SELinux is preventing gdm-binary (xdm_t) "unlink" to ... and npviewer
Antonio Olivares
olivares14031 at yahoo.com
Fri Nov 14 00:36:00 UTC 2008
Dear selinux experts,
running fedora 10 preview updated to latest packages
[olivares at riohigh2 ~]$ uname -r
2.6.27.5-101.fc10.i686
[olivares at riohigh2 ~]$ rpm -qa selinux*
selinux-policy-3.5.13-18.fc10.noarch
selinux-policy-targeted-3.5.13-18.fc10.noarch
Summary:
SELinux is preventing gdm-binary (xdm_t) "unlink" to
./force-display-on-active-vt (var_spool_t).
Detailed Description:
SELinux is preventing gdm-binary (xdm_t) "unlink" to
./force-display-on-active-vt (var_spool_t). The SELinux type var_spool_t, is a
generic type for all files in the directory and very few processes (SELinux
Domains) are allowed to write to this SELinux type. This type of denial usual
indicates a mislabeled file. By default a file created in a directory has the
gets the context of the parent directory, but SELinux policy has rules about the
creation of directories, that say if a process running in one SELinux Domain
(D1) creates a file in a directory with a particular SELinux File Context (F1)
the file gets a different File Context (F2). The policy usually allows the
SELinux Domain (D1) the ability to write, unlink, and append on (F2). But if for
some reason a file (./force-display-on-active-vt) was created with the wrong
context, this domain will be denied. The usual solution to this problem is to
reset the file context on the target file, restorecon -v
'./force-display-on-active-vt'. If the file context does not change from
var_spool_t, then this is probably a bug in policy. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy
package. If it does change, you can try your application again to see if it
works. The file context could have been mislabeled by editing the file or moving
the file from a different directory, if the file keeps getting mislabeled, check
the init scripts to see if they are doing something to mislabel the file.
Allowing Access:
You can attempt to fix file context by executing restorecon -v
'./force-display-on-active-vt'
Fix Command:
restorecon './force-display-on-active-vt'
Additional Information:
Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context system_u:object_r:var_spool_t:s0
Target Objects ./force-display-on-active-vt [ file ]
Source gdm-binary
Source Path /usr/sbin/gdm-binary
Port <Unknown>
Host riohigh2
Source RPM Packages gdm-2.24.0-12.fc10
Target RPM Packages
Policy RPM selinux-policy-3.5.13-18.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name mislabeled_file
Host Name riohigh2
Platform Linux riohigh2 2.6.27.5-94.fc10.i686 #1 SMP Mon
Nov 10 15:51:55 EST 2008 i686 athlon
Alert Count 17
First Seen Mon 03 Nov 2008 07:08:33 AM CST
Last Seen Thu 13 Nov 2008 04:21:21 PM CST
Local ID a66adf6c-89d5-4d90-83ca-f34c94bb4d45
Line Numbers
Raw Audit Messages
node=riohigh2 type=AVC msg=audit(1226614881.881:36): avc: denied { unlink } for pid=2090 comm="gdm-binary" name="force-display-on-active-vt" dev=sda6 ino=190494 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
node=riohigh2 type=SYSCALL msg=audit(1226614881.881:36): arch=40000003 syscall=10 success=no exit=-13 a0=8063b84 a1=0 a2=4f86dc a3=9940400 items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdm-binary" exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
Summary:
SELinux is preventing the npviewer.bin from using potentially mislabeled files
(/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer).
Detailed Description:
SELinux has denied npviewer.bin access to potentially mislabeled file(s)
(/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer). This means that
SELinux will not allow npviewer.bin to use these files. It is common for users
to edit files in their home directory or tmp directories and then move (mv) them
to system directories. The problem is that the files end up with the wrong file
context which confined applications are not allowed to access.
Allowing Access:
If you want npviewer.bin to access this files, you need to relabel them using
restorecon -v '/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer'.
You might want to relabel the entire directory using restorecon -R -v '<Unknown>'.
Additional Information:
Source Context unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102
3
Target Context unconfined_u:object_r:user_home_t:s0
Target Objects /home/olivares/.icedteaplugin/icedtea-plugin-to-
appletviewer [ fifo_file ]
Source npviewer.bin
Source Path /usr/lib/nspluginwrapper/npviewer.bin
Port <Unknown>
Host riohigh2
Source RPM Packages nspluginwrapper-1.1.2-4.fc10
Target RPM Packages
Policy RPM selinux-policy-3.5.13-18.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name home_tmp_bad_labels
Host Name riohigh2
Platform Linux riohigh2 2.6.27.5-101.fc10.i686 #1 SMP Wed
Nov 12 00:50:43 EST 2008 i686 athlon
Alert Count 4
First Seen Thu 13 Nov 2008 06:31:50 PM CST
Last Seen Thu 13 Nov 2008 06:31:55 PM CST
Local ID 81d406be-b7e4-4bf4-a8c7-f12b7c36ee27
Line Numbers
Raw Audit Messages
node=riohigh2 type=AVC msg=audit(1226622715.909:38): avc: denied { write } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=sda6 ino=263881 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
node=riohigh2 type=AVC msg=audit(1226622715.909:38): avc: denied { read } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=sda6 ino=263847 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
node=riohigh2 type=SYSCALL msg=audit(1226622715.909:38): arch=40000003 syscall=11 success=yes exit=0 a0=9e70d28 a1=9e71d40 a2=9e72210 a3=0 items=0 ppid=3572 pid=4732 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
Has someone else encountered these before and what should I do about them?
Thanks,
Antonio
More information about the fedora-selinux-list
mailing list