Bug 904320 - SELinux is preventing /usr/bin/gnome-shell from 'read' accesses on the file seat0.
Summary: SELinux is preventing /usr/bin/gnome-shell from 'read' accesses on the file s...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 18
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:a6abe52df7b073db6aeba53ecff...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-01-26 07:14 UTC by Stefan Schulze Frielinghaus
Modified: 2013-02-08 02:24 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-02-08 02:24:25 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Stefan Schulze Frielinghaus 2013-01-26 07:14:45 UTC
Description of problem:
The following AVC is generated if I try to login as an user_u. However, even if I allow the AVC I cannot login as user_u because of strange systemd error messages like

Failed to set security context (null) for /sys/fs: File exists

but no further AVCs are generated. If I set SELinux in permissive mode, I can login without any problems.
SELinux is preventing /usr/bin/gnome-shell from 'read' accesses on the file seat0.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that gnome-shell should be allowed read access on the seat0 file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep gnome-shell /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                user_u:user_r:user_t:s0
Target Context                system_u:object_r:systemd_logind_var_run_t:s0
Target Objects                seat0 [ file ]
Source                        gnome-shell
Source Path                   /usr/bin/gnome-shell
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           gnome-shell-3.6.2-6.fc18.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.11.1-73.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 3.7.2-204.fc18.x86_64 #1 SMP Wed
                              Jan 16 16:22:52 UTC 2013 x86_64 x86_64
Alert Count                   1
First Seen                    2013-01-26 08:06:23 CET
Last Seen                     2013-01-26 08:06:23 CET
Local ID                      d754b8cc-e5f7-4f40-b890-e04043b096f7

Raw Audit Messages
type=AVC msg=audit(1359183983.919:1566): avc:  denied  { read } for  pid=22932 comm="gnome-shell" name="seat0" dev="tmpfs" ino=427989 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:systemd_logind_var_run_t:s0 tclass=file


type=AVC msg=audit(1359183983.919:1566): avc:  denied  { open } for  pid=22932 comm="gnome-shell" path="/run/systemd/seats/seat0" dev="tmpfs" ino=427989 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:systemd_logind_var_run_t:s0 tclass=file


type=SYSCALL msg=audit(1359183983.919:1566): arch=x86_64 syscall=open success=yes exit=ENOSPC a0=24d6fc0 a1=80000 a2=1b6 a3=238 items=0 ppid=22719 pid=22932 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 ses=22 tty=(none) comm=gnome-shell exe=/usr/bin/gnome-shell subj=user_u:user_r:user_t:s0 key=(null)

Hash: gnome-shell,user_t,systemd_logind_var_run_t,file,read

audit2allow

#============= user_t ==============
#!!!! This avc is allowed in the current policy

allow user_t systemd_logind_var_run_t:file { read open };

audit2allow -R

#============= user_t ==============
#!!!! This avc is allowed in the current policy

allow user_t systemd_logind_var_run_t:file { read open };


Additional info:
hashmarkername: setroubleshoot
kernel:         3.7.2-204.fc18.x86_64
type:           libreport

Comment 1 Daniel Walsh 2013-01-28 16:59:53 UTC
19d30e0eee398fe68877564f694f9b863dd1d657 in git fixes this.

Comment 2 Miroslav Grepl 2013-01-28 17:14:07 UTC
Added.

Comment 3 Fedora Update System 2013-01-31 13:19:05 UTC
selinux-policy-3.11.1-74.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-74.fc18

Comment 4 Fedora Update System 2013-02-01 16:39:47 UTC
Package selinux-policy-3.11.1-74.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-74.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-1693/selinux-policy-3.11.1-74.fc18
then log in and leave karma (feedback).

Comment 5 Fedora Update System 2013-02-08 02:24:27 UTC
selinux-policy-3.11.1-74.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.