SELinux is preventing /usr/libexec/colord from getattr access on the file /usr/local/Brother/sane/models3/ext4.ini.

[Clyde E. Kunkel]

On 06/07/2011 09:47 AM, Lawrence E Graves wrote:
> SELinux is preventing /usr/libexec/colord from getattr access on the file /usr/local/Brother/sane/models3/ext4.ini.
>
> *****  Plugin catchall (100. confidence) suggests  ***************************
>
> If you believe that colord should be allowed getattr access on the ext4.ini file by default.
> Then you should report this as a bug.
> You can generate a local policy module to allow this access.
> Do
> allow this access for now by executing:
> # grep colord /var/log/audit/audit.log | audit2allow -M mypol
> # semodule -i mypol.pp
>
> Additional Information:
> Source Context                system_u:system_r:colord_t:s0-s0:c0.c1023
> Target Context                system_u:object_r:bin_t:s0
> Target Objects                /usr/local/Brother/sane/models3/ext4.ini [ file ]
> Source                        colord
> Source Path                   /usr/libexec/colord
> Port<Unknown>
> Host                          Jehovah.localdomain
> Source RPM Packages           colord-0.1.7-1.fc15
> Target RPM Packages           brscan3-0.2.11-4
> Policy RPM                    selinux-policy-3.9.16-26.fc15
> Selinux Enabled               True
> Policy Type                   targeted
> Enforcing Mode                Enforcing
> Host Name                     Jehovah.localdomain
> Platform                      Linux Jehovah.localdomain 2.6.38.7-30.fc15.x86_64
>                                #1 SMP Fri May 27 05:15:53 UTC 2011 x86_64 x86_64
> Alert Count                   5
> First Seen                    Mon 06 Jun 2011 06:40:50 AM MDT
> Last Seen                     Tue 07 Jun 2011 05:20:41 AM MDT
> Local ID                      5284eedd-a207-486b-a7d9-09af2e567072
>
> Raw Audit Messages
> type=AVC msg=audit(1307445641.672:26): avc:  denied  { getattr } for  pid=1136 comm="colord" path="/usr/local/Brother/sane/models3/ext4.ini" dev=dm-1 ino=1325526 scontext=system_u:system_r:colord_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file
>
>
> type=SYSCALL msg=audit(1307445641.672:26): arch=x86_64 syscall=fstat success=yes exit=0 a0=12 a1=7fffa928d6a0 a2=7fffa928d6a0 a3=7fffa928d5a0 items=0 ppid=1 pid=1136 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=colord exe=/usr/libexec/colord subj=system_u:system_r:colord_t:s0-s0:c0.c1023 key=(null)
>
> Hash: colord,colord_t,bin_t,file,getattr
>
> audit2allow
>
> #============= colord_t ==============
> allow colord_t bin_t:file getattr;
>
> audit2allow -R
>
> #============= colord_t ==============
> allow colord_t bin_t:file getattr;
>
>

colord is required by both cups (print server) and foomatic (printer 
databases).  It looks like you are using selinux in enforcing mode which 
is preventing your printing due to the denial above (best guess on my part).

Turn off selinux and try it.  I told you how to do that offlist.  If 
that doesn't work, please note in Dan's response that there is bug for 
this open.  You might just need to wait for the fix to hit F15 
updates-testing.  (sudo yum --enablerepo=updates-testing update).

If that doesn't work, follow Dan's advice and open a bugzilla for the 
problem.  Open against cups for now and the triagers will get it to the 
right place.  Include this selinux denial.

There is nothing else I can do to help you.  Good luck.

-- 
Regards,
OldFart