Bug 862229 - cannot run kgpg probably due to selinux restrictions
cannot run kgpg probably due to selinux restrictions
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2012-10-02 07:04 EDT by Petr Lautrbach
Modified: 2014-10-09 14:34 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-12-20 10:00:41 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
avcs in permissive mode (15.75 KB, text/plain)
2012-10-02 07:04 EDT, Petr Lautrbach
no flags Details

  None (edit)
Description Petr Lautrbach 2012-10-02 07:04:11 EDT
Created attachment 620239 [details]
avcs in permissive mode

$ id -Z

$ rpm -q kgpg

$ rpm -q selinux-policy

$ LC_ALL=C kgpg
unnamed app(6935): KUniqueApplication: Cannot find the D-Bus session server:  "Failed to connect to socket /tmp/dbus-sDp5CJoM5L: Permission denied" 

unnamed app(6934): KUniqueApplication: Pipe closed unexpectedly.
Comment 1 Petr Lautrbach 2012-10-04 08:58:35 EDT
kgpg is X-window application and it's run with gpg_t. I think it's not necessary. 
I've tried to change context of /usr/bin/kgpg to bin_t and it seems to 
work. It looks like that kgpg uses gpg2 and type transistion should be done when kgpg runs /usr/bin/gpg2.
Comment 2 Miroslav Grepl 2012-10-04 10:49:55 EDT
The question is why we have this label.
Comment 3 Dominick Grift 2012-10-04 11:13:00 EDT
Should probably leave /usr/bin/kgpg bin_t. It will domain type transition as soon as it runs gpg(2)?
Comment 4 Daniel Walsh 2012-10-11 14:17:20 EDT
Removing it and see if we get an AVC about it.

Fixed in selinux-policy-3.11.1-37.fc18.noarch
Comment 5 Fedora Update System 2012-10-23 16:33:42 EDT
selinux-policy-3.11.1-43.fc18 has been submitted as an update for Fedora 18.
Comment 6 Fedora Update System 2012-10-26 11:36:34 EDT
selinux-policy-3.11.1-46.fc18 has been submitted as an update for Fedora 18.
Comment 7 Fedora Update System 2012-10-26 15:25:49 EDT
Package selinux-policy-3.11.1-46.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-46.fc18'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).
Comment 8 Fedora Update System 2012-12-20 10:00:44 EST
selinux-policy-3.11.1-46.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Maurizio 2014-10-09 14:34:47 EDT
knemo wont start   

unnamed app(7067): KUniqueApplication: Pipe closed unexpectedly

unnamed app(7068): KUniqueApplication: Cannot find the D-Bus session server:  "Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken."

Note You need to log in before you can comment on or make changes to this bug.