Fedora 10 Selinux Denies Firefox Ability to Upload Picture

[Ole Ersoy]

Hi,

I tried uploading a picture to facebook, and it appears that selinux was denying firefox
the ability to read the image.  The image has the following context:

rw-rw-r--  ole ole unconfined_u:object_r:user_home_t:s0 dsc06702.jpg


I looked in /var/log/messages and /var/log/audit/audit.log for a denial message, but did
not see one (Silent denial?).  The image uploaded fine after running:

setenforce 0 

though, so I assume it's SELinux.  Thought I'd mention this in case it's
something that can make a secure Fedora experience simpler for the average desktop user.

Cheers,
- Ole

[Dominick Grift]

On Fri, 2009-01-16 at 13:21 -0600, Ole Ersoy wrote:
>  Hi,
>  
>  I tried uploading a picture to facebook, and it appears that selinux was denying firefox
> the ability to read the image.  The image has the following context:
>  
>  rw-rw-r--  ole ole unconfined_u:object_r:user_home_t:s0 dsc06702.jpg
>  
>  
>  I looked in /var/log/messages and /var/log/audit/audit.log for a denial message, but did
> not see one (Silent denial?).  The image uploaded fine after running:
>  
>  setenforce 0 
>  
>  though, so I assume it's SELinux.  Thought I'd mention this in case it's
> something that can make a secure Fedora experience simpler for the average desktop user.
You can unload the "silent denials" using the "semodule -DB" command.
Your issue is strange however because it seems that you operate in the
unconfined user domain. This user domain is designed to be unrestricted
(not targeted) with the exception of execmem, execmod, execstack and
execheap.

Hth, Dominick grift

>  
>  
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Ole Ersoy]

>  You can unload the "silent denials" using the
> "semodule -DB" command. 
Gave it a shot, and nothing there either:
[root@ole Documents]# semodule -DB
[root@ole Documents]# 

>  Your issue is strange however because it seems that you operate in
> the
>  unconfined user domain. This user domain is designed to be unrestricted
>  (not targeted) with the exception of execmem, execmod, execstack and
>  execheap. 
Indeed.  I'll keep poking around for clues and do a post back if I find more info.

Thanks,
- Ole

[Dominick Grift]

On Fri, 2009-01-16 at 15:13 -0600, Ole Ersoy wrote:

>  Indeed.  I'll keep poking around for clues and do a post back if
> I find more info. 
You could also try and see if DBUS is somehow involved. DBUS SELinux
denials go to /var/log/messages. It is a long shot.

[Ole Ersoy]

I tried:
grep "SELinux is preventing" /var/log/messages

And peeking through /var/log/message, but did not find anything.  Next time I do a fresh
install I'll see whether I can replicate the result.

Cheers,
- Ole

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ole Ersoy wrote:
>  I tried:
>  grep "SELinux is preventing" /var/log/messages
>  
>  And peeking through /var/log/message, but did not find anything.  Next
>  time I do a fresh install I'll see whether I can replicate the result.
>  
>  Cheers,
>  - Ole
>  
>  -- 
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
Your error (avc)
messages are in /var/log/audit/audit.log


grep avc /var/log/audit/audit.log
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkl0jV4ACgkQrlYvE4MpobM2ZwCdFYMT8/s3+yMgmVWyUnaM5Lu3
> H30AoOlEjqmWU3tXkbcgHCq0uVOMhN77
> =t11h
> -----END PGP SIGNATURE-----

[Ole Ersoy]

I had a look in /var/log/audit as well, but did not see anything that looks like a
it's related.  I pasted the last few entries at the bottom of the email.

I've been trying to see whether I can create another denial entry, so that I know
exactly which one is new, but the pictures are uploading with selinux enforcing now, so
perhaps it was just a coincidence that running setenforce 0 worked....

I'm in the process of learning SELinux and experimenting, but I don't think I did
anything to change target policy...

If no one else has the issue, I would say it's a false report - sorry.

