Bug 906970 - SELinux is preventing /usr/libexec/colord from 'search' accesses on the directory sessions.
Summary: SELinux is preventing /usr/libexec/colord from 'search' accesses on the direc...
Keywords:
Status: CLOSED DUPLICATE of bug 903173
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 18
Hardware: i686
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:20c46ebe07d685b3cee5ac1fbe6...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-02-02 05:15 UTC by Javier Villanueva
Modified: 2013-02-04 11:40 UTC (History)
14 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-02-04 11:40:40 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Javier Villanueva 2013-02-02 05:15:52 UTC
Description of problem:
SELinux is preventing /usr/libexec/colord from 'search' accesses on the directory sessions.

*****  Plugin catchall (100. confidence) suggests  ***************************

If cree que de manera predeterminada, colord debería permitir acceso search sobre  sessions directory.     
Then debería reportar esto como un error.
Puede generar un módulo de política local para permitir este acceso.
Do
permita el acceso momentáneamente executando:
# grep colord /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:colord_t:s0
Target Context                system_u:object_r:systemd_logind_sessions_t:s0
Target Objects                sessions [ dir ]
Source                        colord
Source Path                   /usr/libexec/colord
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           colord-0.1.28-1.fc18.i686
Target RPM Packages           
Policy RPM                    selinux-policy-3.11.1-74.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.7.5-201.fc18.i686.PAE #1 SMP Mon
                              Jan 28 20:06:14 UTC 2013 i686 i686
Alert Count                   1
First Seen                    2013-02-01 23:13:38 CST
Last Seen                     2013-02-01 23:13:38 CST
Local ID                      cfe0a951-df52-4a45-8473-6ea8c0332bac

Raw Audit Messages
type=AVC msg=audit(1359782018.548:357): avc:  denied  { search } for  pid=1796 comm="colord" name="sessions" dev="tmpfs" ino=16298 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:object_r:systemd_logind_sessions_t:s0 tclass=dir


type=SYSCALL msg=audit(1359782018.548:357): arch=i386 syscall=open success=no exit=EACCES a0=9849920 a1=88000 a2=1b6 a3=984abc0 items=0 ppid=1 pid=1796 auid=4294967295 uid=998 gid=997 euid=998 suid=998 fsuid=998 egid=997 sgid=997 fsgid=997 ses=4294967295 tty=(none) comm=colord exe=/usr/libexec/colord subj=system_u:system_r:colord_t:s0 key=(null)

Hash: colord,colord_t,systemd_logind_sessions_t,dir,search

audit2allow

#============= colord_t ==============
allow colord_t systemd_logind_sessions_t:dir search;

audit2allow -R

#============= colord_t ==============
allow colord_t systemd_logind_sessions_t:dir search;


Additional info:
hashmarkername: setroubleshoot
kernel:         3.7.5-201.fc18.i686.PAE
type:           libreport

Comment 1 Vedran Miletić 2013-02-02 11:16:12 UTC
Installed all updates and logged in to GNOME desktop.

Package: (null)
OS Release: Fedora release 18 (Spherical Cow)

Comment 2 Pascal94 2013-02-02 12:51:11 UTC
restarted after updating system

Package: (null)
Architecture: x86_64
OS Release: Fedora release 18 (Spherical Cow)

Comment 3 Paul 2013-02-03 13:53:37 UTC
I received SELinux Alert after updating Fedora 18 with Testing repository enabled (first update after enabling).

Package: (null)
Architecture: x86_64
OS Release: Fedora release 18 (Spherical Cow)

Comment 4 Roman 2013-02-03 19:51:25 UTC
The message appeared right after the GNOME session were started. If you 
think that colord should have access to search accesses in directories, 
please alter the SELinux policy, otherwise hinder colord from doing it.

Thank you in advance
Roman Morokutti


Package: (null)
Architecture: x86_64
OS Release: Fedora release 18 (Spherical Cow)

Comment 5 Tyler 2013-02-04 05:21:58 UTC
The bug was detected on boot. I think the problem might be related to Chrome or the plugins associated with it. Chrome crashed my computer twice, instantly, as soon as I launched the browser. 

Package: (null)
Architecture: x86_64
OS Release: Fedora release 18 (Spherical Cow)

Comment 6 D.S. Ljungmark 2013-02-04 07:03:45 UTC
started up my computer&logged in, no user interaction at all

Package: (null)
Architecture: x86_64
OS Release: Fedora release 18 (Spherical Cow)

Comment 7 Miroslav Grepl 2013-02-04 11:40:40 UTC

*** This bug has been marked as a duplicate of bug 903173 ***


Note You need to log in before you can comment on or make changes to this bug.