SELinux is preventing gdm-binary (xdm_t) "unlink" to ... and npviewer

Daniel J Walsh dwalsh at redhat.com
Fri Nov 14 14:12:16 UTC 2008


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Antonio Olivares wrote:
> Dear selinux experts, 
> 
> running fedora 10 preview updated to latest packages 
> 
> [olivares at riohigh2 ~]$ uname -r
> 2.6.27.5-101.fc10.i686
> [olivares at riohigh2 ~]$ rpm -qa selinux*
> selinux-policy-3.5.13-18.fc10.noarch
> selinux-policy-targeted-3.5.13-18.fc10.noarch
> 
> 
> Summary:
> 
> SELinux is preventing gdm-binary (xdm_t) "unlink" to
> ./force-display-on-active-vt (var_spool_t).
> 
> Detailed Description:
> 
> SELinux is preventing gdm-binary (xdm_t) "unlink" to
> ./force-display-on-active-vt (var_spool_t). The SELinux type var_spool_t, is a
> generic type for all files in the directory and very few processes (SELinux
> Domains) are allowed to write to this SELinux type. This type of denial usual
> indicates a mislabeled file. By default a file created in a directory has the
> gets the context of the parent directory, but SELinux policy has rules about the
> creation of directories, that say if a process running in one SELinux Domain
> (D1) creates a file in a directory with a particular SELinux File Context (F1)
> the file gets a different File Context (F2). The policy usually allows the
> SELinux Domain (D1) the ability to write, unlink, and append on (F2). But if for
> some reason a file (./force-display-on-active-vt) was created with the wrong
> context, this domain will be denied. The usual solution to this problem is to
> reset the file context on the target file, restorecon -v
> './force-display-on-active-vt'. If the file context does not change from
> var_spool_t, then this is probably a bug in policy. Please file a bug report
> (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy
> package. If it does change, you can try your application again to see if it
> works. The file context could have been mislabeled by editing the file or moving
> the file from a different directory, if the file keeps getting mislabeled, check
> the init scripts to see if they are doing something to mislabel the file.
> 
> Allowing Access:
> 
> You can attempt to fix file context by executing restorecon -v
> './force-display-on-active-vt'
> 
> Fix Command:
> 
> restorecon './force-display-on-active-vt'
> 
> Additional Information:
> 
> Source Context                system_u:system_r:xdm_t:s0-s0:c0.c1023
> Target Context                system_u:object_r:var_spool_t:s0
> Target Objects                ./force-display-on-active-vt [ file ]
> Source                        gdm-binary
> Source Path                   /usr/sbin/gdm-binary
> Port                          <Unknown>
> Host                          riohigh2
> Source RPM Packages           gdm-2.24.0-12.fc10
> Target RPM Packages           
> Policy RPM                    selinux-policy-3.5.13-18.fc10
> Selinux Enabled               True
> Policy Type                   targeted
> MLS Enabled                   True
> Enforcing Mode                Enforcing
> Plugin Name                   mislabeled_file
> Host Name                     riohigh2
> Platform                      Linux riohigh2 2.6.27.5-94.fc10.i686 #1 SMP Mon
>                               Nov 10 15:51:55 EST 2008 i686 athlon
> Alert Count                   17
> First Seen                    Mon 03 Nov 2008 07:08:33 AM CST
> Last Seen                     Thu 13 Nov 2008 04:21:21 PM CST
> Local ID                      a66adf6c-89d5-4d90-83ca-f34c94bb4d45
> Line Numbers                  
> 
> Raw Audit Messages            
> 
> node=riohigh2 type=AVC msg=audit(1226614881.881:36): avc:  denied  { unlink } for  pid=2090 comm="gdm-binary" name="force-display-on-active-vt" dev=sda6 ino=190494 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
> 
> node=riohigh2 type=SYSCALL msg=audit(1226614881.881:36): arch=40000003 syscall=10 success=no exit=-13 a0=8063b84 a1=0 a2=4f86dc a3=9940400 items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdm-binary" exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
> 
Actually this looks like a labeling problem

restorecon -R -v /var/spool/gdm

> 
> 
> 
> 
> Summary:
> 
> SELinux is preventing the npviewer.bin from using potentially mislabeled files
> (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer).
> 
> Detailed Description:
> 
> SELinux has denied npviewer.bin access to potentially mislabeled file(s)
> (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer). This means that
> SELinux will not allow npviewer.bin to use these files. It is common for users
> to edit files in their home directory or tmp directories and then move (mv) them
> to system directories. The problem is that the files end up with the wrong file
> context which confined applications are not allowed to access.
> 
> Allowing Access:
> 
> If you want npviewer.bin to access this files, you need to relabel them using
> restorecon -v '/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer'.
> You might want to relabel the entire directory using restorecon -R -v '<Unknown>'.
> 
> Additional Information:
> 
> Source Context                unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102
>                               3
> Target Context                unconfined_u:object_r:user_home_t:s0
> Target Objects                /home/olivares/.icedteaplugin/icedtea-plugin-to-
>                               appletviewer [ fifo_file ]
> Source                        npviewer.bin
> Source Path                   /usr/lib/nspluginwrapper/npviewer.bin
> Port                          <Unknown>
> Host                          riohigh2
> Source RPM Packages           nspluginwrapper-1.1.2-4.fc10
> Target RPM Packages           
> Policy RPM                    selinux-policy-3.5.13-18.fc10
> Selinux Enabled               True
> Policy Type                   targeted
> MLS Enabled                   True
> Enforcing Mode                Enforcing
> Plugin Name                   home_tmp_bad_labels
> Host Name                     riohigh2
> Platform                      Linux riohigh2 2.6.27.5-101.fc10.i686 #1 SMP Wed
>                               Nov 12 00:50:43 EST 2008 i686 athlon
> Alert Count                   4
> First Seen                    Thu 13 Nov 2008 06:31:50 PM CST
> Last Seen                     Thu 13 Nov 2008 06:31:55 PM CST
> Local ID                      81d406be-b7e4-4bf4-a8c7-f12b7c36ee27
> Line Numbers                  
> 
> Raw Audit Messages            
> 
> node=riohigh2 type=AVC msg=audit(1226622715.909:38): avc:  denied  { write } for  pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=sda6 ino=263881 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
> 
> node=riohigh2 type=AVC msg=audit(1226622715.909:38): avc:  denied  { read } for  pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=sda6 ino=263847 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
> 
> node=riohigh2 type=SYSCALL msg=audit(1226622715.909:38): arch=40000003 syscall=11 success=yes exit=0 a0=9e70d28 a1=9e71d40 a2=9e72210 a3=0 items=0 ppid=3572 pid=4732 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
> 
> 
> 
> Has someone else encountered these before and what should I do about them?
> 
> Thanks,
> 
> Antonio 
> 
> 
>       
> 
> --
> fedora-selinux-list mailing list
> fedora-selinux-list at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkkdh0AACgkQrlYvE4MpobOZ5QCdE1loj7OZLDhBVGrzJcv2PMwE
rrYAoLxAM4V9m//DbBKcUbWr5T9cI84r
=upDR
-----END PGP SIGNATURE-----




More information about the fedora-selinux-list mailing list