Bug 829792 - SELinux is preventing /sbin/ldconfig from 'read' accesses on the lnk_file tmp.
SELinux is preventing /sbin/ldconfig from 'read' accesses on the lnk_file tmp.
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
16
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
abrt_hash:1a8ab36a3ac09f25493ce2df325...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-06-07 10:56 EDT by Artur Szymczak
Modified: 2012-07-25 23:54 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-07-25 23:54:17 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Artur Szymczak 2012-06-07 10:56:18 EDT
libreport version: 2.0.10
executable:     /usr/bin/python2.7
hashmarkername: setroubleshoot
kernel:         3.3.7-1.fc16.x86_64
time:           czw, 7 cze 2012, 16:58:54

description:
:SELinux is preventing /sbin/ldconfig from 'read' accesses on the lnk_file tmp.
:
:*****  Plugin catchall (100. confidence) suggests  ***************************
:
:If aby ldconfig powinno mieć domyślnie read dostęp do tmp lnk_file.
:Then proszę to zgłosić jako błąd.
:Można utworzyć lokalny moduł polityki, aby umożliwić ten dostęp.
:Do
:można tymczasowo zezwolić na ten dostęp wykonując polecenia:
:# grep ldconfig /var/log/audit/audit.log | audit2allow -M mojapolityka
:# semodule -i mojapolityka.pp
:
:Additional Information:
:Source Context                unconfined_u:system_r:ldconfig_t:s0-s0:c0.c1023
:Target Context                system_u:object_r:tmp_t:s0
:Target Objects                tmp [ lnk_file ]
:Source                        ldconfig
:Source Path                   /sbin/ldconfig
:Port                          <Nieznane>
:Host                          (removed)
:Source RPM Packages           glibc-2.14.90-24.fc16.7.x86_64
:                              glibc-2.14.90-24.fc16.7.i686
:Target RPM Packages           filesystem-2.4.44-1.fc16.x86_64
:Policy RPM                    selinux-policy-3.10.0-86.fc16.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed) 3.3.7-1.fc16.x86_64 #1 SMP
:                              Tue May 22 13:59:39 UTC 2012 x86_64 x86_64
:Alert Count                   5
:First Seen                    czw, 7 cze 2012, 16:44:39
:Last Seen                     czw, 7 cze 2012, 16:44:39
:Local ID                      960feea9-4eaa-4cd6-8cda-39ee95b38089
:
:Raw Audit Messages
:type=AVC msg=audit(1339080279.811:70): avc:  denied  { read } for  pid=10497 comm="ldconfig" name="tmp" dev="dm-1" ino=786468 scontext=unconfined_u:system_r:ldconfig_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=lnk_file
:
:
:type=SYSCALL msg=audit(1339080279.811:70): arch=x86_64 syscall=open success=no exit=EACCES a0=20d51b0 a1=20241 a2=180 a3=646c2f6374652f68 items=0 ppid=2022 pid=10497 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm=ldconfig exe=/sbin/ldconfig subj=unconfined_u:system_r:ldconfig_t:s0-s0:c0.c1023 key=(null)
:
:Hash: ldconfig,ldconfig_t,tmp_t,lnk_file,read
:
:audit2allow
:
:#============= ldconfig_t ==============
:allow ldconfig_t tmp_t:lnk_file read;
:
:audit2allow -R
:
:#============= ldconfig_t ==============
:allow ldconfig_t tmp_t:lnk_file read;
:
Comment 1 Artur Szymczak 2012-06-07 11:12:29 EDT
# find / -inum 786468
/var/tmp
# ls -Zd /var/tmp/
drwxrwxrwt. root root system_u:object_r:tmp_t:s0       /var/tmp/
Comment 2 Daniel Walsh 2012-06-07 12:19:21 EDT
So this looks like a local customization, although we should probably just allow all apps that search tmp_t to be able to read the lnk_file.

Fixed in selinux-policy-3.10.0-129.fc17
Comment 3 Artur Szymczak 2012-06-07 12:34:13 EDT
I'm using Fedora 16.
Comment 4 Artur Szymczak 2012-06-07 12:40:47 EDT
Sorry, my wrong, output of "ls -Zd /var/tmp" should be:
lrwxrwxrwt. root root system_u:object_r:tmp_t:s0       /var/tmp -> /tmp
Comment 5 Artur Szymczak 2012-06-07 12:41:56 EDT
Typos...
lrwxrwxrwx. root root system_u:object_r:tmp_t:s0       /var/tmp -> /tmp
Comment 6 Daniel Walsh 2012-06-07 14:51:30 EDT
Miroslav can you back port the fix.
Comment 7 Miroslav Grepl 2012-06-22 05:05:15 EDT
Fixed in selinux-policy-3.10.0-90.fc16
Comment 8 Fedora Update System 2012-07-02 04:48:54 EDT
selinux-policy-3.10.0-90.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-90.fc16
Comment 9 Fedora Update System 2012-07-03 11:50:39 EDT
Package selinux-policy-3.10.0-90.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-90.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-10203/selinux-policy-3.10.0-90.fc16
then log in and leave karma (feedback).
Comment 10 Fedora Update System 2012-07-25 23:54:17 EDT
selinux-policy-3.10.0-90.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.