Dear selinux experts,
running fedora 10 preview updated to latest packages
[olivares@riohigh2 ~]$ uname -r 2.6.27.5-101.fc10.i686 [olivares@riohigh2 ~]$ rpm -qa selinux* selinux-policy-3.5.13-18.fc10.noarch selinux-policy-targeted-3.5.13-18.fc10.noarch
Summary:
SELinux is preventing gdm-binary (xdm_t) "unlink" to ./force-display-on-active-vt (var_spool_t).
Detailed Description:
SELinux is preventing gdm-binary (xdm_t) "unlink" to ./force-display-on-active-vt (var_spool_t). The SELinux type var_spool_t, is a generic type for all files in the directory and very few processes (SELinux Domains) are allowed to write to this SELinux type. This type of denial usual indicates a mislabeled file. By default a file created in a directory has the gets the context of the parent directory, but SELinux policy has rules about the creation of directories, that say if a process running in one SELinux Domain (D1) creates a file in a directory with a particular SELinux File Context (F1) the file gets a different File Context (F2). The policy usually allows the SELinux Domain (D1) the ability to write, unlink, and append on (F2). But if for some reason a file (./force-display-on-active-vt) was created with the wrong context, this domain will be denied. The usual solution to this problem is to reset the file context on the target file, restorecon -v './force-display-on-active-vt'. If the file context does not change from var_spool_t, then this is probably a bug in policy. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy package. If it does change, you can try your application again to see if it works. The file context could have been mislabeled by editing the file or moving the file from a different directory, if the file keeps getting mislabeled, check the init scripts to see if they are doing something to mislabel the file.
Allowing Access:
You can attempt to fix file context by executing restorecon -v './force-display-on-active-vt'
Fix Command:
restorecon './force-display-on-active-vt'
Additional Information:
Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:var_spool_t:s0 Target Objects ./force-display-on-active-vt [ file ] Source gdm-binary Source Path /usr/sbin/gdm-binary Port <Unknown> Host riohigh2 Source RPM Packages gdm-2.24.0-12.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name mislabeled_file Host Name riohigh2 Platform Linux riohigh2 2.6.27.5-94.fc10.i686 #1 SMP Mon Nov 10 15:51:55 EST 2008 i686 athlon Alert Count 17 First Seen Mon 03 Nov 2008 07:08:33 AM CST Last Seen Thu 13 Nov 2008 04:21:21 PM CST Local ID a66adf6c-89d5-4d90-83ca-f34c94bb4d45 Line Numbers
Raw Audit Messages
node=riohigh2 type=AVC msg=audit(1226614881.881:36): avc: denied { unlink } for pid=2090 comm="gdm-binary" name="force-display-on-active-vt" dev=sda6 ino=190494 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
node=riohigh2 type=SYSCALL msg=audit(1226614881.881:36): arch=40000003 syscall=10 success=no exit=-13 a0=8063b84 a1=0 a2=4f86dc a3=9940400 items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdm-binary" exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
Summary:
SELinux is preventing the npviewer.bin from using potentially mislabeled files (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer).
Detailed Description:
SELinux has denied npviewer.bin access to potentially mislabeled file(s) (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer). This means that SELinux will not allow npviewer.bin to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access.
Allowing Access:
If you want npviewer.bin to access this files, you need to relabel them using restorecon -v '/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer'. You might want to relabel the entire directory using restorecon -R -v '<Unknown>'.
Additional Information:
Source Context unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102 3 Target Context unconfined_u:object_r:user_home_t:s0 Target Objects /home/olivares/.icedteaplugin/icedtea-plugin-to- appletviewer [ fifo_file ] Source npviewer.bin Source Path /usr/lib/nspluginwrapper/npviewer.bin Port <Unknown> Host riohigh2 Source RPM Packages nspluginwrapper-1.1.2-4.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name home_tmp_bad_labels Host Name riohigh2 Platform Linux riohigh2 2.6.27.5-101.fc10.i686 #1 SMP Wed Nov 12 00:50:43 EST 2008 i686 athlon Alert Count 4 First Seen Thu 13 Nov 2008 06:31:50 PM CST Last Seen Thu 13 Nov 2008 06:31:55 PM CST Local ID 81d406be-b7e4-4bf4-a8c7-f12b7c36ee27 Line Numbers
Raw Audit Messages
node=riohigh2 type=AVC msg=audit(1226622715.909:38): avc: denied { write } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=sda6 ino=263881 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
node=riohigh2 type=AVC msg=audit(1226622715.909:38): avc: denied { read } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=sda6 ino=263847 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
node=riohigh2 type=SYSCALL msg=audit(1226622715.909:38): arch=40000003 syscall=11 success=yes exit=0 a0=9e70d28 a1=9e71d40 a2=9e72210 a3=0 items=0 ppid=3572 pid=4732 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
Has someone else encountered these before and what should I do about them?
