AVC from gnome 'eject'

[Tom London]

On 3/4/07, Tom London <selinux at gmail.com> wrote:
> Running latest Rawhide, targeted/enforcing.
>
> Trying to unmount/eject CD by right-clicking on its icon and selecting
> 'eject' does the unmount, but fails to eject (produces an error
> popup).
>
> Found this in /var/log/audit/audit.log:
>
> type=AVC msg=audit(1173069472.190:85): avc:  denied  { setexec } for
> pid=10486 comm="userhelper" scontext=system_u:system_r:hald_t:s0
> tcontext=system_u:system_r:hald_t:s0 tclass=process
> type=SYSCALL msg=audit(1173069472.190:85): arch=40000003 syscall=4
> success=no exit=-13 a0=4 a1=8cefa48 a2=1c a3=43469be9 items=0
> ppid=10485 pid=10486 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=(none) comm="userhelper"
> exe="/usr/sbin/userhelper" subj=system_u:system_r:hald_t:s0 key=(null)
>
Running this with enforcing=0 (and with today's hal update), I get:

type=AVC msg=audit(1173105610.525:31): avc:  denied  { write } for
pid=4022 comm="userhelper" name="eject" dev=dm-0 ino=11075786
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:etc_t:s0 tclass=file
type=SYSCALL msg=audit(1173105610.525:31): arch=40000003 syscall=5
success=yes exit=3 a0=8140240 a1=2 a2=bfc60de4 a3=0 items=0 ppid=4021
pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="userhelper" exe="/usr/sbin/userhelper"
subj=system_u:system_r:hald_t:s0 key=(null)
type=USER_AUTH msg=audit(1173105610.525:32): user pid=4022 uid=0
auid=4294967295 subj=system_u:system_r:hald_t:s0 msg='PAM:
authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?,
addr=?, terminal=? res=success)'
type=USER_ACCT msg=audit(1173105610.525:33): user pid=4022 uid=0
auid=4294967295 subj=system_u:system_r:hald_t:s0 msg='PAM: accounting
acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=?
res=success)'
type=AVC msg=audit(1173105610.525:34): avc:  denied  { setexec } for
pid=4022 comm="userhelper" scontext=system_u:system_r:hald_t:s0
tcontext=system_u:system_r:hald_t:s0 tclass=process
type=SYSCALL msg=audit(1173105610.525:34): arch=40000003 syscall=4
success=yes exit=34 a0=4 a1=81402a8 a2=22 a3=43469be9 items=0
ppid=4021 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) comm="userhelper"
exe="/usr/sbin/userhelper" subj=system_u:system_r:hald_t:s0 key=(null)
type=AVC msg=audit(1173105610.525:35): avc:  denied  { transition }
for  pid=4022 comm="userhelper" name="eject" dev=dm-0 ino=5481827
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:system_r:unconfined_t:s0 tclass=process
type=AVC msg=audit(1173105610.525:35): avc:  denied  { siginh } for
pid=4022 comm="eject" scontext=system_u:system_r:hald_t:s0
tcontext=system_u:system_r:unconfined_t:s0 tclass=process
type=AVC msg=audit(1173105610.525:35): avc:  denied  { rlimitinh } for
 pid=4022 comm="eject" scontext=system_u:system_r:hald_t:s0
tcontext=system_u:system_r:unconfined_t:s0 tclass=process
type=AVC msg=audit(1173105610.525:35): avc:  denied  { noatsecure }
for  pid=4022 comm="eject" scontext=system_u:system_r:hald_t:s0
tcontext=system_u:system_r:unconfined_t:s0 tclass=process
type=SYSCALL msg=audit(1173105610.525:35): arch=40000003 syscall=11
success=yes exit=0 a0=8141180 a1=bfc61090 a2=81411d0 a3=2 items=0
ppid=4021 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) comm="eject" exe="/usr/sbin/eject"
subj=system_u:system_r:unconfined_t:s0 key=(null)
type=AVC_PATH msg=audit(1173105610.525:35):  path="/usr/sbin/eject"


-- 
Tom London