Description of problem: ======================= SELinux is preventing /usr/bin/composite from create access on the file magickNVvF6a. Version-Release number of selected component (if applicable): ============================================================= gnome-exe-thumbnailer-0.8-3.fc17 Additional Information: Source Context unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 Target Context unconfined_u:object_r:user_home_dir_t:s0 Target Objects magickNVvF6a [ file ] Source composite Source Path /usr/bin/composite Port <Sconosciuto> Host dave.idp.it Source RPM Packages ImageMagick-6.7.5.6-4.fc17.i686 Target RPM Packages Policy RPM selinux-policy-3.10.0-156.fc17.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name dave.idp.it Platform Linux dave.idp.it 3.6.2-4.fc17.i686 #1 SMP Wed Oct 17 03:22:23 UTC 2012 i686 i686 Alert Count 15 First Seen 2012-10-26 21:00:43 CEST Last Seen 2012-10-26 21:00:45 CEST Local ID ec8382ba-0483-4a7a-b86b-d91b17f77908 Raw Audit Messages type=AVC msg=audit(1351278045.898:233358): avc: denied { create } for pid=6614 comm="convert" name="magickNVvF6a" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=file type=SYSCALL msg=audit(1351278045.898:233358): arch=i386 syscall=open success=no exit=EACCES a0=8dc1ab0 a1=80c2 a2=180 a3=b591d1e items=0 ppid=6589 pid=6614 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1146 comm=convert exe=/usr/bin/convert subj=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 key=(null) Hash: composite,thumb_t,user_home_dir_t,file,create audit2allow #============= thumb_t ============== allow thumb_t user_home_dir_t:file create; audit2allow -R #============= thumb_t ============== allow thumb_t user_home_dir_t:file create;
Any chance # restorecon -R -v /home/$YOUR_USERNAME returns anything?
Nope. [root@dave ~]# restorecon -R -v /home/davide [root@dave ~]#
Can you get this to happen again?
Yes.
Why is ImageMagick creating these files in the HomeDir? Can it move the creation to ~/.cache?
I suppose ImageMagick create it in current directory where converting happened. Is it problem? Is creatint it say in /tmp solve that problem globally?
Yes, this means it could write anywhere. ~/.cache would be better but /tmp should also work.
Let me explain why this is a problem. Since you are using a random name, we can not setup a file trans label based on the name. Which means we would have to allow thumb apps to create files in $HOME. Since ~/.bashrc or ~/.profile type files are always executed by users this allows a hacked thumb application to take over the machine. If this is moved to /tmp or ~/.cache we have alot less risk.
*** This bug has been marked as a duplicate of bug 825874 ***