Bug 856210 - PackageKit GUI triggers SELinux denials
Summary: PackageKit GUI triggers SELinux denials
Keywords:
Status: CLOSED DUPLICATE of bug 852403
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 18
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: F18Alpha, F18AlphaBlocker
TreeView+ depends on / blocked
 
Reported: 2012-09-11 12:58 UTC by Kamil Páral
Modified: 2012-09-11 13:34 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-09-11 13:34:11 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Kamil Páral 2012-09-11 12:58:52 UTC
Description of problem:
I see this when I try to install a package using gnome-packagekit in F18 Alpha RC2.

SELinux is preventing /usr/lib/polkit-1/polkit-agent-helper-1 from read access on the file system-auth-ac.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that polkit-agent-helper-1 should be allowed read access on the system-auth-ac file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep polkit-agent-he /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c
                              0.c1023
Target Context                system_u:object_r:etc_runtime_t:s0
Target Objects                system-auth-ac [ file ]
Source                        polkit-agent-he
Source Path                   /usr/lib/polkit-1/polkit-agent-helper-1
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           polkit-0.107-2.fc18.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.11.1-7.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux localhost 3.6.0-0.rc2.git2.1.fc18.x86_64 #1
                              SMP Wed Aug 22 11:54:04 UTC 2012 x86_64 x86_64
Alert Count                   3
First Seen                    2012-09-11 12:44:40 CEST
Last Seen                     2012-09-11 12:44:40 CEST
Local ID                      ab43a5b1-7ae0-47b3-abcc-f237f40f1e4f

Raw Audit Messages
type=AVC msg=audit(1347360280.923:307): avc:  denied  { read } for  pid=1445 comm="polkit-agent-he" name="system-auth-ac" dev="vda3" ino=293884 scontext=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_runtime_t:s0 tclass=file


type=SYSCALL msg=audit(1347360280.923:307): arch=x86_64 syscall=open success=no exit=EACCES a0=e76960 a1=0 a2=1b6 a3=238 items=0 ppid=1193 pid=1445 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=2 comm=polkit-agent-he exe=/usr/lib/polkit-1/polkit-agent-helper-1 subj=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 key=(null)

Hash: polkit-agent-he,policykit_auth_t,etc_runtime_t,file,read

audit2allow

#============= policykit_auth_t ==============
allow policykit_auth_t etc_runtime_t:file read;

audit2allow -R

#============= policykit_auth_t ==============
allow policykit_auth_t etc_runtime_t:file read;



Version-Release number of selected component (if applicable):
PackageKit-gstreamer-plugin-0.8.3-2.fc18.x86_64
PackageKit-command-not-found-0.8.3-2.fc18.x86_64
PackageKit-yum-0.8.3-2.fc18.x86_64
gnome-packagekit-3.5.4-1.fc18.x86_64
PackageKit-gtk3-module-0.8.3-2.fc18.x86_64
PackageKit-0.8.3-2.fc18.x86_64
PackageKit-yum-plugin-0.8.3-2.fc18.x86_64
PackageKit-glib-0.8.3-2.fc18.x86_64
PackageKit-device-rebind-0.8.3-2.fc18.x86_64
polkit-0.107-2.fc18.x86_64
polkit-gnome-0.105-3.fc18.x86_64
libselinux-2.1.11-6.fc18.x86_64
libselinux-utils-2.1.11-6.fc18.x86_64
selinux-policy-devel-3.11.1-7.fc18.noarch
selinux-policy-targeted-3.11.1-7.fc18.noarch
selinux-policy-3.11.1-7.fc18.noarch
libselinux-python-2.1.11-6.fc18.x86_64


How reproducible:
always

Steps to Reproduce:
1. run packagekit gui
2. try to install package
3. see AVC

Comment 1 Kamil Páral 2012-09-11 13:28:22 UTC
I can confirm this blocks PackageKit completely. Until SELinux is disabled/permissive, it can't install any packages. I assume the same applies for updates.

Proposing as Alpha blocker:
" The installed system must be able to download and install updates with yum and the default graphical package manager in all release-blocking desktops "
https://fedoraproject.org/wiki/Fedora_18_Alpha_Release_Criteria

Comment 2 Kamil Páral 2012-09-11 13:34:11 UTC

*** This bug has been marked as a duplicate of bug 852403 ***


Note You need to log in before you can comment on or make changes to this bug.