Bug 984168 - SELinux is preventing /usr/sbin/ladvd from 'execute' accesses on the file /usr/bin/lsb_release.
Summary: SELinux is preventing /usr/sbin/ladvd from 'execute' accesses on the file /us...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: ladvd
Version: 18
Hardware: i686
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Andreas Thienemann
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:342ccbded0076b05efdf6fff1b4...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-07-13 07:52 UTC by vikram goyal
Modified: 2013-10-01 02:04 UTC (History)
6 users (show)

Fixed In Version: ladvd-1.0.4-4.fc18
Clone Of:
Environment:
Last Closed: 2013-10-01 02:04:51 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description vikram goyal 2013-07-13 07:52:29 UTC
Description of problem:
I don't know what this alert means. Mine is a simple dsl setup.
SELinux is preventing /usr/sbin/ladvd from 'execute' accesses on the file /usr/bin/lsb_release.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that ladvd should be allowed execute access on the lsb_release file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep ladvd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:ladvd_t:s0
Target Context                system_u:object_r:bin_t:s0
Target Objects                /usr/bin/lsb_release [ file ]
Source                        ladvd
Source Path                   /usr/sbin/ladvd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           ladvd-1.0.4-3.fc18.i686
Target RPM Packages           redhat-lsb-core-4.1-10.fc18.i686
Policy RPM                    selinux-policy-3.11.1-97.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.9.9-201.fc18.i686 #1 SMP Fri Jul
                              5 17:42:49 UTC 2013 i686 i686
Alert Count                   1
First Seen                    2013-07-13 18:34:31 IST
Last Seen                     2013-07-13 18:34:31 IST
Local ID                      739f23b6-81f5-4086-88ce-8586c3033b86

Raw Audit Messages
type=AVC msg=audit(1373720671.195:28): avc:  denied  { execute } for  pid=632 comm="ladvd" name="lsb_release" dev="sda3" ino=1111462 scontext=system_u:system_r:ladvd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file


type=SYSCALL msg=audit(1373720671.195:28): arch=i386 syscall=execve success=no exit=EACCES a0=bff82949 a1=bff82a34 a2=b93dd068 a3=b93dd0fe items=0 ppid=565 pid=632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=ladvd exe=/usr/sbin/ladvd subj=system_u:system_r:ladvd_t:s0 key=(null)

Hash: ladvd,ladvd_t,bin_t,file,execute

audit2allow

#============= ladvd_t ==============
allow ladvd_t bin_t:file execute;

audit2allow -R
require {
	type ladvd_t;
}

#============= ladvd_t ==============
corecmd_sbin_entry_type(ladvd_t)


Additional info:
reporter:       libreport-2.1.5
hashmarkername: setroubleshoot
kernel:         3.9.9-201.fc18.i686
type:           libreport

Comment 1 Miroslav Grepl 2013-07-16 09:01:16 UTC
Where does ladvd policy come from? Did you add this policy?

Comment 2 vikram goyal 2013-09-02 15:55:05 UTC
This comes with F18 default repos only. I just installed it.
Please see:

ladvd.i686                       1.0.4-3.fc18       @updates                    
ladvd-selinux.i686               1.0.4-3.fc18       @updates

Also I just created a local policy from selinux messages. It may help you diagnose. Please ignore the extraneous info which I was not able to remove. Thanks...

module mypol 1.0;

require {
        type net_conf_t;
        type chrome_sandbox_t;
        type tor_socks_port_t;
        type user_home_dir_t;
        type ladvd_t;
        type sysfs_t;
        type var_lock_t;
        type bin_t;
        type apcupsd_t;
        type sysctl_net_t;
        type polipo_t;
        type var_run_t;
        class process { signal setcap };
        class capability { net_admin setpcap };
        class tcp_socket name_connect;
        class file { read create open execute };
        class sock_file create;
        class udp_socket connect;
}

#============= apcupsd_t ==============
allow apcupsd_t var_lock_t:file read;

#============= chrome_sandbox_t ==============
allow chrome_sandbox_t user_home_dir_t:file create;

#============= ladvd_t ==============
allow ladvd_t bin_t:file execute;
allow ladvd_t net_conf_t:file open;
allow ladvd_t self:capability { net_admin setpcap };
allow ladvd_t self:process { signal setcap };
allow ladvd_t self:udp_socket connect;
allow ladvd_t sysctl_net_t:file open;
allow ladvd_t sysfs_t:file open;
allow ladvd_t var_run_t:sock_file create;

#============= polipo_t ==============
#!!!! This avc is allowed in the current policy

allow polipo_t tor_socks_port_t:tcp_socket name_connect;

Comment 3 Fedora Update System 2013-09-17 09:04:13 UTC
ladvd-1.0.4-4.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/ladvd-1.0.4-4.fc18

Comment 4 Fedora Update System 2013-09-18 13:01:26 UTC
Package ladvd-1.0.4-4.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing ladvd-1.0.4-4.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-17005/ladvd-1.0.4-4.fc18
then log in and leave karma (feedback).

Comment 5 Fedora Update System 2013-10-01 02:04:51 UTC
ladvd-1.0.4-4.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.