Bug 815106 - SELinux is preventing /usr/bin/evince-thumbnailer from using the 'dac_override' capabilities.
Summary: SELinux is preventing /usr/bin/evince-thumbnailer from using the 'dac_overrid...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 23
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:05443624bfca785cc15b3ab2659...
: 894564 1046673 1295226 1295227 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-04-22 14:57 UTC by peter.senna
Modified: 2016-09-19 13:42 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-04-23 15:49:05 UTC
Type: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description peter.senna 2012-04-22 14:57:02 UTC 
libreport version: 2.0.10
executable:     /usr/bin/python2.7
hashmarkername: setroubleshoot
kernel:         3.3.2-8.fc17.x86_64
time:           Sun 22 Apr 2012 11:55:05 AM BRT

description:
:SELinux is preventing /usr/bin/evince-thumbnailer from using the 'dac_override' capabilities.
:
:*****  Plugin dac_override (91.4 confidence) suggests  ***********************
:
:If you want to help identify if domain needs this access or you have a file with the wrong permissions on your system
:Then turn on full auditing to get path information about the offending file and generate the error again.
:Do
:
:Turn on full auditing
:# auditctl -w /etc/shadow -p w
:Try to recreate AVC. Then execute
:# ausearch -m avc -ts recent
:If you see PATH record check ownership/permissions on file, and fix it, 
:otherwise report as a bugzilla.
:
:*****  Plugin catchall (9.59 confidence) suggests  ***************************
:
:If you believe that evince-thumbnailer should have the dac_override capability by default.
:Then you should report this as a bug.
:You can generate a local policy module to allow this access.
:Do
:allow this access for now by executing:
:# grep evince-thumbnai /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context                unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023
:Target Context                unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023
:Target Objects                 [ capability ]
:Source                        evince-thumbnai
:Source Path                   /usr/bin/evince-thumbnailer
:Port                          <Unknown>
:Host                          (removed)
:Source RPM Packages           evince-3.4.0-1.fc17.x86_64
:Target RPM Packages           
:Policy RPM                    selinux-policy-3.10.0-116.fc17.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed) 3.3.2-8.fc17.x86_64 #1 SMP
:                              Sat Apr 21 12:44:25 UTC 2012 x86_64 x86_64
:Alert Count                   102
:First Seen                    Sun 22 Apr 2012 11:02:07 AM BRT
:Last Seen                     Sun 22 Apr 2012 11:54:40 AM BRT
:Local ID                      e915aff1-54e6-4dd2-b612-8ff0c21a35d6
:
:Raw Audit Messages
:type=AVC msg=audit(1335106480.270:520): avc:  denied  { dac_override } for  pid=24755 comm="evince-thumbnai" capability=1  scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=capability
:
:
:type=AVC msg=audit(1335106480.270:520): avc:  denied  { dac_read_search } for  pid=24755 comm="evince-thumbnai" capability=2  scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=capability
:
:
:type=SYSCALL msg=audit(1335106480.270:520): arch=x86_64 syscall=open success=no exit=EACCES a0=1644670 a1=0 a2=0 a3=aaaaaaaaaaaaaaab items=0 ppid=24718 pid=24755 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm=evince-thumbnai exe=/usr/bin/evince-thumbnailer subj=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 key=(null)
:
:Hash: evince-thumbnai,thumb_t,thumb_t,capability,dac_override
:
:audit2allowunable to open /sys/fs/selinux/policy:  Permission denied
:
:
:audit2allow -Runable to open /sys/fs/selinux/policy:  Permission denied
:
:
Comment 1 Miroslav Grepl 2012-04-22 19:21:54 UTC 
Could you do the following