Thanks,
Antonio
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Antonio Olivares wrote:
Dear selinux experts,
running fedora 10 preview updated to latest packages
[olivares@riohigh2 ~]$ uname -r 2.6.27.5-101.fc10.i686 [olivares@riohigh2 ~]$ rpm -qa selinux* selinux-policy-3.5.13-18.fc10.noarch selinux-policy-targeted-3.5.13-18.fc10.noarch
Summary:
SELinux is preventing gdm-binary (xdm_t) "unlink" to ./force-display-on-active-vt (var_spool_t).
Detailed Description:
SELinux is preventing gdm-binary (xdm_t) "unlink" to ./force-display-on-active-vt (var_spool_t). The SELinux type var_spool_t, is a generic type for all files in the directory and very few processes (SELinux Domains) are allowed to write to this SELinux type. This type of denial usual indicates a mislabeled file. By default a file created in a directory has the gets the context of the parent directory, but SELinux policy has rules about the creation of directories, that say if a process running in one SELinux Domain (D1) creates a file in a directory with a particular SELinux File Context (F1) the file gets a different File Context (F2). The policy usually allows the SELinux Domain (D1) the ability to write, unlink, and append on (F2). But if for some reason a file (./force-display-on-active-vt) was created with the wrong context, this domain will be denied. The usual solution to this problem is to reset the file context on the target file, restorecon -v './force-display-on-active-vt'. If the file context does not change from var_spool_t, then this is probably a bug in policy. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy package. If it does change, you can try your application again to see if it works. The file context could have been mislabeled by editing the file or moving the file from a different directory, if the file keeps getting mislabeled, check the init scripts to see if they are doing something to mislabel the file.
Allowing Access:
You can attempt to fix file context by executing restorecon -v './force-display-on-active-vt'
Fix Command:
restorecon './force-display-on-active-vt'
Additional Information:
Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:var_spool_t:s0 Target Objects ./force-display-on-active-vt [ file ] Source gdm-binary Source Path /usr/sbin/gdm-binary Port <Unknown> Host riohigh2 Source RPM Packages gdm-2.24.0-12.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name mislabeled_file Host Name riohigh2 Platform Linux riohigh2 2.6.27.5-94.fc10.i686 #1 SMP Mon Nov 10 15:51:55 EST 2008 i686 athlon Alert Count 17 First Seen Mon 03 Nov 2008 07:08:33 AM CST Last Seen Thu 13 Nov 2008 04:21:21 PM CST Local ID a66adf6c-89d5-4d90-83ca-f34c94bb4d45 Line Numbers
Raw Audit Messages
node=riohigh2 type=AVC msg=audit(1226614881.881:36): avc: denied { unlink } for pid=2090 comm="gdm-binary" name="force-display-on-active-vt" dev=sda6 ino=190494 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
node=riohigh2 type=SYSCALL msg=audit(1226614881.881:36): arch=40000003 syscall=10 success=no exit=-13 a0=8063b84 a1=0 a2=4f86dc a3=9940400 items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdm-binary" exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
THe question here is which process created this file? force-display-on-active-vt
Summary:
SELinux is preventing the npviewer.bin from using potentially mislabeled files (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer).
Detailed Description:
SELinux has denied npviewer.bin access to potentially mislabeled file(s) (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer). This means that SELinux will not allow npviewer.bin to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access.
Allowing Access:
If you want npviewer.bin to access this files, you need to relabel them using restorecon -v '/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer'. You might want to relabel the entire directory using restorecon -R -v '<Unknown>'.
Additional Information:
Source Context unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102 3 Target Context unconfined_u:object_r:user_home_t:s0 Target Objects /home/olivares/.icedteaplugin/icedtea-plugin-to- appletviewer [ fifo_file ] Source npviewer.bin Source Path /usr/lib/nspluginwrapper/npviewer.bin Port <Unknown> Host riohigh2 Source RPM Packages nspluginwrapper-1.1.2-4.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name home_tmp_bad_labels Host Name riohigh2 Platform Linux riohigh2 2.6.27.5-101.fc10.i686 #1 SMP Wed Nov 12 00:50:43 EST 2008 i686 athlon Alert Count 4 First Seen Thu 13 Nov 2008 06:31:50 PM CST Last Seen Thu 13 Nov 2008 06:31:55 PM CST Local ID 81d406be-b7e4-4bf4-a8c7-f12b7c36ee27 Line Numbers
Raw Audit Messages
node=riohigh2 type=AVC msg=audit(1226622715.909:38): avc: denied { write } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=sda6 ino=263881 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
node=riohigh2 type=AVC msg=audit(1226622715.909:38): avc: denied { read } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=sda6 ino=263847 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
node=riohigh2 type=SYSCALL msg=audit(1226622715.909:38): arch=40000003 syscall=11 success=yes exit=0 a0=9e70d28 a1=9e71d40 a2=9e72210 a3=0 items=0 ppid=3572 pid=4732 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
Has someone else encountered these before and what should I do about them?
