Bug 963318 - SELinux is preventing /usr/libexec/colord from 'read' accesses on the file /home/SECURITY/amy/.local/share/icc/edid-a99d98c760ecb11e07592f0536164edc.icc.
Summary: SELinux is preventing /usr/libexec/colord from 'read' accesses on the file /h...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 19
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:48e53508c1185c43be4be978b5c...
: 1099691 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-05-15 15:56 UTC by David Spurek
Modified: 2015-03-02 05:27 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-05-16 06:13:46 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description David Spurek 2013-05-15 15:56:31 UTC
Description of problem:
GDM login with Active directory account cause this avc message
SELinux is preventing /usr/libexec/colord from 'read' accesses on the file /home/SECURITY/amy/.local/share/icc/edid-a99d98c760ecb11e07592f0536164edc.icc.

*****  Plugin restorecon (99.5 confidence) suggests  *************************

If you want to fix the label. 
/home/SECURITY/amy/.local/share/icc/edid-a99d98c760ecb11e07592f0536164edc.icc default label should be user_home_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /home/SECURITY/amy/.local/share/icc/edid-a99d98c760ecb11e07592f0536164edc.icc

*****  Plugin catchall (1.49 confidence) suggests  ***************************

If you believe that colord should be allowed read access on the edid-a99d98c760ecb11e07592f0536164edc.icc file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep gdbus /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:colord_t:s0
Target Context                unconfined_u:object_r:home_root_t:s0
Target Objects                /home/SECURITY/amy/.local/share/icc/edid-
                              a99d98c760ecb11e07592f0536164edc.icc [ file ]
Source                        gdbus
Source Path                   /usr/libexec/colord
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           colord-0.1.34-1.fc19.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-44.fc19.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.9.0-301.fc19.x86_64 #1 SMP Mon
                              Apr 29 13:44:05 UTC 2013 x86_64 x86_64
Alert Count                   2
First Seen                    2013-05-15 11:49:37 EDT
Last Seen                     2013-05-15 11:49:38 EDT
Local ID                      f3019b47-cc7c-492c-b0cb-134c1ab7e1d6

Raw Audit Messages
type=AVC msg=audit(1368632978.349:768): avc:  denied  { read } for  pid=1154 comm="gdbus" path="/home/SECURITY/amy/.local/share/icc/edid-a99d98c760ecb11e07592f0536164edc.icc" dev="dm-1" ino=150234 scontext=system_u:system_r:colord_t:s0 tcontext=unconfined_u:object_r:home_root_t:s0 tclass=file


type=SYSCALL msg=audit(1368632978.349:768): arch=x86_64 syscall=recvmsg success=yes exit=EBUSY a0=a a1=7f62f7940bb0 a2=40000000 a3=0 items=0 ppid=1 pid=1154 auid=4294967295 uid=997 gid=997 euid=997 suid=997 fsuid=997 egid=997 sgid=997 fsgid=997 ses=4294967295 tty=(none) comm=gdbus exe=/usr/libexec/colord subj=system_u:system_r:colord_t:s0 key=(null)

Hash: gdbus,colord_t,home_root_t,file,read

audit2allow

#============= colord_t ==============
allow colord_t home_root_t:file read;

audit2allow -R
require {
	type colord_t;
}

#============= colord_t ==============
colord_dbus_chat(colord_t)


Additional info:
reporter:       libreport-2.1.4
hashmarkername: setroubleshoot
kernel:         3.9.0-301.fc19.x86_64
type:           libreport

Potential duplicate: bug 882343

Comment 1 Daniel Walsh 2013-05-15 17:48:27 UTC
You have a labeling problem.  Did you execute something like

# semanage fcontext -a -e /home /home/SECURITY
# restorecon -R -v /home

Comment 2 Dean Hunter 2013-08-30 17:11:48 UTC
I have this same problem when logging into an NFS server as a user whose home directory is mounted from the same server.  I noticed that the SELinux boolean use_nfs_home_dirs is set off.  I suspect that this is the immediate cause of the problem.

However, I also noticed that the home directory file labels bear no resemblance to those of a local home directory.  Is there information available on how to set the labels for NFS mounted home directories so that when NFS is enhanced to work with SELinux (in Fedora 20?) we will be ready?

Comment 3 Daniel Walsh 2013-08-30 17:24:47 UTC
I think we will be discovering this together.  How are the labels different?

Comment 4 Dean Hunter 2013-08-30 18:04:37 UTC
For the case of this error:

[root@host ~]# ls -lZ /home/local/.local/share/icc
-rw-rw-r--. local local unconfined_u:object_r:icc_data_home_t:s0 edid-b6c33574ee9f79890208c5c599c274b4.icc

[root@host ~]# ls -lZ /home/net/dean/.local/share/icc
-rw-rw-r--. dean dean system_u:object_r:home_root_t:s0 edid-a99d98c760ecb11e07592f0536164edc.icc
-rw-rw-r--. dean dean system_u:object_r:user_home_t:s0 edid-b6c33574ee9f79890208c5c599c274b4.icc

[root@host ~]#

Comment 5 Dean Hunter 2013-08-30 18:40:15 UTC
As I look at this, some of the problem may be because I did not understand, when I was first configuring the NFS home directories, that SELinux file context was not supported.  I was trying anything I could think of to get it to work.

Is there a mailing list or other forum I should be watching for the discovery of how to configure SELinux labels for NFS mounted home directories?

Comment 6 Daniel Walsh 2013-08-30 20:13:06 UTC
# semanage fcontext -a -e /home /home/net
# restorecon -R -v /home/net

Should fix the local labels.

Comment 7 Dean Hunter 2014-05-26 23:07:04 UTC
The solution is actually:

# semanage fcontext --add --equal /home /srv/nfs/home
# restorecon -Rv /srv/nfs/home

Comment 8 Miroslav Grepl 2014-05-30 12:50:32 UTC
*** Bug 1099691 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.