Bug 915593 - SELinux is preventing /usr/lib/systemd/systemd-localed from 'search' accesses on the directory 1976.
Summary: SELinux is preventing /usr/lib/systemd/systemd-localed from 'search' accesses...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 18
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:14865cedc806224b88931abda49...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-02-26 08:01 UTC by Gerard Barker
Modified: 2013-03-14 03:02 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-03-14 03:02:28 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Gerard Barker 2013-02-26 08:01:00 UTC
Description of problem:
SELinux is preventing /usr/lib/systemd/systemd-localed from 'search' accesses on the directory 1976.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that systemd-localed should be allowed search access on the 1976 directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep systemd-localed /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:systemd_localed_t:s0
Target Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Objects                1976 [ dir ]
Source                        systemd-localed
Source Path                   /usr/lib/systemd/systemd-localed
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           systemd-197-1.fc18.1.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.11.1-79.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.7.9-201.fc18.x86_64 #1 SMP Mon
                              Feb 18 21:07:56 UTC 2013 x86_64 x86_64
Alert Count                   5
First Seen                    2013-02-26 20:35:13 NZDT
Last Seen                     2013-02-26 20:55:57 NZDT
Local ID                      93c19c0d-7633-4579-82ea-2b1d86fd4f40

Raw Audit Messages
type=AVC msg=audit(1361865357.843:472): avc:  denied  { search } for  pid=2033 comm="systemd-localed" name="1976" dev="proc" ino=28818 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir


type=AVC msg=audit(1361865357.843:472): avc:  denied  { read } for  pid=2033 comm="systemd-localed" name="stat" dev="proc" ino=32755 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file


type=AVC msg=audit(1361865357.843:472): avc:  denied  { open } for  pid=2033 comm="systemd-localed" path="/proc/1976/stat" dev="proc" ino=32755 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file


type=SYSCALL msg=audit(1361865357.843:472): arch=x86_64 syscall=open success=yes exit=EIO a0=7fff1d133610 a1=80000 a2=1b6 a3=238 items=0 ppid=1 pid=2033 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=systemd-localed exe=/usr/lib/systemd/systemd-localed subj=system_u:system_r:systemd_localed_t:s0 key=(null)

Hash: systemd-localed,systemd_localed_t,unconfined_t,dir,search

audit2allow

#============= systemd_localed_t ==============
allow systemd_localed_t unconfined_t:dir search;
allow systemd_localed_t unconfined_t:file { read open };

audit2allow -R

#============= systemd_localed_t ==============
allow systemd_localed_t unconfined_t:dir search;
allow systemd_localed_t unconfined_t:file { read open };


Additional info:
hashmarkername: setroubleshoot
kernel:         3.7.9-201.fc18.x86_64
type:           libreport

Comment 1 Miroslav Grepl 2013-02-26 09:49:56 UTC
Pleae update to the lastest policy.

# yum update selinux-policy-targeted

Comment 2 Gustavo Maciel Dias Vieira 2013-03-01 19:26:49 UTC
I'm still seeing this with selinux-policy-targeted-3.11.1-82.fc18.noarch. This happens when trying to save locale and keyboard settings globally.

Additional Information:
Source Context                system_u:system_r:systemd_localed_t:s0
Target Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Objects                6104 [ dir ]
Source                        systemd-localed
Source Path                   /usr/lib/systemd/systemd-localed
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           systemd-197-1.fc18.2.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.11.1-82.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux () 3.7.9-205.fc18.x86_64 #1
                              SMP Sun Feb 24 20:10:02 UTC 2013 x86_64 x86_64
Alert Count                   6
First Seen                    2013-03-01 10:16:48 BRT
Last Seen                     2013-03-01 12:25:46 BRT
Local ID                      ec48ed1d-d40a-422c-a50f-bd009bf6e4e8

Raw Audit Messages
type=AVC msg=audit(1362151546.155:398): avc:  denied  { search } for  pid=3688 comm="systemd-localed" name="6104" dev="proc" ino=40513 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir


type=AVC msg=audit(1362151546.155:398): avc:  denied  { read } for  pid=3688 comm="systemd-localed" name="stat" dev="proc" ino=41426 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file


type=AVC msg=audit(1362151546.155:398): avc:  denied  { open } for  pid=3688 comm="systemd-localed" path="/proc/6104/stat" dev="proc" ino=41426 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file


type=SYSCALL msg=audit(1362151546.155:398): arch=x86_64 syscall=open success=yes exit=EIO a0=7fff71507870 a1=80000 a2=1b6 a3=238 items=0 ppid=1 pid=3688 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=systemd-localed exe=/usr/lib/systemd/systemd-localed subj=system_u:system_r:systemd_localed_t:s0 key=(null)

Hash: systemd-localed,systemd_localed_t,unconfined_t,dir,search

Comment 3 Gustavo Maciel Dias Vieira 2013-03-01 19:36:55 UTC
Can the original reporter reopen this, please. Or should I create a new bug?

Comment 4 Miroslav Grepl 2013-03-04 10:14:37 UTC
Fixed in selinux-policy-3.11.1-83.fc18

Comment 5 Fedora Update System 2013-03-04 12:11:28 UTC
selinux-policy-3.11.1-83.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-83.fc18

Comment 6 Fedora Update System 2013-03-04 22:34:10 UTC
Package selinux-policy-3.11.1-83.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-83.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-3398/selinux-policy-3.11.1-83.fc18
then log in and leave karma (feedback).

Comment 7 Fedora Update System 2013-03-08 16:11:40 UTC
selinux-policy-3.11.1-84.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-84.fc18

Comment 8 Fedora Update System 2013-03-14 03:02:31 UTC
selinux-policy-3.11.1-85.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.