Thanks,
Antonio
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
If you change the context of this directory to
chcon -R -t nsplugin_home_t ~/.icedteaplugin
You should eliminate this avc. I will change the layout in selinux-policy-3.5.13-21.fc10
--- On Fri, 11/14/08, Daniel J Walsh dwalsh@redhat.com wrote:
From: Daniel J Walsh dwalsh@redhat.com Subject: Re: SELinux is preventing gdm-binary (xdm_t) "unlink" to ... and npviewer To: olivares14031@yahoo.com Cc: fedora-selinux-list@redhat.com Date: Friday, November 14, 2008, 6:08 AM -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Antonio Olivares wrote:
Dear selinux experts,
running fedora 10 preview updated to latest packages
[olivares@riohigh2 ~]$ uname -r 2.6.27.5-101.fc10.i686 [olivares@riohigh2 ~]$ rpm -qa selinux* selinux-policy-3.5.13-18.fc10.noarch selinux-policy-targeted-3.5.13-18.fc10.noarch
Summary:
SELinux is preventing gdm-binary (xdm_t)
"unlink" to
./force-display-on-active-vt (var_spool_t).
Detailed Description:
SELinux is preventing gdm-binary (xdm_t)
"unlink" to
./force-display-on-active-vt (var_spool_t). The
SELinux type var_spool_t, is a
generic type for all files in the directory and very
few processes (SELinux
Domains) are allowed to write to this SELinux type.
This type of denial usual
indicates a mislabeled file. By default a file created
in a directory has the
gets the context of the parent directory, but SELinux
policy has rules about the
creation of directories, that say if a process running
in one SELinux Domain
(D1) creates a file in a directory with a particular
SELinux File Context (F1)
the file gets a different File Context (F2). The
policy usually allows the
SELinux Domain (D1) the ability to write, unlink, and
append on (F2). But if for
some reason a file (./force-display-on-active-vt) was
created with the wrong
context, this domain will be denied. The usual
solution to this problem is to
reset the file context on the target file, restorecon
-v
'./force-display-on-active-vt'. If the file
context does not change from
var_spool_t, then this is probably a bug in policy.
Please file a bug report
against the selinux-policy
package. If it does change, you can try your
application again to see if it
works. The file context could have been mislabeled by
editing the file or moving
the file from a different directory, if the file keeps
getting mislabeled, check
the init scripts to see if they are doing something to
mislabel the file.
Allowing Access:
You can attempt to fix file context by executing
restorecon -v
'./force-display-on-active-vt'
Fix Command:
restorecon './force-display-on-active-vt'
Additional Information:
Source Context
system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context
system_u:object_r:var_spool_t:s0
Target Objects
./force-display-on-active-vt [ file ]
Source gdm-binary Source Path /usr/sbin/gdm-binary Port <Unknown> Host riohigh2 Source RPM Packages gdm-2.24.0-12.fc10 Target RPM Packages Policy RPM
selinux-policy-3.5.13-18.fc10
Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name mislabeled_file Host Name riohigh2 Platform Linux riohigh2
2.6.27.5-94.fc10.i686 #1 SMP Mon
Nov 10 15:51:55 EST 2008i686 athlon
Alert Count 17 First Seen Mon 03 Nov 2008 07:08:33
AM CST
Last Seen Thu 13 Nov 2008 04:21:21
PM CST
Local ID
a66adf6c-89d5-4d90-83ca-f34c94bb4d45
Line Numbers
Raw Audit Messages
node=riohigh2 type=AVC msg=audit(1226614881.881:36):
avc: denied { unlink } for pid=2090 comm="gdm-binary" name="force-display-on-active-vt" dev=sda6 ino=190494 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
node=riohigh2 type=SYSCALL
msg=audit(1226614881.881:36): arch=40000003 syscall=10 success=no exit=-13 a0=8063b84 a1=0 a2=4f86dc a3=9940400 items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdm-binary" exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
THe question here is which process created this file? force-display-on-active-vt
Summary:
SELinux is preventing the npviewer.bin from using
potentially mislabeled files
(/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer).
Detailed Description:
SELinux has denied npviewer.bin access to potentially
mislabeled file(s)
(/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer). This means that
SELinux will not allow npviewer.bin to use these
files. It is common for users
to edit files in their home directory or tmp
directories and then move (mv) them
to system directories. The problem is that the files
end up with the wrong file
context which confined applications are not allowed to
access.
Allowing Access:
If you want npviewer.bin to access this files, you
need to relabel them using
restorecon -v
'/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer'.
You might want to relabel the entire directory using
restorecon -R -v '<Unknown>'.
