Bug 829792 - SELinux is preventing /sbin/ldconfig from 'read' accesses on the lnk_file tmp.
Summary: SELinux is preventing /sbin/ldconfig from 'read' accesses on the lnk_file tmp.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 16
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:1a8ab36a3ac09f25493ce2df325...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-06-07 14:56 UTC by Artur Szymczak
Modified: 2012-07-26 03:54 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-07-26 03:54:17 UTC


Attachments (Terms of Use)

Description Artur Szymczak 2012-06-07 14:56:18 UTC
libreport version: 2.0.10
executable:     /usr/bin/python2.7
hashmarkername: setroubleshoot
kernel:         3.3.7-1.fc16.x86_64
time:           czw, 7 cze 2012, 16:58:54

description:
:SELinux is preventing /sbin/ldconfig from 'read' accesses on the lnk_file tmp.
:
:*****  Plugin catchall (100. confidence) suggests  ***************************
:
:If aby ldconfig powinno mieć domyślnie read dostęp do tmp lnk_file.
:Then proszę to zgłosić jako błąd.
:Można utworzyć lokalny moduł polityki, aby umożliwić ten dostęp.
:Do
:można tymczasowo zezwolić na ten dostęp wykonując polecenia:
:# grep ldconfig /var/log/audit/audit.log | audit2allow -M mojapolityka
:# semodule -i mojapolityka.pp
:
:Additional Information:
:Source Context                unconfined_u:system_r:ldconfig_t:s0-s0:c0.c1023
:Target Context                system_u:object_r:tmp_t:s0
:Target Objects                tmp [ lnk_file ]
:Source                        ldconfig
:Source Path                   /sbin/ldconfig
:Port                          <Nieznane>
:Host                          (removed)
:Source RPM Packages           glibc-2.14.90-24.fc16.7.x86_64
:                              glibc-2.14.90-24.fc16.7.i686
:Target RPM Packages           filesystem-2.4.44-1.fc16.x86_64
:Policy RPM                    selinux-policy-3.10.0-86.fc16.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed) 3.3.7-1.fc16.x86_64 #1 SMP
:                              Tue May 22 13:59:39 UTC 2012 x86_64 x86_64
:Alert Count                   5
:First Seen                    czw, 7 cze 2012, 16:44:39
:Last Seen                     czw, 7 cze 2012, 16:44:39
:Local ID                      960feea9-4eaa-4cd6-8cda-39ee95b38089
:
:Raw Audit Messages
:type=AVC msg=audit(1339080279.811:70): avc:  denied  { read } for  pid=10497 comm="ldconfig" name="tmp" dev="dm-1" ino=786468 scontext=unconfined_u:system_r:ldconfig_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=lnk_file
:
:
:type=SYSCALL msg=audit(1339080279.811:70): arch=x86_64 syscall=open success=no exit=EACCES a0=20d51b0 a1=20241 a2=180 a3=646c2f6374652f68 items=0 ppid=2022 pid=10497 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm=ldconfig exe=/sbin/ldconfig subj=unconfined_u:system_r:ldconfig_t:s0-s0:c0.c1023 key=(null)
:
:Hash: ldconfig,ldconfig_t,tmp_t,lnk_file,read
:
:audit2allow
:
:#============= ldconfig_t ==============
:allow ldconfig_t tmp_t:lnk_file read;
:
:audit2allow -R
:
:#============= ldconfig_t ==============
:allow ldconfig_t tmp_t:lnk_file read;
:

Comment 1 Artur Szymczak 2012-06-07 15:12:29 UTC
# find / -inum 786468
/var/tmp
# ls -Zd /var/tmp/
drwxrwxrwt. root root system_u:object_r:tmp_t:s0       /var/tmp/

Comment 2 Daniel Walsh 2012-06-07 16:19:21 UTC
So this looks like a local customization, although we should probably just allow all apps that search tmp_t to be able to read the lnk_file.

Fixed in selinux-policy-3.10.0-129.fc17

Comment 3 Artur Szymczak 2012-06-07 16:34:13 UTC
I'm using Fedora 16.

Comment 4 Artur Szymczak 2012-06-07 16:40:47 UTC
Sorry, my wrong, output of "ls -Zd /var/tmp" should be:
lrwxrwxrwt. root root system_u:object_r:tmp_t:s0       /var/tmp -> /tmp

Comment 5 Artur Szymczak 2012-06-07 16:41:56 UTC
Typos...
lrwxrwxrwx. root root system_u:object_r:tmp_t:s0       /var/tmp -> /tmp

Comment 6 Daniel Walsh 2012-06-07 18:51:30 UTC
Miroslav can you back port the fix.

Comment 7 Miroslav Grepl 2012-06-22 09:05:15 UTC
Fixed in selinux-policy-3.10.0-90.fc16

Comment 8 Fedora Update System 2012-07-02 08:48:54 UTC
selinux-policy-3.10.0-90.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-90.fc16

Comment 9 Fedora Update System 2012-07-03 15:50:39 UTC
Package selinux-policy-3.10.0-90.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-90.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-10203/selinux-policy-3.10.0-90.fc16
then log in and leave karma (feedback).

Comment 10 Fedora Update System 2012-07-26 03:54:17 UTC
selinux-policy-3.10.0-90.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.