Bug 875456 - SELinux is preventing /usr/bin/passwd from 'execute' accesses on the file /usr/bin/gnome-keyring-daemon.
Summary: SELinux is preventing /usr/bin/passwd from 'execute' accesses on the file /us...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 17
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:a73daefcd1cdc405d39cee7b19f...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-11-11 11:34 UTC by Mark
Modified: 2013-07-06 17:57 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-07-04 06:50:36 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
File: type (9 bytes, text/plain)
2012-11-11 11:34 UTC, Mark
no flags Details
File: hashmarkername (14 bytes, text/plain)
2012-11-11 11:34 UTC, Mark
no flags Details

Description Mark 2012-11-11 11:34:26 UTC
Description of problem:
When changing password I get this error, but i don't know what caused it, maybe due privileges?. 

Additional info:
libreport version: 2.0.18
kernel:         3.3.4-5.fc17.x86_64

description:
:SELinux is preventing /usr/bin/passwd from 'execute' accesses on the file /usr/bin/gnome-keyring-daemon.
:
:*****  Plugin leaks (86.2 confidence) suggests  ******************************
:
:If je wilt negeren dat passwd execute toegang probeert te krijgen tot de gnome-keyring-daemon file, omdat je denkt het deze toegang niet nodig heeft.
:Then je moet dit melden als een fout.  
:Je kunt een locale tactiek module genereren om deze toegang niet te auditeren.
:Do
:# grep /usr/bin/passwd /var/log/audit/audit.log | audit2allow -D -M mypol
:# semodule -i mypol.pp
:
:*****  Plugin catchall (14.7 confidence) suggests  ***************************
:
:If je denkt dat passwd standaard execute toegang moet hebben tot de  gnome-keyring-daemon file.
:Then je moet dit melden als een fout.
:Je kunt een locale tactiek module genereren om deze toegang toe te staan.
:Do
:sta deze toegang nu toe door het uitvoeren van:
:# grep passwd /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context                unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023
:Target Context                system_u:object_r:gkeyringd_exec_t:s0
:Target Objects                /usr/bin/gnome-keyring-daemon [ file ]
:Source                        passwd
:Source Path                   /usr/bin/passwd
:Port                          <Onbekend>
:Host                          (removed)
:Source RPM Packages           passwd-0.78.99-1.fc17.x86_64
:Target RPM Packages           gnome-keyring-3.4.1-3.fc17.x86_64
:Policy RPM                    selinux-policy-3.10.0-156.fc17.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed) 3.3.4-5.fc17.x86_64 #1 SMP Mon May
:                              7 17:29:34 UTC 2012 x86_64 x86_64
:Alert Count                   1
:First Seen                    2012-11-11 12:16:29 CET
:Last Seen                     2012-11-11 12:16:29 CET
:Local ID                      ed5fe4f3-12f9-4fd2-9556-e6b5565ad742
:
:Raw Audit Messages
:type=AVC msg=audit(1352632589.116:70): avc:  denied  { execute } for  pid=1446 comm="passwd" name="gnome-keyring-daemon" dev="sdb3" ino=170328 scontext=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:gkeyringd_exec_t:s0 tclass=file
:
:
:type=SYSCALL msg=audit(1352632589.116:70): arch=x86_64 syscall=execve success=no exit=EACCES a0=7f5eb54e35c0 a1=7fff2b0c7ed0 a2=7f5ebc01b190 a3=12 items=0 ppid=1439 pid=1446 auid=1001 uid=1001 gid=1001 euid=1001 suid=0 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=1 comm=passwd exe=/usr/bin/passwd subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 key=(null)
:
:Hash: passwd,passwd_t,gkeyringd_exec_t,file,execute
:
:audit2allowunable to open /sys/fs/selinux/policy:  Permission denied
:
:
:audit2allow -Runable to open /sys/fs/selinux/policy:  Permission denied
:
:


Potential duplicate bug: 707803

Comment 1 Mark 2012-11-11 11:34:30 UTC
Created attachment 642741 [details]
File: type

Comment 2 Mark 2012-11-11 11:34:32 UTC
Created attachment 642742 [details]
File: hashmarkername

Comment 3 Miroslav Grepl 2012-11-12 13:31:14 UTC
No, The problem is g-k-daemon was not running. We have some fixes in F18. I need to look at it and backport them.

Comment 4 Igor Vucenovic 2013-03-26 08:31:01 UTC
I was try to change my password via graphical tool Users Accounts, and I receive this warning, and I am afraid that my password for gnome-keyring is not changed now....

Package: (null)
OS Release: Fedora release 17 (Beefy Miracle)

Comment 5 Miroslav Grepl 2013-03-27 12:56:24 UTC
Could you try to update to the lastest F17 policy.

selinux-policy-3.10.0-168.fc17

Comment 6 Joe Zeff 2013-04-16 20:25:36 UTC
Description of problem:
I was adding a user to my home machine, recreating an account that had been on it before I re-installed Fedora.  After I was finished, I saw this alert.

Additional info:
hashmarkername: setroubleshoot
kernel:         3.8.4-102.fc17.i686.PAE
type:           libreport

Comment 7 Fedora End Of Life 2013-07-04 06:18:14 UTC
This message is a reminder that Fedora 17 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 17. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '17'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 17's end of life.

Bug Reporter:  Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 17 is end of life. If you 
would still like  to see this bug fixed and are able to reproduce it 
against a later version  of Fedora, you are encouraged  change the 
'version' to a later Fedora version prior to Fedora 17's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.


Note You need to log in before you can comment on or make changes to this bug.