Red Hat Bugzilla – Bug 833813
/sur/bin/xauth selinux error after host name edited
Last modified: 2012-06-30 17:51:50 EDT
Description of problem: I edited /etc/sysconfig/network and modified the host name. X was running. At this point I got these errors from selinux: grep xauth /var/log/audit/audit.log type=AVC msg=audit(1340194034.272:634): avc: denied { write } for pid=13813 comm="xauth" name="kde-root" dev="sda6" ino=262168 scontext=unconfined_u:unconfined_r:xauth_t:s0 tcontext=system_u:object_r:firstboot_tmp_t:s0 tclass=dir type=AVC msg=audit(1340194034.272:634): avc: denied { add_name } for pid=13813 comm="xauth" name="xauth-0-_0-c" scontext=unconfined_u:unconfined_r:xauth_t:s0 tcontext=system_u:object_r:firstboot_tmp_t:s0 tclass=dir type=AVC msg=audit(1340194034.272:634): avc: denied { create } for pid=13813 comm="xauth" name="xauth-0-_0-c" scontext=unconfined_u:unconfined_r:xauth_t:s0 tcontext=unconfined_u:object_r:firstboot_tmp_t:s0 tclass=file type=AVC msg=audit(1340194034.272:634): avc: denied { open } for pid=13813 comm="xauth" path="/tmp/kde-root/xauth-0-_0-c" dev="sda6" ino=265976 scontext=unconfined_u:unconfined_r:xauth_t:s0 tcontext=unconfined_u:object_r:firstboot_tmp_t:s0 tclass=file type=SYSCALL msg=audit(1340194034.272:634): arch=40000003 syscall=5 success=yes exit=3 a0=fff3cd2a a1=c1 a2=180 a3=a items=0 ppid=13811 pid=13813 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0 key=(null) type=AVC msg=audit(1340194034.273:635): avc: denied { link } for pid=13813 comm="xauth" name="xauth-0-_0-c" dev="sda6" ino=265976 scontext=unconfined_u:unconfined_r:xauth_t:s0 tcontext=unconfined_u:object_r:firstboot_tmp_t:s0 tclass=file type=SYSCALL msg=audit(1340194034.273:635): arch=40000003 syscall=9 success=yes exit=0 a0=fff3cd2a a1=fff3d12b a2=4f052ff4 a3=a items=0 ppid=13811 pid=13813 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0 key=(null) type=AVC msg=audit(1340194034.283:636): avc: denied { remove_name } for pid=13813 comm="xauth" name="xauth-0-_0-c" dev="sda6" ino=265976 scontext=unconfined_u:unconfined_r:xauth_t:s0 tcontext=system_u:object_r:firstboot_tmp_t:s0 tclass=dir type=AVC msg=audit(1340194034.283:636): avc: denied { unlink } for pid=13813 comm="xauth" name="xauth-0-_0-c" dev="sda6" ino=265976 scontext=unconfined_u:unconfined_r:xauth_t:s0 tcontext=unconfined_u:object_r:firstboot_tmp_t:s0 tclass=file type=SYSCALL msg=audit(1340194034.283:636): arch=40000003 syscall=10 success=yes exit=0 a0=fff3c91a a1=706d742f a2=4f052ff4 a3=fff3cd33 items=0 ppid=13811 pid=13813 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0 key=(null) Version-Release number of selected component (if applicable): selinux-policy-3.10.0-130.fc17.noarch How reproducible: did not try Steps to Reproduce: 1. start kde session 2. edit /etc/sysconfig/network modifying domain name Actual results: get error from selinux: xauth tried this access: remove_name Expected results: no error Additional info:
Remove firstboot_tmp_t directories, so this should just work without generating avc's in the future. Fixed in selinux-policy-3.10.0-133.fc17
selinux-policy-3.10.0-134.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-134.fc17
Package selinux-policy-3.10.0-134.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-134.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-10008/selinux-policy-3.10.0-134.fc17 then log in and leave karma (feedback).
selinux-policy-3.10.0-134.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.