Additional Information:
Source Context
unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102
3Target Context
unconfined_u:object_r:user_home_t:s0
Target Objects
/home/olivares/.icedteaplugin/icedtea-plugin-to-
appletviewer [ fifo_file]
Source npviewer.bin Source Path
/usr/lib/nspluginwrapper/npviewer.bin
Port <Unknown> Host riohigh2 Source RPM Packages
nspluginwrapper-1.1.2-4.fc10
Target RPM Packages Policy RPM
selinux-policy-3.5.13-18.fc10
Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name home_tmp_bad_labels Host Name riohigh2 Platform Linux riohigh2
2.6.27.5-101.fc10.i686 #1 SMP Wed
Nov 12 00:50:43 EST 2008i686 athlon
Alert Count 4 First Seen Thu 13 Nov 2008 06:31:50
PM CST
Last Seen Thu 13 Nov 2008 06:31:55
PM CST
Local ID
81d406be-b7e4-4bf4-a8c7-f12b7c36ee27
Line Numbers
Raw Audit Messages
node=riohigh2 type=AVC msg=audit(1226622715.909:38):
avc: denied { write } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=sda6 ino=263881 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
node=riohigh2 type=AVC msg=audit(1226622715.909:38):
avc: denied { read } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=sda6 ino=263847 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
node=riohigh2 type=SYSCALL
msg=audit(1226622715.909:38): arch=40000003 syscall=11 success=yes exit=0 a0=9e70d28 a1=9e71d40 a2=9e72210 a3=0 items=0 ppid=3572 pid=4732 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
Has someone else encountered these before and what
should I do about them?
Thanks,
Antonio
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list If you change the context of this directory to
chcon -R -t nsplugin_home_t ~/.icedteaplugin
You should eliminate this avc. I will change the layout in selinux-policy-3.5.13-21.fc10 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkkdhmcACgkQrlYvE4MpobMjuwCZAZh4YDlxJW30wanjBHUZ15CF EL0AoNjcjHePhXKzyHjPSc4Ed/WaYnXE =m4dV -----END PGP SIGNATURE-----
I tried the chcon command and this is what happened
Nov 14 20:00:05 localhost kernel: type=1400 audit(1226714405.352:155): avc: denied { write } for pid=5155 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:05 localhost kernel: type=1400 audit(1226714405.352:156): avc: denied { read } for pid=5155 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:05 localhost kernel: type=1400 audit(1226714405.388:157): avc: denied { write } for pid=5159 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:05 localhost kernel: type=1400 audit(1226714405.388:158): avc: denied { read } for pid=5159 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:15 localhost kernel: type=1400 audit(1226714415.618:159): avc: denied { write } for pid=5166 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:15 localhost kernel: type=1400 audit(1226714415.618:160): avc: denied { read } for pid=5166 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:15 localhost kernel: type=1400 audit(1226714415.654:161): avc: denied { write } for pid=5169 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:15 localhost kernel: type=1400 audit(1226714415.654:162): avc: denied { read } for pid=5169 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:22 localhost kernel: type=1400 audit(1226714422.242:163): avc: denied { write } for pid=5176 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:22 localhost kernel: type=1400 audit(1226714422.242:164): avc: denied { read } for pid=5176 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:22 localhost kernel: type=1400 audit(1226714422.279:165): avc: denied { write } for pid=5179 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:22 localhost kernel: type=1400 audit(1226714422.279:166): avc: denied { read } for pid=5179 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file ^C [root@localhost ~]# chcon -R -t nsplugin_home_t ~/.icedteaplugin chcon: cannot access `/root/.icedteaplugin': No such file or directory
Thanks,
Antonio
On Fri, 14 Nov 2008 18:02:33 -0800 (PST) Antonio Olivares olivares14031@yahoo.com wrote:
--- On Fri, 11/14/08, Daniel J Walsh dwalsh@redhat.com wrote:
From: Daniel J Walsh dwalsh@redhat.com Subject: Re: SELinux is preventing gdm-binary (xdm_t) "unlink" to ... and npviewer To: olivares14031@yahoo.com Cc: fedora-selinux-list@redhat.com Date: Friday, November 14, 2008, 6:08 AM -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Antonio Olivares wrote:
Dear selinux experts,
running fedora 10 preview updated to latest packages
[olivares@riohigh2 ~]$ uname -r 2.6.27.5-101.fc10.i686 [olivares@riohigh2 ~]$ rpm -qa selinux* selinux-policy-3.5.13-18.fc10.noarch selinux-policy-targeted-3.5.13-18.fc10.noarch
Summary:
SELinux is preventing gdm-binary (xdm_t)
"unlink" to
./force-display-on-active-vt (var_spool_t).
Detailed Description:
SELinux is preventing gdm-binary (xdm_t)
"unlink" to
./force-display-on-active-vt (var_spool_t). The
SELinux type var_spool_t, is a
generic type for all files in the directory and very
few processes (SELinux
Domains) are allowed to write to this SELinux type.
