Bug 866716 - SELinux is preventing /usr/bin/brprintconf_mfcj6910dw from 'write' accesses on the directory /etc/opt/brother/Printers/mfcj6910dw/inf.
Summary: SELinux is preventing /usr/bin/brprintconf_mfcj6910dw from 'write' accesses o...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 17
Hardware: i686
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:a0c17e6fdeb9d5620601459946b...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-10-16 00:43 UTC by John Griffiths
Modified: 2013-01-07 03:59 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-01-07 03:59:51 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
File: type (9 bytes, text/plain)
2012-10-16 00:43 UTC, John Griffiths
no flags Details
File: hashmarkername (14 bytes, text/plain)
2012-10-16 00:43 UTC, John Griffiths
no flags Details

Description John Griffiths 2012-10-16 00:43:42 UTC
Description of problem:
Occured when printing using the Brother MFCJ 6910dw printer using the Brother supplied drivers and software.

Additional info:
libreport version: 2.0.14
kernel:         3.6.1-1.fc17.i686.PAE

description:
:SELinux is preventing /usr/bin/brprintconf_mfcj6910dw from 'write' accesses on the directory /etc/opt/brother/Printers/mfcj6910dw/inf.
:
:*****  Plugin catchall_labels (83.8 confidence) suggests  ********************
:
:If you want to allow brprintconf_mfcj6910dw to have write access on the inf directory
:Then you need to change the label on /etc/opt/brother/Printers/mfcj6910dw/inf
:Do
:# semanage fcontext -a -t FILE_TYPE '/etc/opt/brother/Printers/mfcj6910dw/inf'
:where FILE_TYPE is one of the following: var_log_t, cupsd_var_run_t, var_run_t, pcscd_var_run_t, print_spool_t, krb5_host_rcache_t, cupsd_interface_t, var_lock_t, tmp_t, var_t, cupsd_etc_t, cupsd_log_t, cupsd_rw_etc_t, cupsd_tmp_t, krb5_host_rcache_t, root_t, tmp_t. 
:Then execute: 
:restorecon -v '/etc/opt/brother/Printers/mfcj6910dw/inf'
:
:
:*****  Plugin catchall (17.1 confidence) suggests  ***************************
:
:If you believe that brprintconf_mfcj6910dw should be allowed write access on the inf directory by default.
:Then you should report this as a bug.
:You can generate a local policy module to allow this access.
:Do
:allow this access for now by executing:
:# grep brprintconf_mfc /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context                system_u:system_r:cupsd_t:s0-s0:c0.c1023
:Target Context                system_u:object_r:etc_t:s0
:Target Objects                /etc/opt/brother/Printers/mfcj6910dw/inf [ dir ]
:Source                        brprintconf_mfc
:Source Path                   /usr/bin/brprintconf_mfcj6910dw
:Port                          <Unknown>
:Host                          (removed)
:Source RPM Packages           mfcj6910dwlpr-1.1.1-1.i386
:Target RPM Packages           
:Policy RPM                    selinux-policy-3.10.0-153.fc17.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed) 3.6.1-1.fc17.i686.PAE #1 SMP Wed
:                              Oct 10 12:32:58 UTC 2012 i686 i686
:Alert Count                   60
:First Seen                    2012-10-15 10:08:48 EDT
:Last Seen                     2012-10-15 20:25:08 EDT
:Local ID                      082395bb-7e0c-40a4-88f6-fa482f6746a6
:
:Raw Audit Messages
:type=AVC msg=audit(1350347108.596:43007): avc:  denied  { write } for  pid=16180 comm="brprintconf_mfc" name="inf" dev="dm-4" ino=2894078 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=dir
:
:
:type=SYSCALL msg=audit(1350347108.596:43007): arch=i386 syscall=rename per=400000 success=no exit=EACCES a0=bfefdec0 a1=bfefdab0 a2=804abc0 a3=bfefdec0 items=0 ppid=16158 pid=16180 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm=brprintconf_mfc exe=/usr/bin/brprintconf_mfcj6910dw subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
:
:Hash: brprintconf_mfc,cupsd_t,etc_t,dir,write
:
:audit2allow
:
:#============= cupsd_t ==============
:#!!!! The source type 'cupsd_t' can write to a 'dir' of the following types:
:# var_log_t, cupsd_var_run_t, var_run_t, pcscd_var_run_t, print_spool_t, krb5_host_rcache_t, cupsd_interface_t, var_lock_t, tmp_t, var_t, cupsd_etc_t, cupsd_log_t, cupsd_rw_etc_t, cupsd_tmp_t, krb5_host_rcache_t, root_t, tmp_t
:
:allow cupsd_t etc_t:dir write;
:
:audit2allow -R
:
:#============= cupsd_t ==============
:#!!!! The source type 'cupsd_t' can write to a 'dir' of the following types:
:# var_log_t, cupsd_var_run_t, var_run_t, pcscd_var_run_t, print_spool_t, krb5_host_rcache_t, cupsd_interface_t, var_lock_t, tmp_t, var_t, cupsd_etc_t, cupsd_log_t, cupsd_rw_etc_t, cupsd_tmp_t, krb5_host_rcache_t, root_t, tmp_t
:
:allow cupsd_t etc_t:dir write;
:

