Bug 825718 - SELinux is preventing /usr/bin/ls from getattr access on the blk_file /dev/sdb
SELinux is preventing /usr/bin/ls from getattr access on the blk_file /dev/sdb
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
17
x86_64 Linux
unspecified Severity high
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-05-28 05:32 EDT by Antonio Trande
Modified: 2012-06-03 19:32 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-06-03 19:32:15 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Alert logs (4.56 KB, text/plain)
2012-05-28 05:32 EDT, Antonio Trande
no flags Details
/var/log/messages (2.59 MB, text/plain)
2012-05-28 05:36 EDT, Antonio Trande
no flags Details
Alert-sysctl from write access on the file nmi_watchdog (2.24 KB, application/octet-stream)
2012-06-01 13:01 EDT, Antonio Trande
no flags Details

  None (edit)
Description Antonio Trande 2012-05-28 05:32:24 EDT
Created attachment 587186 [details]
Alert logs

Description of problem:

These alerts pop up at every boot.
Maybe are connected to Bug769747.


Version-Release number of selected component (if applicable):

selinux-policy-targeted-3.10.0-121.fc17.noarch
selinux-policy-3.10.0-121.fc17.noarch

How reproducible:

By boot up Fedora.
Comment 1 Antonio Trande 2012-05-28 05:36:38 EDT
Created attachment 587187 [details]
/var/log/messages
Comment 2 Miroslav Grepl 2012-05-28 12:05:24 EDT
Please could you test it with the latest policy which is available from koji

http://koji.fedoraproject.org/koji/buildinfo?buildID=320274

Thank you.
Comment 3 Antonio Trande 2012-05-28 13:28:18 EDT
(In reply to comment #2)
> Please could you test it with the latest policy which is available from koji
> 
> http://koji.fedoraproject.org/koji/buildinfo?buildID=320274
> 
> Thank you.

In https://bugzilla.redhat.com/attachment.cgi?id=587186, there are two SELinux alerts. After selinux-policy update, is signaled only the second one.
Comment 4 Miroslav Grepl 2012-05-29 01:58:28 EDT
Thank you for testing.

Fixed in selinux-policy-3.10.0-128.fc17
Comment 5 Fedora Update System 2012-05-31 02:27:52 EDT
selinux-policy-3.10.0-128.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-128.fc17
Comment 6 Antonio Trande 2012-05-31 13:14:21 EDT
(In reply to comment #5)
> selinux-policy-3.10.0-128.fc17 has been submitted as an update for Fedora 17.
> https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-128.fc17

selinux-policy updated
The alert "SELinux is preventing /usr/sbin/sysctl from write access on the file nmi_watchdog" appears again. See https://bugzilla.redhat.com/attachment.cgi?id=587186
Comment 7 Daniel Walsh 2012-05-31 13:20:07 EDT
Please add the new AVC's the bug you link to is fixed.
Comment 8 Daniel Walsh 2012-05-31 13:27:24 EDT
 selinux-policy-3.10.0-129.fc17 will allow tuned to write to kernel_sysctls_t.
Comment 9 Antonio Trande 2012-06-01 13:01:26 EDT
Created attachment 588540 [details]
Alert-sysctl from write access on the file nmi_watchdog
Comment 10 Antonio Trande 2012-06-01 13:02:05 EDT
(In reply to comment #7)
> Please add the new AVC's the bug you link to is fixed.

See https://bugzilla.redhat.com/attachment.cgi?id=588540
Comment 11 Fedora Update System 2012-06-01 13:09:49 EDT
Package selinux-policy-3.10.0-128.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-128.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-8720/selinux-policy-3.10.0-128.fc17
then log in and leave karma (feedback).
Comment 12 Fedora Update System 2012-06-03 19:32:15 EDT
selinux-policy-3.10.0-128.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.