Bug 902205 - SELinux is preventing /usr/bin/totem-video-thumbnailer from name_bind access on the udp_socket
Summary: SELinux is preventing /usr/bin/totem-video-thumbnailer from name_bind access ...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 18
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-01-21 07:18 UTC by Ralf Corsepius
Modified: 2014-02-05 23:23 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2014-02-05 23:23:22 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
full SEalert (2.46 KB, text/plain)
2013-01-21 12:33 UTC, Ralf Corsepius
no flags Details

Description Ralf Corsepius 2013-01-21 07:18:29 UTC
Description of problem:
see subject.

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.11.1-67.fc18.noarch

How reproducible:
Frequently, but non-deterministic.

i.e. I am frequently receiving these, but have not found a method to provoke them deterministically.

Steps to Reproduce:
1. Open a nautilus window and step into a directory containing videos.

  
Actual results:
- The alert above.
- Seemingly, totem-thumbnailer sometimes fails to generate thumbnail images from some videos.

Expected results:
No sealerts, proper function.

Comment 1 Miroslav Grepl 2013-01-21 12:01:26 UTC
Could you also attach the alert? Thank you.

Comment 2 Ralf Corsepius 2013-01-21 12:33:19 UTC
Created attachment 684252 [details]
full SEalert

(In reply to comment #1)
> Could you also attach the alert? Thank you.

Sure. Actually, I had intended to do so, but got distracted. Sorry ;)

Comment 3 Ralf Corsepius 2013-01-22 11:43:24 UTC
FWIW: I am suspecting this issue to be related to dbus, due to the following observations:

When trying to running totem-video-thumbnailer from the command line soon after one of these sealerts (300+ so far), issued a "can't connect to dbus" warning (or similar).

Checking whether the dbus.service was running showed this:
# systemctl status dbus.service
...
dbus.service - D-Bus System Message Bus
	  Loaded: loaded (/usr/lib/systemd/system/dbus.service; static)
	  Active: active (running) since Mon 2013-01-21 09:43:52 CET; 18h ago
	Main PID: 533 (dbus-daemon)
	  CGroup: name=systemd:/system/dbus.service
		  ├─ 533 /bin/dbus-daemon --system --address=systemd: --nofor...
		  ├─ 568 /usr/sbin/modem-manager
		  └─5254 /usr/bin/python -Es /usr/sbin/setroubleshootd -f

Jan 22 04:22:50 beck setroubleshoot[5254]: SELinux is preventing /usr/bin/totem-video-thumbnailer from name_bind access on the udp_socket . For complete SELinux messages. run sealert -l 4c326cb1-a9f4-42d1-a4d9-3078e22f1e06
...

Manually restarting dbus.service 
# systemctl restart dbus.service
seems to have caused the sealerts to go away. 
At least I haven't received any of these sealerts since then.

I.e. I'd assume totem-video-thumbnailer could be doing something nasty, when dbus isn't running. From what I gather from strace, it seems to be wildly poking around into the system's sockets.

Comment 4 Daniel Walsh 2013-01-22 20:14:05 UTC
Were you running in an NIS Environment?

Comment 5 Ralf Corsepius 2013-01-22 22:28:52 UTC
(In reply to comment #4)
> Were you running in an NIS Environment?

Yes, I am using NIS to host passwd, groups and homes, but the directories which trigger the alerts were local in this case.

Comment 6 Daniel Walsh 2013-01-22 22:35:26 UTC
totem is calling getpw calls which is triggering this event. We have just added dontaudits for this in Rawhide and should back port to F18.

Comment 7 Miroslav Grepl 2013-01-23 08:26:34 UTC
It has beeen added also to F18.

# yum update selinux-policy-targeted --enablerepo=updates-testing

Comment 8 Ralf Corsepius 2013-01-28 08:47:31 UTC
I haven't received one of these sealerts since having installed 
selinux-policy-3.11.1-73.fc18 (6 days ago).

Thanks.

Comment 9 Fedora End Of Life 2013-12-21 15:50:11 UTC
This message is a reminder that Fedora 18 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 18. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '18'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 18's end of life.

Thank you for reporting this issue and we are sorry that we may not be 
able to fix it before Fedora 18 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior to Fedora 18's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 10 Fedora End Of Life 2014-02-05 23:23:22 UTC
Fedora 18 changed to end-of-life (EOL) status on 2014-01-14. Fedora 18 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.


Note You need to log in before you can comment on or make changes to this bug.