Bug 986616 - SELinux is preventing wicd from 'setattr' accesses on the file /etc/wicd/dhclient.conf.template.
SELinux is preventing wicd from 'setattr' accesses on the file /etc/wicd/dhcl...
Status: CLOSED WORKSFORME
Product: Fedora
Classification: Fedora
Component: wicd (Show other bugs)
19
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: David Cantrell
Fedora Extras Quality Assurance
abrt_hash:9c59144983cad0aa6137e26ba30...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-07-20 21:49 EDT by prestontunnellwilson
Modified: 2013-07-29 19:59 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-07-29 19:59:29 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description prestontunnellwilson 2013-07-20 21:49:34 EDT
Description of problem:
My computer hibernated (from my command) then the notifications began.
SELinux is preventing wicd from 'setattr' accesses on the file /etc/wicd/dhclient.conf.template.

*****  Plugin catchall_labels (83.8 confidence) suggests  ********************

If you want to allow wicd to have setattr access on the dhclient.conf.template file
Then you need to change the label on /etc/wicd/dhclient.conf.template
Do
# semanage fcontext -a -t FILE_TYPE '/etc/wicd/dhclient.conf.template'
where FILE_TYPE is one of the following: NetworkManager_etc_rw_t, NetworkManager_log_t, NetworkManager_tmp_t, NetworkManager_var_lib_t, NetworkManager_var_run_t, named_cache_t, net_conf_t, pppd_var_run_t, systemd_passwd_var_run_t. 
Then execute: 
restorecon -v '/etc/wicd/dhclient.conf.template'


*****  Plugin catchall (17.1 confidence) suggests  ***************************

If you believe that wicd should be allowed setattr access on the dhclient.conf.template file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep wicd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:NetworkManager_t:s0
Target Context                system_u:object_r:etc_t:s0
Target Objects                /etc/wicd/dhclient.conf.template [ file ]
Source                        wicd
Source Path                   wicd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           python-2.7.5-3.fc19.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-65.fc19.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.9.9-302.fc19.x86_64 #1 SMP Sat
                              Jul 6 13:41:07 UTC 2013 x86_64 x86_64
Alert Count                   2
First Seen                    2013-07-20 20:41:24 CDT
Last Seen                     2013-07-20 20:42:08 CDT
Local ID                      3f4c8be5-4aed-42d0-a505-034426e00365

Raw Audit Messages
type=AVC msg=audit(1374370928.606:406): avc:  denied  { setattr } for  pid=1584 comm="wicd" name="dhclient.conf.template" dev="dm-1" ino=264547 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file


type=SYSCALL msg=audit(1374370928.606:406): arch=x86_64 syscall=chmod success=no exit=EACCES a0=161adc0 a1=1a4 a2=32f7dbbf88 a3=0 items=0 ppid=1 pid=1584 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=wicd exe=/usr/bin/python2.7 subj=system_u:system_r:NetworkManager_t:s0 key=(null)

Hash: wicd,NetworkManager_t,etc_t,file,setattr

Additional info:
reporter:       libreport-2.1.5
hashmarkername: setroubleshoot
kernel:         3.9.9-302.fc19.x86_64
type:           libreport

Potential duplicate: bug 809737
Comment 1 Daniel Walsh 2013-07-21 07:30:26 EDT
Why is wicd modifying its configuration data?
Comment 2 prestontunnellwilson 2013-07-22 18:38:33 EDT
(In reply to Daniel Walsh from comment #1)
> Why is wicd modifying its configuration data?

I am not sure. I attributed it to the fact that I hibernated my computer, though that seems like an unlikely factor. However, this is the only time that this has happened. I tried to allow a temporary fix as mentioned by the bug reporter ( sudo grep python /var/log/audit/audit.log | audit2allow -M mypol), but I got the error that "audit2allow" is not recognized. I think that this is a very localized error due to user malfunction.
Comment 3 Daniel Walsh 2013-07-24 18:20:23 EDT
You can install policycoreutils-devel to get audit2allow, but I would not add that rule at all.  It should not be necessary.
Comment 4 prestontunnellwilson 2013-07-29 19:50:46 EDT
Thank you. This bug has not happened since. wicd is working properly, and the circumstance is so strange in which it happend that I don't think it will occur again.

Note You need to log in before you can comment on or make changes to this bug.