Description of problem: opening a ntfs drive with multiple video files(multiple format too) in file browser SELinux is preventing /usr/bin/totem-video-thumbnailer from 'execute' accesses on the chr_file /dev/zero. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that totem-video-thumbnailer should be allowed execute access on the zero chr_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep totem-video-thu /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 Target Context system_u:object_r:zero_device_t:s0 Target Objects /dev/zero [ chr_file ] Source totem-video-thu Source Path /usr/bin/totem-video-thumbnailer Port <Unknown> Host (removed) Source RPM Packages totem-3.6.3-1.fc18.i686 Target RPM Packages Policy RPM selinux-policy-3.11.1-67.fc18.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 3.7.2-204.fc18.i686.PAE #1 SMP Wed Jan 16 16:31:26 UTC 2013 i686 i686 Alert Count 1 First Seen 2013-01-23 09:56:02 IST Last Seen 2013-01-23 09:56:02 IST Local ID b178f46d-5255-4b79-81f9-76f9bb5bec22 Raw Audit Messages type=AVC msg=audit(1358915162.378:394): avc: denied { execute } for pid=7231 comm="totem-video-thu" path="/dev/zero" dev="devtmpfs" ino=22 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:zero_device_t:s0 tclass=chr_file type=SYSCALL msg=audit(1358915162.378:394): arch=i386 syscall=mmap2 success=yes exit=-1216552960 a0=0 a1=2000 a2=7 a3=2 items=0 ppid=2337 pid=7231 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=3 tty=(none) comm=totem-video-thu exe=/usr/bin/totem-video-thumbnailer subj=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 key=(null) Hash: totem-video-thu,thumb_t,zero_device_t,chr_file,execute audit2allow #============= thumb_t ============== allow thumb_t zero_device_t:chr_file execute; audit2allow -R #============= thumb_t ============== allow thumb_t zero_device_t:chr_file execute; Additional info: hashmarkername: setroubleshoot kernel: 3.7.2-204.fc18.i686.PAE type: libreport
Fixed in selinux-policy-3.11.1-74.fc18
selinux-policy-3.11.1-74.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-74.fc18
Package selinux-policy-3.11.1-74.fc18: * should fix your issue, * was pushed to the Fedora 18 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-74.fc18' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-1693/selinux-policy-3.11.1-74.fc18 then log in and leave karma (feedback).
selinux-policy-3.11.1-74.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
This bug was not fixed with the current release. Today is 5-27-2013 and I just submitted a new report. was using dropbox and /dev/zero was denied access from the totem-thumbnailer. Today I have had much trouble with this totem thumbnailer. I just updated from the updates repository last night, and then the kernel updates from same this morning. It was after that I have this problem. Was not using nautillus. I was using the dropbox default "files 2.0.3" file manager. I do not log in as root ever, only in terminal to do root tasks.. Thanks guys [ and gals :) ] -Jamie in Boston
Please attach your latest avc messages.
[root@jfm james]# ausearch -m avc -ts recent <no matches> Is this posible? Sorry, I am new to this SELinux -J
Im still having this problem. This time I wasnt even using any file managers that thumbnail.. SELinux is preventing /usr/bin/totem-video-thumbnailer from execute access on the chr_file /dev/zero. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that totem-video-thumbnailer should be allowed execute access on the zero chr_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep totem-video-thu /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 Target Context system_u:object_r:zero_device_t:s0 Target Objects /dev/zero [ chr_file ] Source totem-video-thu Source Path /usr/bin/totem-video-thumbnailer Port <Unknown> Host (removed) Source RPM Packages totem-3.6.3-2.fc18.i686 Target RPM Packages Policy RPM selinux-policy-3.11.1-96.fc18.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux jfm 3.9.4-200.fc18.i686.PAE #1 SMP Fri May 24 20:24:58 UTC 2013 i686 i686 Alert Count 6 First Seen 2013-05-27 18:37:39 EDT Last Seen 2013-05-27 18:38:25 EDT Local ID f587cd2a-4375-4e19-8116-7aa091681243 Raw Audit Messages type=AVC msg=audit(1369694305.513:634): avc: denied { execute } for pid=5165 comm="totem-video-thu" path="/dev/zero" dev="devtmpfs" ino=4884 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:zero_device_t:s0 tclass=chr_file type=SYSCALL msg=audit(1369694305.513:634): arch=i386 syscall=mmap2 success=no exit=EACCES a0=0 a1=2000 a2=7 a3=2 items=0 ppid=4978 pid=5165 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=1 tty=(none) comm=totem-video-thu exe=/usr/bin/totem-video-thumbnailer subj=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 key=(null) Hash: totem-video-thu,thumb_t,zero_device_t,chr_file,execute audit2allow #============= thumb_t ============== #!!!! This avc is allowed in the current policy allow thumb_t zero_device_t:chr_file execute; audit2allow -R require { type thumb_t; } #============= thumb_t ============== dev_rwx_zero(thumb_t)
Last Seen 2013-05-27 18:38:25 EDT This says that it has not happened since 5-27 #============= thumb_t ============== #!!!! This avc is allowed in the current policy allow thumb_t zero_device_t:chr_file execute; Meanig you have the fix.