Bug 882695 - SELinux is preventing /usr/bin/nmcli from 'read' accesses on the lnk_file /usr/tmp.
Summary: SELinux is preventing /usr/bin/nmcli from 'read' accesses on the lnk_file /us...
Keywords:
Status: CLOSED DUPLICATE of bug 882696
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 17
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:4860b78196471a704ca09944f7e...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-12-02 17:50 UTC by Grosswiler Roger
Modified: 2012-12-03 11:18 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2012-12-03 11:18:32 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
File: type (9 bytes, text/plain)
2012-12-02 17:51 UTC, Grosswiler Roger
no flags Details
File: hashmarkername (14 bytes, text/plain)
2012-12-02 17:51 UTC, Grosswiler Roger
no flags Details

Description Grosswiler Roger 2012-12-02 17:50:57 UTC
Additional info:
libreport version: 2.0.18
kernel:         3.6.7-4.fc17.x86_64

description:
:SELinux is preventing /usr/bin/nmcli from 'read' accesses on the lnk_file /usr/tmp.
:
:*****  Plugin catchall_labels (83.8 confidence) suggests  ********************
:
:If you want to allow nmcli to have read access on the tmp lnk_file
:Then sie müssen das Label auf /usr/tmp ändern
:Do
:# semanage fcontext -a -t FILE_TYPE '/usr/tmp'
:wobei FILE_TYPE einer der folgenen Werte ist: rpm_script_tmp_t, home_root_t, var_run_t, user_home_dir_t, device_t, device_t, devlog_t, locale_t, var_lock_t, etc_t, bin_t, cert_t, proc_t, sysfs_t, var_run_t, pppd_t, tmp_t, tmp_t, net_conf_t, postfix_etc_t, device_t, ld_so_t, abrt_t, bin_t, proc_t, lib_t, root_t, tmp_t, userdomain, proc_net_t, etc_t, cert_t, mta_exec_type, pppd_etc_t, var_run_t, var_run_t, var_run_t, etc_runtime_t, textrel_shlib_t, udev_var_run_t, var_run_t, var_run_t. 
:Führen Sie danach Folgendes aus: 
:restorecon -v '/usr/tmp'
:
:
:*****  Plugin catchall (17.1 confidence) suggests  ***************************
:
:If sie denken, dass nmcli standardmässig erlaubt sein sollte, read Zugriff auf tmp lnk_file zu erhalten.
:Then sie sollten dies als Fehler melden.
:Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen.
:Do
:zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen:
:# grep nmcli /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context                system_u:system_r:pppd_t:s0
:Target Context                system_u:object_r:usr_t:s0
:Target Objects                /usr/tmp [ lnk_file ]
:Source                        nmcli
:Source Path                   /usr/bin/nmcli
:Port                          <Unbekannt>
:Host                          (removed)
:Source RPM Packages           NetworkManager-0.9.6.4-3.fc17.x86_64
:Target RPM Packages           filesystem-3-2.fc17.x86_64
:Policy RPM                    selinux-policy-3.10.0-161.fc17.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Permissive
:Host Name                     (removed)
:Platform                      Linux (removed) 3.6.7-4.fc17.x86_64 #1 SMP Tue Nov
:                              20 19:40:01 UTC 2012 x86_64 x86_64
:Alert Count                   12
:First Seen                    2012-11-21 20:53:22 CET
:Last Seen                     2012-12-02 15:58:57 CET
:Local ID                      78eb68e4-1f5e-424a-8be5-10158527805a
:
:Raw Audit Messages
:type=AVC msg=audit(1354460337.61:186): avc:  denied  { read } for  pid=3773 comm="nmcli" name="tmp" dev="dm-1" ino=2883588 scontext=system_u:system_r:pppd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=lnk_file
:
:
:type=SYSCALL msg=audit(1354460337.61:186): arch=x86_64 syscall=stat success=yes exit=0 a0=34d1842603 a1=7fff4a5a8590 a2=7fff4a5a8590 a3=22 items=0 ppid=3772 pid=3773 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=nmcli exe=/usr/bin/nmcli subj=system_u:system_r:pppd_t:s0 key=(null)
:
:Hash: nmcli,pppd_t,usr_t,lnk_file,read
:
:audit2allow
:
:#============= pppd_t ==============
:allow pppd_t usr_t:lnk_file read;
:
:audit2allow -R
:
:#============= pppd_t ==============
:allow pppd_t usr_t:lnk_file read;
:

Comment 1 Grosswiler Roger 2012-12-02 17:51:02 UTC
Created attachment 656153 [details]
File: type

Comment 2 Grosswiler Roger 2012-12-02 17:51:05 UTC
Created attachment 656154 [details]
File: hashmarkername

Comment 3 Miroslav Grepl 2012-12-03 11:18:32 UTC

*** This bug has been marked as a duplicate of bug 882696 ***


Note You need to log in before you can comment on or make changes to this bug.