Bug 800785 - avc: denied { write } for pid=19624 comm="passwd"
Summary: avc: denied { write } for pid=19624 comm="passwd"
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.3
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-03-07 09:02 UTC by Michal Nowak
Modified: 2013-03-08 02:13 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-03-07 12:11:55 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Michal Nowak 2012-03-07 09:02:01 UTC
Description of problem:

Just found it in log http://beaker-archive.app.eng.bos.redhat.com/beaker-logs/2012/03/2009/200943/426298/4779846/26331681/test_log-Setup-avc.log when running

useradd abrt-suid-test -M
echo "kokotice" | passwd abrt-suid-test --stdin

type=AVC msg=audit(1331109716.691:214428): avc:  denied  { write } for  pid=19624 comm="passwd" path="/tmp/abrt-testsuite/test/bz783450-setuid-core-owned-by-root/full.log" dev=dm-0 ino=2229049 scontext=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file

type=AVC msg=audit(1331109716.691:214428): avc:  denied  { write } for  pid=19624 comm="passwd" path="/tmp/abrt-testsuite/test/bz783450-setuid-core-owned-by-root/full.log" dev=dm-0 ino=2229049 scontext=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file

Version-Release number of selected component (if applicable):

selinux-policy-3.7.19-138.el6.noarch

Comment 2 Miroslav Grepl 2012-03-07 11:02:53 UTC
This is a test issue with beaker/passwd which is caused by 

$RUNNER_SCRIPT $test &> $logfile

You will need to change a label for full.log to make this workig as you need.


$ sesearch -A -s passwd_t -c file -p write

Comment 3 Milos Malik 2012-03-07 11:31:17 UTC
Please run "restorecon -Rv /etc" on that machine.

rlFileRestore() is the culprit.


Note You need to log in before you can comment on or make changes to this bug.