Bug 844494 - SELinux is preventing /bin/bash from 'write' accesses on the directory ffgtk.
SELinux is preventing /bin/bash from 'write' accesses on the directory ffgtk.
Status: CLOSED NOTABUG
Product: Fedora
Classification: Fedora
Component: 0xFFFF (Show other bugs)
16
i686 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
abrt_hash:8bf37488636d239fee5ebde273f...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-07-30 18:19 EDT by Markus Schulze
Modified: 2012-08-10 03:18 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-08-10 03:18:58 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
File: description (4.19 KB, text/plain)
2012-07-30 18:19 EDT, Markus Schulze
no flags Details

  None (edit)
Description Markus Schulze 2012-07-30 18:19:47 EDT
libreport version: 2.0.10
executable:     /usr/bin/python2.7
hashmarkername: setroubleshoot
kernel:         3.3.8-1.fc16.i686
time:           Di 31 Jul 2012 00:19:21 CEST

description:    Text file, 4291 bytes
Comment 1 Markus Schulze 2012-07-30 18:19:50 EDT
Created attachment 601347 [details]
File: description
Comment 2 Miroslav Grepl 2012-07-31 05:31:54 EDT
Where is ffgtk-cups located?
Comment 3 Markus Schulze 2012-07-31 08:53:46 EDT
/usr/lib/cups/backend/
Comment 4 Daniel Walsh 2012-07-31 11:24:05 EDT
Does

restorecon -R -v /var/lib/cups

Do anything?
Comment 5 Markus Schulze 2012-07-31 13:23:19 EDT
Well, it seems so, but now another alert comes up:

SELinux is preventing /bin/bash from 'write' accesses on the directory /var/spool/ffgtk.

*****  Plugin catchall (100. confidence) suggests  ***************************

If sie denken, dass bash standardmässig erlaubt sein sollte, write Zugriff auf ffgtk directory zu erhalten.
Then sie sollten dies als Fehler melden.
Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen.
Do
zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen:
# grep ffgtk-cups /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:cupsd_t:s0-s0:c0.c1023
Target Context                unconfined_u:object_r:var_spool_t:s0
Target Objects                /var/spool/ffgtk [ dir ]
Source                        ffgtk-cups
Source Path                   /bin/bash
Port                          <Unbekannt>
Host                          (removed)
Source RPM Packages           bash-4.2.28-1.fc16.i686
Target RPM Packages           
Policy RPM                    selinux-policy-3.10.0-90.fc16.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.3.8-1.fc16.i686 #1 SMP
                              Mon Jun 4 21:30:50 UTC 2012 i686 i686
Alert Count                   1
First Seen                    Di 31 Jul 2012 19:19:11 CEST
Last Seen                     Di 31 Jul 2012 19:19:11 CEST
Local ID                      bfc189cc-6b01-4ecc-857d-2b5b9957b7d4

Raw Audit Messages
type=AVC msg=audit(1343755151.421:161): avc:  denied  { write } for  pid=17889 comm="ffgtk-cups" name="ffgtk" dev="dm-1" ino=542847 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_spool_t:s0 tclass=dir


type=SYSCALL msg=audit(1343755151.421:161): arch=i386 syscall=open success=no exit=EACCES a0=9e91aa0 a1=8241 a2=1b6 a3=0 items=0 ppid=17887 pid=17889 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm=ffgtk-cups exe=/bin/bash subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)

Hash: ffgtk-cups,cupsd_t,var_spool_t,dir,write

audit2allow

Is there another restorecon needed on /var/spool/ffgtk ?
Comment 6 Miroslav Grepl 2012-08-01 04:20:12 EDT
What does

# rpm -qf /var/spool/ffgtk
Comment 7 Markus Schulze 2012-08-10 03:18:26 EDT
/var/spool/ffgtk is a directory

I'll close this bug, because the problem is caused by changes made to ffgtk. They changed the way the fax printer is handled and the packet maintainer didn't include the changes yet.

Note You need to log in before you can comment on or make changes to this bug.