Comment 1 John Griffiths 2012-10-16 00:43:44 UTC
Created attachment 627822 [details]
File: type

Comment 2 John Griffiths 2012-10-16 00:43:46 UTC
Created attachment 627823 [details]
File: hashmarkername

Comment 3 Miroslav Grepl 2012-10-16 11:47:21 UTC
You will need to fix labeling for brprintconf_mfc. 

# restorecon -R -v PATHO/brprintconf_mfc

Comment 4 Daniel Walsh 2012-10-16 12:43:16 UTC
This install must be creating files in /etc and then mv it to matchpathcon /etc/opt/brother/Printers/mfcj6910dw/inf
/etc/opt/brother/Printers/mfcj6910dw/inf	system_u:object_r:etc_t:s0

Comment 5 Miroslav Grepl 2012-10-16 12:45:51 UTC
You are right. I missed  this is

/etc/opt/..

Comment 6 Miroslav Grepl 2012-10-17 06:54:10 UTC
We have

matchpathcon /opt/brother/Printers/mfcj6910dw/inf
/opt/brother/Printers/mfcj6910dw/inf	system_u:object_r:cupsd_rw_etc_t:s0


Why is it located in the /etc/opt/brother instead of /opt/brother?

Comment 7 John Griffiths 2012-10-17 12:59:36 UTC
The inf directory is only in /etc/opt/brother/Printers/mfcj6910dw/. The /opt/brother/Printers/mfcj6910dw/ directory contains two directories, cupswrapper and lpd.

The "why" would have to be directed to Brother. All I did was install the Brother rpm packages.

Comment 8 Daniel Walsh 2012-10-18 11:18:48 UTC
Maybe they have moved it.

Comment 9 Miroslav Grepl 2012-10-18 13:23:02 UTC
ok, what does

rpm -qf /etc/opt/brother

Comment 10 John Griffiths 2012-10-18 15:55:37 UTC
rpm -qf /etc/opt/brother
file /etc/opt/brother is not owned by any package


This was a fresh install of Fedora 17.

brmfcfaxlpd-1.0.0-1.i386.rpm
brmfcfaxcups-1.0.0-1.i386.rpm
brscan-skey-0.2.1-3.i386.rpm
brscan4-0.3.0-2.i386.rpm
mfcj6910dwlpr-1.1.1-1.i386.rpm
mfcj6910dwcupswrapper-1.1.1-1.i386.rpm

are the Brother rpm packages installed.

Comment 11 Miroslav Grepl 2012-12-16 10:26:27 UTC
Added labeling.

Comment 12 Fedora Update System 2012-12-17 18:41:02 UTC
selinux-policy-3.10.0-165.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-165.fc17

Comment 13 Fedora Update System 2012-12-18 02:36:28 UTC
Package selinux-policy-3.10.0-165.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-165.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-20544/selinux-policy-3.10.0-165.fc17
then log in and leave karma (feedback).

Comment 14 Fedora Update System 2013-01-05 06:40:01 UTC
Package selinux-policy-3.10.0-166.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-166.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-20544/selinux-policy-3.10.0-166.fc17
then log in and leave karma (feedback).

Comment 15 Fedora Update System 2013-01-07 03:59:53 UTC
selinux-policy-3.10.0-166.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.