Dear selinux experts,
running fedora 10 preview updated to latest packages
[olivares@riohigh2 ~]$ uname -r 2.6.27.5-101.fc10.i686 [olivares@riohigh2 ~]$ rpm -qa selinux* selinux-policy-3.5.13-18.fc10.noarch selinux-policy-targeted-3.5.13-18.fc10.noarch
Summary:
SELinux is preventing gdm-binary (xdm_t) "unlink" to ./force-display-on-active-vt (var_spool_t).
Detailed Description:
SELinux is preventing gdm-binary (xdm_t) "unlink" to ./force-display-on-active-vt (var_spool_t). The SELinux type var_spool_t, is a generic type for all files in the directory and very few processes (SELinux Domains) are allowed to write to this SELinux type. This type of denial usual indicates a mislabeled file. By default a file created in a directory has the gets the context of the parent directory, but SELinux policy has rules about the creation of directories, that say if a process running in one SELinux Domain (D1) creates a file in a directory with a particular SELinux File Context (F1) the file gets a different File Context (F2). The policy usually allows the SELinux Domain (D1) the ability to write, unlink, and append on (F2). But if for some reason a file (./force-display-on-active-vt) was created with the wrong context, this domain will be denied. The usual solution to this problem is to reset the file context on the target file, restorecon -v './force-display-on-active-vt'. If the file context does not change from var_spool_t, then this is probably a bug in policy. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy package. If it does change, you can try your application again to see if it works. The file context could have been mislabeled by editing the file or moving the file from a different directory, if the file keeps getting mislabeled, check the init scripts to see if they are doing something to mislabel the file.
Allowing Access:
You can attempt to fix file context by executing restorecon -v './force-display-on-active-vt'
Fix Command:
restorecon './force-display-on-active-vt'
Additional Information:
Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:var_spool_t:s0 Target Objects ./force-display-on-active-vt [ file ] Source gdm-binary Source Path /usr/sbin/gdm-binary Port <Unknown> Host riohigh2 Source RPM Packages gdm-2.24.0-12.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name mislabeled_file Host Name riohigh2 Platform Linux riohigh2 2.6.27.5-94.fc10.i686 #1 SMP Mon Nov 10 15:51:55 EST 2008 i686 athlon Alert Count 17 First Seen Mon 03 Nov 2008 07:08:33 AM CST Last Seen Thu 13 Nov 2008 04:21:21 PM CST Local ID a66adf6c-89d5-4d90-83ca-f34c94bb4d45 Line Numbers
Raw Audit Messages
node=riohigh2 type=AVC msg=audit(1226614881.881:36): avc: denied { unlink } for pid=2090 comm="gdm-binary" name="force-display-on-active-vt" dev=sda6 ino=190494 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
node=riohigh2 type=SYSCALL msg=audit(1226614881.881:36): arch=40000003 syscall=10 success=no exit=-13 a0=8063b84 a1=0 a2=4f86dc a3=9940400 items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdm-binary" exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
Summary:
SELinux is preventing the npviewer.bin from using potentially mislabeled files (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer).
Detailed Description:
SELinux has denied npviewer.bin access to potentially mislabeled file(s) (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer). This means that SELinux will not allow npviewer.bin to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access.
Allowing Access:
If you want npviewer.bin to access this files, you need to relabel them using restorecon -v '/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer'. You might want to relabel the entire directory using restorecon -R -v '<Unknown>'.
Additional Information:
Source Context unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102 3 Target Context unconfined_u:object_r:user_home_t:s0 Target Objects /home/olivares/.icedteaplugin/icedtea-plugin-to- appletviewer [ fifo_file ] Source npviewer.bin Source Path /usr/lib/nspluginwrapper/npviewer.bin Port <Unknown> Host riohigh2 Source RPM Packages nspluginwrapper-1.1.2-4.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name home_tmp_bad_labels Host Name riohigh2 Platform Linux riohigh2 2.6.27.5-101.fc10.i686 #1 SMP Wed Nov 12 00:50:43 EST 2008 i686 athlon Alert Count 4 First Seen Thu 13 Nov 2008 06:31:50 PM CST Last Seen Thu 13 Nov 2008 06:31:55 PM CST Local ID 81d406be-b7e4-4bf4-a8c7-f12b7c36ee27 Line Numbers
Raw Audit Messages
node=riohigh2 type=AVC msg=audit(1226622715.909:38): avc: denied { write } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=sda6 ino=263881 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
node=riohigh2 type=AVC msg=audit(1226622715.909:38): avc: denied { read } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=sda6 ino=263847 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
node=riohigh2 type=SYSCALL msg=audit(1226622715.909:38): arch=40000003 syscall=11 success=yes exit=0 a0=9e70d28 a1=9e71d40 a2=9e72210 a3=0 items=0 ppid=3572 pid=4732 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
Has someone else encountered these before and what should I do about them?
Thanks,
Antonio