Bug 875192 - SELinux is preventing /usr/bin/gnome-shell from 'read' accesses on the directory /var/lib/AccountsService/icons.
Summary: SELinux is preventing /usr/bin/gnome-shell from 'read' accesses on the direct...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 19
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:d4cc19086f3101894b2b6fd120f...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-11-09 18:48 UTC by Nicolas Mailhot
Modified: 2013-04-19 05:52 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-04-19 05:52:13 UTC
Type: ---


Attachments (Terms of Use)
File: type (9 bytes, text/plain)
2012-11-09 18:48 UTC, Nicolas Mailhot
no flags Details
File: hashmarkername (14 bytes, text/plain)
2012-11-09 18:48 UTC, Nicolas Mailhot
no flags Details

Description Nicolas Mailhot 2012-11-09 18:48:43 UTC
Additional info:
libreport version: 2.0.18
kernel:         3.7.0-0.rc4.git2.1.fc19.x86_64

description:
:SELinux is preventing /usr/bin/gnome-shell from 'read' accesses on the directory /var/lib/AccountsService/icons.
:
:*****  Plugin catchall (100. confidence) suggests  ***************************
:
:If vous pensez que gnome-shell devrait être autorisé à accéder read sur icons directory par défaut.
:Then vous devriez rapporter ceci en tant qu'anomalie.
:Vous pouvez générer un module de stratégie local pour autoriser cet accès.
:Do
:autoriser cet accès pour le moment en exécutant :
:# grep gnome-shell /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context                system_u:system_r:xdm_t:s0-s0:c0.c1023
:Target Context                system_u:object_r:accountsd_var_lib_t:s0
:Target Objects                /var/lib/AccountsService/icons [ dir ]
:Source                        gnome-shell
:Source Path                   /usr/bin/gnome-shell
:Port                          <Inconnu>
:Host                          (removed)
:Source RPM Packages           gnome-shell-3.7.1-1.fc19.x86_64
:Target RPM Packages           accountsservice-0.6.25-2.fc19.x86_64
:Policy RPM                    selinux-policy-3.11.1-52.fc18.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed) 3.7.0-0.rc4.git2.1.fc19.x86_64 #1
:                              SMP Fri Nov 9 13:04:25 UTC 2012 x86_64 x86_64
:Alert Count                   3
:First Seen                    2012-11-09 19:45:51 CET
:Last Seen                     2012-11-09 19:45:57 CET
:Local ID                      fe0f9cc6-7ae5-4659-be1d-25640ad2fc51
:
:Raw Audit Messages
:type=AVC msg=audit(1352486757.577:70): avc:  denied  { read } for  pid=1031 comm="gnome-shell" name="icons" dev="dm-0" ino=2890205 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:accountsd_var_lib_t:s0 tclass=dir
:
:
:type=SYSCALL msg=audit(1352486757.577:70): arch=x86_64 syscall=inotify_add_watch success=no exit=EACCES a0=9 a1=1a5a7c0 a2=1002fce a3=0 items=0 ppid=918 pid=1031 auid=42 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 ses=1 tty=(none) comm=gnome-shell exe=/usr/bin/gnome-shell subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
:
:Hash: gnome-shell,xdm_t,accountsd_var_lib_t,dir,read
:
:audit2allow
:
:#============= xdm_t ==============
:allow xdm_t accountsd_var_lib_t:dir read;
:
:audit2allow -R
:
:#============= xdm_t ==============
:allow xdm_t accountsd_var_lib_t:dir read;
:

Comment 1 Nicolas Mailhot 2012-11-09 18:48:46 UTC
Created attachment 641777 [details]
File: type

Comment 2 Nicolas Mailhot 2012-11-09 18:48:49 UTC
Created attachment 641778 [details]
File: hashmarkername

Comment 3 Daniel Walsh 2012-11-09 23:49:17 UTC
Was this from the initial install?

Comment 4 Nicolas Mailhot 2012-11-10 12:25:14 UTC
Sorry, I don't understand the question.

It was after a reboot with new gdm & selinux policy

Comment 5 Miroslav Grepl 2012-11-12 15:17:12 UTC
What does

# ls -dZ /usr/share/icons

Comment 6 Daniel Walsh 2012-11-12 19:44:17 UTC
Nicolas, was it during the new first boot?  xdm is going to be interacting with accountsdialog on first boot.

Comment 7 Nicolas Mailhot 2012-11-13 09:01:05 UTC
No it's a yum-updated rawhide system

Comment 8 Daniel Walsh 2012-11-13 18:10:33 UTC
Fixed in selinux-policy-3.11.1-54.fc18.noarch

Comment 9 Fedora End Of Life 2013-04-03 20:27:52 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 19 development cycle.
Changing version to '19'.

(As we did not run this process for some time, it could affect also pre-Fedora 19 development
cycle bugs. We are very sorry. It will help us with cleanup during Fedora 19 End Of Life. Thank you.)

More information and reason for this action is here:
https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora19

Comment 10 Fedora Update System 2013-04-08 11:40:56 UTC
selinux-policy-3.12.1-28.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/FEDORA-2013-5045/selinux-policy-3.12.1-28.fc19

Comment 11 Fedora Update System 2013-04-08 15:49:21 UTC
Package selinux-policy-3.12.1-28.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-28.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-5045/selinux-policy-3.12.1-28.fc19
then log in and leave karma (feedback).

Comment 12 Fedora Update System 2013-04-19 05:52:14 UTC
selinux-policy-3.12.1-28.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.