Turn on full auditing
# auditctl -w /etc/shadow -p w

Try to recreate AVC. Then execute
# ausearch -m avc -ts recent
Comment 2 peter.senna 2012-04-22 22:46:40 UTC 
[root@notepeter ~]# ausearch -m avc -ts recent
----
time->Sun Apr 22 19:45:34 2012
type=PATH msg=audit(1335134734.763:329): item=0 name=2F72756E2F6D656469612F70657465722F50657465722D657874342F6E6F746570657465722D4665646F726131352F686F6D652F70657465722F446F63756D656E74732F5543422F322D323031312F456E67536F664949495F4E44415F32303131325F43616E6469646F5F204E6F7461735F205665722E706466
type=CWD msg=audit(1335134734.763:329):  cwd="/root"
type=SYSCALL msg=audit(1335134734.763:329): arch=c000003e syscall=4 success=no exit=-13 a0=c74570 a1=7fff873cc570 a2=7fff873cc570 a3=70 items=1 ppid=2716 pid=2804 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="evince-thumbnai" exe="/usr/bin/evince-thumbnailer" subj=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1335134734.763:329): avc:  denied  { dac_read_search } for  pid=2804 comm="evince-thumbnai" capability=2  scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=capability
type=AVC msg=audit(1335134734.763:329): avc:  denied  { dac_override } for  pid=2804 comm="evince-thumbnai" capability=1  scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=capability
----
time->Sun Apr 22 19:45:34 2012
type=PATH msg=audit(1335134734.748:328): item=0 name=2F72756E2F6D656469612F70657465722F50657465722D657874342F6E6F746570657465722D4665646F726131352F686F6D652F70657465722F446F63756D656E74732F5543422F322D323031312F456E67536F664949495F4E44415F32303131325F43616E6469646F5F204E6F7461735F205665722E706466
type=CWD msg=audit(1335134734.748:328):  cwd="/root"
type=SYSCALL msg=audit(1335134734.748:328): arch=c000003e syscall=6 success=no exit=-13 a0=c46070 a1=7fff873cc530 a2=7fff873cc530 a3=c369cc items=1 ppid=2716 pid=2804 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="evince-thumbnai" exe="/usr/bin/evince-thumbnailer" subj=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1335134734.748:328): avc:  denied  { dac_read_search } for  pid=2804 comm="evince-thumbnai" capability=2  scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=capability
type=AVC msg=audit(1335134734.748:328): avc:  denied  { dac_override } for  pid=2804 comm="evince-thumbnai" capability=1  scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=capability
----
time->Sun Apr 22 19:45:34 2012
type=PATH msg=audit(1335134734.763:330): item=0 name=2F72756E2F6D656469612F70657465722F50657465722D657874342F6E6F746570657465722D4665646F726131352F686F6D652F70657465722F446F63756D656E74732F5543422F322D323031312F456E67536F664949495F4E44415F32303131325F43616E6469646F5F204E6F7461735F205665722E706466
type=CWD msg=audit(1335134734.763:330):  cwd="/root"
type=SYSCALL msg=audit(1335134734.763:330): arch=c000003e syscall=2 success=no exit=-13 a0=c74570 a1=0 a2=1b6 a3=238 items=1 ppid=2716 pid=2804 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="evince-thumbnai" exe="/usr/bin/evince-thumbnailer" subj=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1335134734.763:330): avc:  denied  { dac_read_search } for  pid=2804 comm="evince-thumbnai" capability=2  scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=capability
type=AVC msg=audit(1335134734.763:330): avc:  denied  { dac_override } for  pid=2804 comm="evince-thumbnai" capability=1  scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=capability
----
time->Sun Apr 22 19:45:34 2012
type=PATH msg=audit(1335134734.763:331): item=0 name=2F72756E2F6D656469612F70657465722F50657465722D657874342F6E6F746570657465722D4665646F726131352F686F6D652F70657465722F446F63756D656E74732F5543422F322D323031312F456E67536F664949495F4E44415F32303131325F43616E6469646F5F204E6F7461735F205665722E706466
type=CWD msg=audit(1335134734.763:331):  cwd="/root"
type=SYSCALL msg=audit(1335134734.763:331): arch=c000003e syscall=2 success=no exit=-13 a0=c74570 a1=0 a2=0 a3=aaaaaaaaaaaaaaab items=1 ppid=2716 pid=2804 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="evince-thumbnai" exe="/usr/bin/evince-thumbnailer" subj=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1335134734.763:331): avc:  denied  { dac_read_search } for  pid=2804 comm="evince-thumbnai" capability=2  scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=capability
type=AVC msg=audit(1335134734.763:331): avc:  denied  { dac_override } for  pid=2804 comm="evince-thumbnai" capability=1  scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=capability
Comment 3 Daniel Walsh 2012-04-23 14:24:16 UTC 
Are you logged in with X as root?  This is unsupported by SELinux.
Comment 4 peter.senna 2012-04-23 14:57:27 UTC 
No, logged as regular user. But I call Nautilus from a terminal as root.
Comment 5 Daniel Walsh 2012-04-23 15:49:05 UTC 
Well that would cause the problem.  Not sure we should dontaudit these or not.  Since this is not a common thing.
Comment 6 Miroslav Grepl 2013-01-14 09:44:33 UTC 
*** Bug 894564 has been marked as a duplicate of this bug. ***
Comment 7 Miroslav Grepl 2013-01-14 09:46:09 UTC 
I believe we want to see these avc msgs.
Comment 8 Daniel Walsh 2014-01-03 20:13:43 UTC 
*** Bug 1046673 has been marked as a duplicate of this bug. ***
Comment 9 Daniel Walsh 2016-01-04 13:24:07 UTC 
*** Bug 1295226 has been marked as a duplicate of this bug. ***
Comment 10 Daniel Walsh 2016-01-04 13:24:16 UTC 
*** Bug 1295227 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.