This type of denial usual
indicates a mislabeled file. By default a file created
in a directory has the
gets the context of the parent directory, but SELinux
policy has rules about the
creation of directories, that say if a process running
in one SELinux Domain
(D1) creates a file in a directory with a particular
SELinux File Context (F1)
the file gets a different File Context (F2). The
policy usually allows the
SELinux Domain (D1) the ability to write, unlink, and
append on (F2). But if for
some reason a file (./force-display-on-active-vt) was
created with the wrong
context, this domain will be denied. The usual
solution to this problem is to
reset the file context on the target file, restorecon
-v
'./force-display-on-active-vt'. If the file
context does not change from
var_spool_t, then this is probably a bug in policy.
Please file a bug report
against the selinux-policy
package. If it does change, you can try your
application again to see if it
works. The file context could have been mislabeled by
editing the file or moving
the file from a different directory, if the file keeps
getting mislabeled, check
the init scripts to see if they are doing something to
mislabel the file.
Allowing Access:
You can attempt to fix file context by executing
restorecon -v
'./force-display-on-active-vt'
Fix Command:
restorecon './force-display-on-active-vt'
Additional Information:
Source Context
system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context
system_u:object_r:var_spool_t:s0
Target Objects
./force-display-on-active-vt [ file ]
Source gdm-binary Source Path /usr/sbin/gdm-binary Port <Unknown> Host riohigh2 Source RPM Packages gdm-2.24.0-12.fc10 Target RPM Packages Policy RPM
selinux-policy-3.5.13-18.fc10
Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name mislabeled_file Host Name riohigh2 Platform Linux riohigh2
2.6.27.5-94.fc10.i686 #1 SMP Mon
Nov 10 15:51:55 EST 2008i686 athlon
Alert Count 17 First Seen Mon 03 Nov 2008 07:08:33
AM CST
Last Seen Thu 13 Nov 2008 04:21:21
PM CST
Local ID
a66adf6c-89d5-4d90-83ca-f34c94bb4d45
Line Numbers
Raw Audit Messages
node=riohigh2 type=AVC msg=audit(1226614881.881:36):
avc: denied { unlink } for pid=2090 comm="gdm-binary" name="force-display-on-active-vt" dev=sda6 ino=190494 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
node=riohigh2 type=SYSCALL
msg=audit(1226614881.881:36): arch=40000003 syscall=10 success=no exit=-13 a0=8063b84 a1=0 a2=4f86dc a3=9940400 items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdm-binary" exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
THe question here is which process created this file? force-display-on-active-vt
Summary:
SELinux is preventing the npviewer.bin from using
potentially mislabeled files
(/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer).
Detailed Description:
SELinux has denied npviewer.bin access to potentially
mislabeled file(s)
(/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer). This means that
SELinux will not allow npviewer.bin to use these
files. It is common for users
to edit files in their home directory or tmp
directories and then move (mv) them
to system directories. The problem is that the files
end up with the wrong file
context which confined applications are not allowed to
access.
Allowing Access:
If you want npviewer.bin to access this files, you
need to relabel them using
restorecon -v
'/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer'.
You might want to relabel the entire directory using
restorecon -R -v '<Unknown>'.
Additional Information:
Source Context
unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102
3Target Context
unconfined_u:object_r:user_home_t:s0
Target Objects
/home/olivares/.icedteaplugin/icedtea-plugin-to-
appletviewer [ fifo_file]
Source npviewer.bin Source Path
/usr/lib/nspluginwrapper/npviewer.bin
Port <Unknown> Host riohigh2 Source RPM Packages
nspluginwrapper-1.1.2-4.fc10
Target RPM Packages Policy RPM
selinux-policy-3.5.13-18.fc10
Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name home_tmp_bad_labels Host Name riohigh2 Platform Linux riohigh2
2.6.27.5-101.fc10.i686 #1 SMP Wed
Nov 12 00:50:43 EST 2008i686 athlon
Alert Count 4 First Seen Thu 13 Nov 2008 06:31:50
PM CST
Last Seen Thu 13 Nov 2008 06:31:55
PM CST
Local ID
81d406be-b7e4-4bf4-a8c7-f12b7c36ee27
Line Numbers
Raw Audit Messages
node=riohigh2 type=AVC msg=audit(1226622715.909:38):
avc: denied { write } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=sda6 ino=263881 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
node=riohigh2 type=AVC msg=audit(1226622715.909:38):
avc: denied { read } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=sda6 ino=263847 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
node=riohigh2 type=SYSCALL
msg=audit(1226622715.909:38): arch=40000003 syscall=11 success=yes exit=0 a0=9e70d28 a1=9e71d40 a2=9e72210 a3=0 items=0 ppid=3572 pid=4732 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
Has someone else encountered these before and what
should I do about them?
