<div class="gmail_quote">On Mon, Jun 22, 2009 at 3:48 PM, Daniel J Walsh <span dir="ltr"><<a href="mailto:dwalsh@redhat.com">dwalsh@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div><div></div><div class="h5">On 06/20/2009 01:50 PM, Steven Stern wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On 06/20/2009 06:12 AM, Daniel J Walsh wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On 06/19/2009 07:10 PM, Steven Stern wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
After installing hplip-gui, I got selinux errors when checking on the<br>
printer status.<br>
<br>
audit2allow generated the following policy<br>
<br>
module cups20090619 1.0;<br>
<br>
require {<br>
type hwdata_t;<br>
type xdm_t;<br>
class dir search;<br>
class file { read getattr open };<br>
}<br>
<br>
#============= xdm_t ==============<br>
allow xdm_t hwdata_t:dir search;<br>
allow xdm_t hwdata_t:file { read getattr open };<br>
<br>
<br>
</blockquote>
xdm is checking the printer status? This allow rule indicates the X<br>
Login program is checking the printer status. Could you attach the AVC's<br>
you used to generate this policy.<br>
<br>
</blockquote>
<br>
And here's another one related to hplip<br>
<br>
type=AVC msg=audit(1245520061.974:38037): avc: denied { read } for<br>
pid=25561 comm="python" name="mls" dev=selinuxfs ino=12<br>
scontext=system_u:system_r:hplip_t:s0<br>
tcontext=system_u:object_r:security_t:s0 tclass=file<br>
<br>
type=AVC msg=audit(1245520061.974:38037): avc: denied { read open } for<br>
pid=25561 comm="python" name="mls" dev=selinuxfs ino=12<br>
scontext=system_u:system_r:hplip_t:s0<br>
tcontext=system_u:object_r:security_t:s0 tclass=file<br>
<br>
<br>
<br>
</blockquote></div></div>
Could you report this as a bug to cups. Cups has some MLS aware ness in it and maybe it is reading this file directly rather then through libselinux. CC me on the bug report <a href="mailto:dwalsh@redhat.com" target="_blank">dwalsh@redhat.com</a><div>
<div></div><br></div></blockquote></div><br>Just a "me too" here. I've got two separate issues, one has to do with this thread. Just after installing F11 everything seemed fine. I poked the necessary holes in my firewall and shared my printer queues and my wife could print from her F10 laptop. Now it seems just about every job gets "stuck" and I see the AVC denials about python. Here's the details for mine (just in case anything is different:<br>
<br>---<br>Summary:<br><br>SELinux is preventing python (hplip_t) "read" security_t.<br><br>Detailed Description:<br><br>[SELinux is in permissive mode, the operation would have been denied but was<br>permitted due to permissive mode.]<br>
<br>SELinux denied access requested by python. It is not expected that this access<br>is required by python and this access may signal an intrusion attempt. It is<br>also possible that the specific version or configuration of the application is<br>
causing it to require additional access.<br><br>Allowing Access:<br><br>You can generate a local policy module to allow this access - see FAQ<br>(<a href="http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385">http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385</a>) Or you can disable<br>
SELinux protection altogether. Disabling SELinux protection is not recommended.<br>Please file a bug report (<a href="http://bugzilla.redhat.com/bugzilla/enter_bug.cgi">http://bugzilla.redhat.com/bugzilla/enter_bug.cgi</a>)<br>
against this package.<br><br>Additional Information:<br><br>Source Context system_u:system_r:hplip_t:s0<br>Target Context system_u:object_r:security_t:s0<br>Target Objects mls [ file ]<br>
Source python<br>Source Path /usr/bin/python<br>Port <Unknown><br>Host hobbes.localdomain<br>Source RPM Packages python-2.6-9.fc11<br>
Target RPM Packages <br>Policy RPM selinux-policy-3.6.12-50.fc11<br>Selinux Enabled True<br>Policy Type targeted<br>MLS Enabled True<br>Enforcing Mode Permissive<br>
Plugin Name catchall<br>Host Name hobbes.localdomain<br>Platform Linux hobbes.localdomain 2.6.29.4-167.fc11.x86_64<br> #1 SMP Wed May 27 17:27:08 EDT 2009 x86_64 x86_64<br>
Alert Count 16<br>First Seen Sun 21 Jun 2009 02:29:26 PM CDT<br>Last Seen Tue 23 Jun 2009 06:58:21 PM CDT<br>Local ID 0a0b19ce-a912-4305-9e4a-1e1369ea4f3f<br>
Line Numbers <br><br>Raw Audit Messages <br><br>node=hobbes.localdomain type=AVC msg=audit(1245801501.788:374): avc: denied { read } for pid=11771 comm="python" name="mls" dev=selinuxfs ino=12 scontext=system_u:system_r:hplip_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=file<br>
<br>node=hobbes.localdomain type=AVC msg=audit(1245801501.788:374): avc: denied { open } for pid=11771 comm="python" name="mls" dev=selinuxfs ino=12 scontext=system_u:system_r:hplip_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=file<br>
<br>node=hobbes.localdomain type=SYSCALL msg=audit(1245801501.788:374): arch=c000003e syscall=2 success=yes exit=6 a0=7fffb58ba060 a1=0 a2=7fffb58ba06c a3=fffffff8 items=0 ppid=11764 pid=11771 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="python" exe="/usr/bin/python" subj=system_u:system_r:hplip_t:s0 key=(null)<br>
---<br><br>Thanks,<br>Richard<br>