Bug 975853 - SELinux is preventing /usr/bin/pkla-check-authorization from 'getattr' accesses on the filesystem /.
SELinux is preventing /usr/bin/pkla-check-authorization from 'getattr' access...
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
19
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
abrt_hash:1472cde562e1bfa621f8a8fb26c...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-06-19 09:16 EDT by Jagabandhu Paul
Modified: 2013-06-23 02:27 EDT (History)
4 users (show)

See Also:
Fixed In Version: selinux-policy-3.12.1-54.fc19
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-06-23 02:27:50 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jagabandhu Paul 2013-06-19 09:16:05 EDT
Description of problem:
SELinux is preventing /usr/bin/pkla-check-authorization from 'getattr' accesses on the filesystem /.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that pkla-check-authorization should be allowed getattr access on the  filesystem by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep pkla-check-auth /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:policykit_t:s0
Target Context                system_u:object_r:fs_t:s0
Target Objects                / [ filesystem ]
Source                        pkla-check-auth
Source Path                   /usr/bin/pkla-check-authorization
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           polkit-pkla-compat-0.1-2.fc19.x86_64
Target RPM Packages           filesystem-3.1-2.fc18.x86_64
                              filesystem-3.2-10.fc19.x86_64
Policy RPM                    selinux-policy-3.11.1-97.fc18.noarch selinux-
                              policy-3.12.1-52.fc19.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.9.5-201.fc18.x86_64 #1 SMP Tue
                              Jun 11 19:40:51 UTC 2013 x86_64 x86_64
Alert Count                   187
First Seen                    2013-06-19 18:43:58 IST
Last Seen                     2013-06-19 18:45:18 IST
Local ID                      dfd30cae-bc43-467f-be7c-a43945f51025

Raw Audit Messages
type=AVC msg=audit(1371647718.311:623): avc:  denied  { getattr } for  pid=17273 comm="pkla-check-auth" name="/" dev="dm-1" ino=2 scontext=system_u:system_r:policykit_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem


type=SYSCALL msg=audit(1371647718.311:623): arch=x86_64 syscall=statfs success=no exit=EACCES a0=7f42d31185d0 a1=7fff2b1d85b0 a2=7f42d3108f20 a3=7fff2b1d8370 items=0 ppid=655 pid=17273 auid=4294967295 uid=999 gid=999 euid=999 suid=999 fsuid=999 egid=999 sgid=999 fsgid=999 ses=4294967295 tty=(none) comm=pkla-check-auth exe=/usr/bin/pkla-check-authorization subj=system_u:system_r:policykit_t:s0 key=(null)

Hash: pkla-check-auth,policykit_t,fs_t,filesystem,getattr

audit2allow

#============= policykit_t ==============
allow policykit_t fs_t:filesystem getattr;

audit2allow -R
require {
	type policykit_t;
}

#============= policykit_t ==============
fs_getattr_xattr_fs(policykit_t)


Additional info:
reporter:       libreport-2.1.5
hashmarkername: setroubleshoot
kernel:         3.9.5-201.fc18.x86_64
type:           libreport
Comment 1 Daniel Walsh 2013-06-19 16:00:53 EDT
If you execute 

chcon -t policykit_auth_exec_t /usr/bin/pkla-check-authorization 

Does it work fine?
Comment 2 Daniel Walsh 2013-06-19 16:08:45 EDT
cf7a5e03ac6cbb7426db9915d7bfe64274d77627 adds this label in git.
Comment 3 Fedora Update System 2013-06-19 17:32:22 EDT
selinux-policy-3.12.1-54.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-54.fc19
Comment 4 Fedora Update System 2013-06-20 14:02:45 EDT
Package selinux-policy-3.12.1-54.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-54.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-11355/selinux-policy-3.12.1-54.fc19
then log in and leave karma (feedback).
Comment 5 Maxim 2013-06-22 19:35:13 EDT
Description of problem:
upgrade to fedora 19

Additional info:
reporter:       libreport-2.1.5
hashmarkername: setroubleshoot
kernel:         3.9.6-200.fc18.x86_64
type:           libreport
Comment 6 Fedora Update System 2013-06-23 02:27:50 EDT
selinux-policy-3.12.1-54.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.