bashrc
/root/.bash_logout
/root/.bash_profile

I didn't login as root. I log as ordinary user:
$ id 
uid=1001(justynka) gid=1001(justynka) grupy=1001(justynka),10(wheel),1002(vboxusers) kontekst=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Comment 6 Daniel Walsh 2012-09-18 12:39:30 UTC
The first avc talks about /root/.kde  Is this the same thing you are seeing.

Comment 7 Artur Szymczak 2012-09-18 13:04:39 UTC
I'm sorry, but after restorecon on all FS and reboot all is working fine. No more AVC's.


Note You need to log in before you can comment on or make changes to this bug.