Thanks,
Antonio
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list If you change the context of this directory to
chcon -R -t nsplugin_home_t ~/.icedteaplugin
You should eliminate this avc. I will change the layout in selinux-policy-3.5.13-21.fc10 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkkdhmcACgkQrlYvE4MpobMjuwCZAZh4YDlxJW30wanjBHUZ15CF EL0AoNjcjHePhXKzyHjPSc4Ed/WaYnXE =m4dV -----END PGP SIGNATURE-----
I tried the chcon command and this is what happened
Nov 14 20:00:05 localhost kernel: type=1400 audit(1226714405.352:155): avc: denied { write } for pid=5155 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:05 localhost kernel: type=1400 audit(1226714405.352:156): avc: denied { read } for pid=5155 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:05 localhost kernel: type=1400 audit(1226714405.388:157): avc: denied { write } for pid=5159 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:05 localhost kernel: type=1400 audit(1226714405.388:158): avc: denied { read } for pid=5159 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:15 localhost kernel: type=1400 audit(1226714415.618:159): avc: denied { write } for pid=5166 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:15 localhost kernel: type=1400 audit(1226714415.618:160): avc: denied { read } for pid=5166 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:15 localhost kernel: type=1400 audit(1226714415.654:161): avc: denied { write } for pid=5169 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:15 localhost kernel: type=1400 audit(1226714415.654:162): avc: denied { read } for pid=5169 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:22 localhost kernel: type=1400 audit(1226714422.242:163): avc: denied { write } for pid=5176 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:22 localhost kernel: type=1400 audit(1226714422.242:164): avc: denied { read } for pid=5176 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:22 localhost kernel: type=1400 audit(1226714422.279:165): avc: denied { write } for pid=5179 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:22 localhost kernel: type=1400 audit(1226714422.279:166): avc: denied { read } for pid=5179 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file ^C [root@localhost ~]# chcon -R -t nsplugin_home_t ~/.icedteaplugin chcon: cannot access `/root/.icedteaplugin': No such file or directory
The SELinux denials are for the "olivares" user, not "root". So you need to run the chcon command as user olivares.
Paul.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Antonio Olivares wrote:
--- On Fri, 11/14/08, Daniel J Walsh dwalsh@redhat.com wrote:
From: Daniel J Walsh dwalsh@redhat.com Subject: Re: SELinux is preventing gdm-binary (xdm_t) "unlink" to ... and npviewer To: olivares14031@yahoo.com Cc: fedora-selinux-list@redhat.com Date: Friday, November 14, 2008, 6:08 AM
Antonio Olivares wrote:
Dear selinux experts,
running fedora 10 preview updated to latest packages
[olivares@riohigh2 ~]$ uname -r 2.6.27.5-101.fc10.i686 [olivares@riohigh2 ~]$ rpm -qa selinux* selinux-policy-3.5.13-18.fc10.noarch selinux-policy-targeted-3.5.13-18.fc10.noarch
Summary:
SELinux is preventing gdm-binary (xdm_t)
"unlink" to
./force-display-on-active-vt (var_spool_t).
Detailed Description:
SELinux is preventing gdm-binary (xdm_t)
"unlink" to
./force-display-on-active-vt (var_spool_t). The
SELinux type var_spool_t, is a
generic type for all files in the directory and very
few processes (SELinux
Domains) are allowed to write to this SELinux type.
This type of denial usual
indicates a mislabeled file. By default a file created
in a directory has the
gets the context of the parent directory, but SELinux
policy has rules about the
creation of directories, that say if a process running
in one SELinux Domain
(D1) creates a file in a directory with a particular
SELinux File Context (F1)
the file gets a different File Context (F2). The
policy usually allows the
SELinux Domain (D1) the ability to write, unlink, and
append on (F2). But if for
some reason a file (./force-display-on-active-vt) was
created with the wrong
context, this domain will be denied. The usual
solution to this problem is to
reset the file context on the target file, restorecon
-v
'./force-display-on-active-vt'. If the file
context does not change from
var_spool_t, then this is probably a bug in policy.
Please file a bug report
against the selinux-policy
package. If it does change, you can try your
application again to see if it
works. The file context could have been mislabeled by
editing the file or moving
the file from a different directory, if the file keeps
getting mislabeled, check
the init scripts to see if they are doing something to
mislabel the file.
Allowing Access:
You can attempt to fix file context by executing
restorecon -v
'./force-display-on-active-vt'
Fix Command:
restorecon './force-display-on-active-vt'
Additional Information:
Source Context
system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context
system_u:object_r:var_spool_t:s0
Target Objects
./force-display-on-active-vt [ file ]
Source gdm-binary Source Path /usr/sbin/gdm-binary Port <Unknown> Host riohigh2 Source RPM Packages gdm-2.24.0-12.fc10 Target RPM Packages Policy RPM
selinux-policy-3.5.13-18.fc10
Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name mislabeled_file Host Name riohigh2 Platform Linux riohigh2
2.6.27.5-94.fc10.i686 #1 SMP Mon
Nov 10 15:51:55 EST 2008i686 athlon
Alert Count 17 First Seen Mon 03 Nov 2008 07:08:33
AM CST
Last Seen Thu 13 Nov 2008 04:21:21
PM CST
Local ID
a66adf6c-89d5-4d90-83ca-f34c94bb4d45
Line Numbers
Raw Audit Messages
node=riohigh2 type=AVC msg=audit(1226614881.881:36):
avc: denied { unlink } for pid=2090 comm="gdm-binary" name="force-display-on-active-vt" dev=sda6 ino=190494 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
node=riohigh2 type=SYSCALL
msg=audit(1226614881.881:36): arch=40000003 syscall=10 success=no exit=-13 a0=8063b84 a1=0 a2=4f86dc a3=9940400 items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdm-binary" exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
THe question here is which process created this file? force-display-on-active-vt
Summary:
SELinux is preventing the npviewer.bin from using
potentially mislabeled files (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer).
