First Last Prev Next    This bug is not in your last search results.
Bug 963318 - SELinux is preventing /usr/libexec/colord from 'read' accesses on the file /home/SECURITY/amy/.local/share/icc/edid-a99d98c760ecb11e07592f0536164edc.icc.
SELinux is preventing /usr/libexec/colord from 'read' accesses on the file /h...
Status: CLOSED NOTABUG
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
19
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
abrt_hash:48e53508c1185c43be4be978b5c...
:
: 1099691 (view as bug list)
Depends On:
Blocks:
  Show dependency tree / graph
 
Reported: 2013-05-15 11:56 EDT by David Spurek
Modified: 2015-03-02 00:27 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-05-16 02:13:46 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

  None (edit)
Description David Spurek 2013-05-15 11:56:31 EDT 
Description of problem:
GDM login with Active directory account cause this avc message
SELinux is preventing /usr/libexec/colord from 'read' accesses on the file /home/SECURITY/amy/.local/share/icc/edid-a99d98c760ecb11e07592f0536164edc.icc.

*****  Plugin restorecon (99.5 confidence) suggests  *************************

If you want to fix the label. 
/home/SECURITY/amy/.local/share/icc/edid-a99d98c760ecb11e07592f0536164edc.icc default label should be user_home_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /home/SECURITY/amy/.local/share/icc/edid-a99d98c760ecb11e07592f0536164edc.icc

*****  Plugin catchall (1.49 confidence) suggests  ***************************

If you believe that colord should be allowed read access on the edid-a99d98c760ecb11e07592f0536164edc.icc file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep gdbus /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:colord_t:s0
Target Context                unconfined_u:object_r:home_root_t:s0
Target Objects                /home/SECURITY/amy/.local/share/icc/edid-
                              a99d98c760ecb11e07592f0536164edc.icc [ file ]
Source                        gdbus
Source Path                   /usr/libexec/colord
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           colord-0.1.34-1.fc19.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-44.fc19.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.9.0-301.fc19.x86_64 #1 SMP Mon
                              Apr 29 13:44:05 UTC 2013 x86_64 x86_64
Alert Count                   2
First Seen                    2013-05-15 11:49:37 EDT
Last Seen                     2013-05-15 11:49:38 EDT
Local ID                      f3019b47-cc7c-492c-b0cb-134c1ab7e1d6

Raw Audit Messages
type=AVC msg=audit(1368632978.349:768): avc:  denied  { read } for  pid=1154 comm="gdbus" path="/home/SECURITY/amy/.local/share/icc/edid-a99d98c760ecb11e07592f0536164edc.icc" dev="dm-1" ino=150234 scontext=system_u:system_r:colord_t:s0 tcontext=unconfined_u:object_r:home_root_t:s0 tclass=file


type=SYSCALL msg=audit(1368632978.349:768): arch=x86_64 syscall=recvmsg success=yes exit=EBUSY a0=a a1=7f62f7940bb0 a2=40000000 a3=0 items=0 ppid=1 pid=1154 auid=4294967295 uid=997 gid=997 euid=997 suid=997 fsuid=997 egid=997 sgid=997 fsgid=997 ses=4294967295 tty=(none) comm=gdbus exe=/usr/libexec/colord subj=system_u:system_r:colord_t:s0 key=(null)

Hash: gdbus,colord_t,home_root_t,file,read

audit2allow

#============= colord_t ==============
allow colord_t home_root_t:file read;

audit2allow -R
require {
	type colord_t;
}

#============= colord_t ==============
colord_dbus_chat(colord_t)


Additional info:
reporter:       libreport-2.1.4
hashmarkername: setroubleshoot
kernel:         3.9.0-301.fc19.x86_64
type:           libreport

Potential duplicate: bug 882343
Comment 1 Daniel Walsh 2013-05-15 13:48:27 EDT 
You have a labeling problem.  Did you execute something like

# semanage fcontext -a -e /home /home/SECURITY
# restorecon -R -v /home
Comment 2 Dean Hunter 2013-08-30 13:11:48 EDT 
I have this same problem when logging into an NFS server as a user whose home directory is mounted from the same server.  I noticed that the SELinux boolean use_nfs_home_dirs is set off.  I suspect that this is the immediate cause of the problem.

However, I also noticed that the home directory file labels bear no resemblance to those of a local home directory.  Is there information available on how to set the labels for NFS mounted home directories so that when NFS is enhanced to work with SELinux (in Fedora 20?) we will be ready?
Comment 3 Daniel Walsh 2013-08-30 13:24:47 EDT 
I think we will be discovering this together.  How are the labels different?
Comment 4 Dean Hunter 2013-08-30 14:04:37 EDT 
For the case of this error:

[root@host ~]# ls -lZ /home/local/.local/share/icc
-rw-rw-r--. local local unconfined_u:object_r:icc_data_home_t:s0 edid-b6c33574ee9f79890208c5c599c274b4.icc

[root@host ~]# ls -lZ /home/net/dean/.local/share/icc
-rw-rw-r--. dean dean system_u:object_r:home_root_t:s0 edid-a99d98c760ecb11e07592f0536164edc.icc
-rw-rw-r--. dean dean system_u:object_r:user_home_t:s0 edid-b6c33574ee9f79890208c5c599c274b4.icc

[root@host ~]#
Comment 5 Dean Hunter 2013-08-30 14:40:15 EDT 
As I look at this, some of the problem may be because I did not understand, when I was first configuring the NFS home directories, that SELinux file context was not supported.  I was trying anything I could think of to get it to work.

Is there a mailing list or other forum I should be watching for the discovery of how to configure SELinux labels for NFS mounted home directories?
Comment 6 Daniel Walsh 2013-08-30 16:13:06 EDT 
# semanage fcontext -a -e /home /home/net
# restorecon -R -v /home/net

Should fix the local labels.
Comment 7 Dean Hunter 2014-05-26 19:07:04 EDT 
The solution is actually:

# semanage fcontext --add --equal /home /srv/nfs/home
# restorecon -Rv /srv/nfs/home
Comment 8 Miroslav Grepl 2014-05-30 08:50:32 EDT 
*** Bug 1099691 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.