Detailed Description:
SELinux has denied npviewer.bin access to potentially
mislabeled file(s) (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer). This means that
SELinux will not allow npviewer.bin to use these
files. It is common for users
to edit files in their home directory or tmp
directories and then move (mv) them
to system directories. The problem is that the files
end up with the wrong file
context which confined applications are not allowed to
access.
Allowing Access:
If you want npviewer.bin to access this files, you
need to relabel them using
restorecon -v
'/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer'.
You might want to relabel the entire directory using
restorecon -R -v '<Unknown>'.
Additional Information:
Source Context
unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102
3Target Context
unconfined_u:object_r:user_home_t:s0
Target Objects
/home/olivares/.icedteaplugin/icedtea-plugin-to-
appletviewer [ fifo_file]
Source npviewer.bin Source Path
/usr/lib/nspluginwrapper/npviewer.bin
Port <Unknown> Host riohigh2 Source RPM Packages
nspluginwrapper-1.1.2-4.fc10
Target RPM Packages Policy RPM
selinux-policy-3.5.13-18.fc10
Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name home_tmp_bad_labels Host Name riohigh2 Platform Linux riohigh2
2.6.27.5-101.fc10.i686 #1 SMP Wed
Nov 12 00:50:43 EST 2008i686 athlon
Alert Count 4 First Seen Thu 13 Nov 2008 06:31:50
PM CST
Last Seen Thu 13 Nov 2008 06:31:55
PM CST
Local ID
81d406be-b7e4-4bf4-a8c7-f12b7c36ee27
Line Numbers
Raw Audit Messages
node=riohigh2 type=AVC msg=audit(1226622715.909:38):
avc: denied { write } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=sda6 ino=263881 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
node=riohigh2 type=AVC msg=audit(1226622715.909:38):
avc: denied { read } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=sda6 ino=263847 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
node=riohigh2 type=SYSCALL
msg=audit(1226622715.909:38): arch=40000003 syscall=11 success=yes exit=0 a0=9e70d28 a1=9e71d40 a2=9e72210 a3=0 items=0 ppid=3572 pid=4732 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
Has someone else encountered these before and what
should I do about them?
Thanks,
Antonio
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list If you change the context of this directory to
chcon -R -t nsplugin_home_t ~/.icedteaplugin
You should eliminate this avc. I will change the layout in selinux-policy-3.5.13-21.fc10
I tried the chcon command and this is what happened
Nov 14 20:00:05 localhost kernel: type=1400 audit(1226714405.352:155): avc: denied { write } for pid=5155 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:05 localhost kernel: type=1400 audit(1226714405.352:156): avc: denied { read } for pid=5155 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:05 localhost kernel: type=1400 audit(1226714405.388:157): avc: denied { write } for pid=5159 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:05 localhost kernel: type=1400 audit(1226714405.388:158): avc: denied { read } for pid=5159 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:15 localhost kernel: type=1400 audit(1226714415.618:159): avc: denied { write } for pid=5166 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:15 localhost kernel: type=1400 audit(1226714415.618:160): avc: denied { read } for pid=5166 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:15 localhost kernel: type=1400 audit(1226714415.654:161): avc: denied { write } for pid=5169 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:15 localhost kernel: type=1400 audit(1226714415.654:162): avc: denied { read } for pid=5169 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:22 localhost kernel: type=1400 audit(1226714422.242:163): avc: denied { write } for pid=5176 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:22 localhost kernel: type=1400 audit(1226714422.242:164): avc: denied { read } for pid=5176 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:22 localhost kernel: type=1400 audit(1226714422.279:165): avc: denied { write } for pid=5179 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=dm-0 ino=7734395 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14 20:00:22 localhost kernel: type=1400 audit(1226714422.279:166): avc: denied { read } for pid=5179 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=dm-0 ino=7734394 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file ^C [root@localhost ~]# chcon -R -t nsplugin_home_t ~/.icedteaplugin chcon: cannot access `/root/.icedteaplugin': No such file or directory
Thanks,
Antonio
You need to do it on your homedir.
chcon -R -t nsplugin_home_t /home/olivares/.icedteaplugin
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Antonio Olivares wrote:
Dear selinux experts,
running fedora 10 preview updated to latest packages
[olivares@riohigh2 ~]$ uname -r 2.6.27.5-101.fc10.i686 [olivares@riohigh2 ~]$ rpm -qa selinux* selinux-policy-3.5.13-18.fc10.noarch selinux-policy-targeted-3.5.13-18.fc10.noarch
Summary:
SELinux is preventing gdm-binary (xdm_t) "unlink" to ./force-display-on-active-vt (var_spool_t).
Detailed Description:
SELinux is preventing gdm-binary (xdm_t) "unlink" to ./force-display-on-active-vt (var_spool_t). The SELinux type var_spool_t, is a generic type for all files in the directory and very few processes (SELinux Domains) are allowed to write to this SELinux type. This type of denial usual indicates a mislabeled file. By default a file created in a directory has the gets the context of the parent directory, but SELinux policy has rules about the creation of directories, that say if a process running in one SELinux Domain (D1) creates a file in a directory with a particular SELinux File Context (F1) the file gets a different File Context (F2). The policy usually allows the SELinux Domain (D1) the ability to write, unlink, and append on (F2). But if for some reason a file (./force-display-on-active-vt) was created with the wrong context, this domain will be denied. The usual solution to this problem is to reset the file context on the target file, restorecon -v './force-display-on-active-vt'. If the file context does not change from var_spool_t, then this is probably a bug in policy. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy package. If it does change, you can try your application again to see if it works. The file context could have been mislabeled by editing the file or moving the file from a different directory, if the file keeps getting mislabeled, check the init scripts to see if they are doing something to mislabel the file.
Allowing Access:
You can attempt to fix file context by executing restorecon -v './force-display-on-active-vt'
Fix Command:
restorecon './force-display-on-active-vt'
Additional Information:
Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:var_spool_t:s0 Target Objects ./force-display-on-active-vt [ file ] Source gdm-binary Source Path /usr/sbin/gdm-binary Port <Unknown> Host riohigh2 Source RPM Packages gdm-2.24.0-12.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name mislabeled_file Host Name riohigh2 Platform Linux riohigh2 2.6.27.5-94.fc10.i686 #1 SMP Mon Nov 10 15:51:55 EST 2008 i686 athlon Alert Count 17 First Seen Mon 03 Nov 2008 07:08:33 AM CST Last Seen Thu 13 Nov 2008 04:21:21 PM CST Local ID a66adf6c-89d5-4d90-83ca-f34c94bb4d45 Line Numbers
Raw Audit Messages
node=riohigh2 type=AVC msg=audit(1226614881.881:36): avc: denied { unlink } for pid=2090 comm="gdm-binary" name="force-display-on-active-vt" dev=sda6 ino=190494 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
node=riohigh2 type=SYSCALL msg=audit(1226614881.881:36): arch=40000003 syscall=10 success=no exit=-13 a0=8063b84 a1=0 a2=4f86dc a3=9940400 items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdm-binary" exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
Actually this looks like a labeling problem
restorecon -R -v /var/spool/gdm
Summary:
SELinux is preventing the npviewer.bin from using potentially mislabeled files (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer).
Detailed Description:
SELinux has denied npviewer.bin access to potentially mislabeled file(s) (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer). This means that SELinux will not allow npviewer.bin to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access.
Allowing Access:
If you want npviewer.bin to access this files, you need to relabel them using restorecon -v '/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer'. You might want to relabel the entire directory using restorecon -R -v '<Unknown>'.
Additional Information:
Source Context unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102 3 Target Context unconfined_u:object_r:user_home_t:s0 Target Objects /home/olivares/.icedteaplugin/icedtea-plugin-to- appletviewer [ fifo_file ] Source npviewer.bin Source Path /usr/lib/nspluginwrapper/npviewer.bin Port <Unknown> Host riohigh2 Source RPM Packages nspluginwrapper-1.1.2-4.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name home_tmp_bad_labels Host Name riohigh2 Platform Linux riohigh2 2.6.27.5-101.fc10.i686 #1 SMP Wed Nov 12 00:50:43 EST 2008 i686 athlon Alert Count 4 First Seen Thu 13 Nov 2008 06:31:50 PM CST Last Seen Thu 13 Nov 2008 06:31:55 PM CST Local ID 81d406be-b7e4-4bf4-a8c7-f12b7c36ee27 Line Numbers
Raw Audit Messages
node=riohigh2 type=AVC msg=audit(1226622715.909:38): avc: denied { write } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=sda6 ino=263881 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
node=riohigh2 type=AVC msg=audit(1226622715.909:38): avc: denied { read } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=sda6 ino=263847 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file
node=riohigh2 type=SYSCALL msg=audit(1226622715.909:38): arch=40000003 syscall=11 success=yes exit=0 a0=9e70d28 a1=9e71d40 a2=9e72210 a3=0 items=0 ppid=3572 pid=4732 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
Has someone else encountered these before and what should I do about them?
Thanks,
Antonio
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
selinux@lists.fedoraproject.org
-
Antonio Olivares -
Daniel J Walsh -
Paul Howarth