Last set of log entries:

type=AVC msg=audit(1232406061.676:687): avc:  denied  { search } for  pid=2802
comm="unix_chkpwd" name="/" dev=selinuxfs ino=1
scontext=system_u:system_r:system_chkpwd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:security_t:s0 tclass=dir
type=SYSCALL msg=audit(1232406061.676:687): arch=40000003 syscall=195 success=no exit=-13
a0=bfda5b7c a1=bfda5b1c a2=30bff4 a3=bfda5b7c items=0 ppid=2801 pid=2802 auid=4294967295
uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="unix_chkpwd" exe="/sbin/unix_chkpwd"
subj=system_u:system_r:system_chkpwd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1232406061.677:688): avc:  denied  { search } for  pid=2802
comm="unix_chkpwd" name="/" dev=selinuxfs ino=1
scontext=system_u:system_r:system_chkpwd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:security_t:s0 tclass=dir
type=SYSCALL msg=audit(1232406061.677:688): arch=40000003 syscall=5 success=no exit=-13
a0=bfda5b54 a1=8000 a2=0 a3=8000 items=0 ppid=2801 pid=2802 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="unix_chkpwd" exe="/sbin/unix_chkpwd"
subj=system_u:system_r:system_chkpwd_t:s0-s0:c0.c1023 key=(null)
type=USER_ACCT msg=audit(1232406061.682:689): user pid=2801 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting
acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron
res=success)'
type=CRED_ACQ msg=audit(1232406061.687:690): user pid=2801 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred
acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron
res=success)'
type=LOGIN msg=audit(1232406061.687:691): login pid=2801 uid=0 old auid=4294967295 new
auid=0 old ses=4294967295 new ses=2
type=USER_START msg=audit(1232406061.689:692): user pid=2801 uid=0 auid=0 ses=2
subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open
acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron
res=success)'
type=CRED_DISP msg=audit(1232406061.750:693): user pid=2801 uid=0 auid=0 ses=2
subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred
acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron
res=success)'
type=USER_END msg=audit(1232406061.750:694): user pid=2801 uid=0 auid=0 ses=2
subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close
acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron
res=success)'

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ole Ersoy wrote:
>  I had a look in /var/log/audit as well, but did not see anything
> that
>  looks like a it's related.  I pasted the last few entries at the bottom
>  of the email.
>  
>  I've been trying to see whether I can create another denial entry, so
>  that I know exactly which one is new, but the pictures are uploading
>  with selinux enforcing now, so perhaps it was just a coincidence that
>  running setenforce 0 worked....
>  
>  I'm in the process of learning SELinux and experimenting, but I don't
>  think I did anything to change target policy...
>  
>  If no one else has the issue, I would say it's a false report - sorry.
>  
>  Last set of log entries:
>  
>  type=AVC msg=audit(1232406061.676:687): avc:  denied  { search } for 
>  pid=2802 comm="unix_chkpwd" name="/" dev=selinuxfs ino=1
>  scontext=system_u:system_r:system_chkpwd_t:s0-s0:c0.c1023
>  tcontext=system_u:object_r:security_t:s0 tclass=dir
>  type=SYSCALL msg=audit(1232406061.676:687): arch=40000003 syscall=195
>  success=no exit=-13 a0=bfda5b7c a1=bfda5b1c a2=30bff4 a3=bfda5b7c
>  items=0 ppid=2801 pid=2802 auid=4294967295 uid=0 gid=0 euid=0 suid=0
>  fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
>  comm="unix_chkpwd" exe="/sbin/unix_chkpwd"
>  subj=system_u:system_r:system_chkpwd_t:s0-s0:c0.c1023 key=(null)
>  type=AVC msg=audit(1232406061.677:688): avc:  denied  { search } for 
>  pid=2802 comm="unix_chkpwd" name="/" dev=selinuxfs ino=1
>  scontext=system_u:system_r:system_chkpwd_t:s0-s0:c0.c1023
>  tcontext=system_u:object_r:security_t:s0 tclass=dir
>  type=SYSCALL msg=audit(1232406061.677:688): arch=40000003 syscall=5
>  success=no exit=-13 a0=bfda5b54 a1=8000 a2=0 a3=8000 items=0 ppid=2801
>  pid=2802 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
>  fsgid=0 tty=(none) ses=4294967295 comm="unix_chkpwd"
>  exe="/sbin/unix_chkpwd"
>  subj=system_u:system_r:system_chkpwd_t:s0-s0:c0.c1023 key=(null)
>  type=USER_ACCT msg=audit(1232406061.682:689): user pid=2801 uid=0
>  auid=4294967295 ses=4294967295
>  subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting
>  acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron
>  res=success)'
>  type=CRED_ACQ msg=audit(1232406061.687:690): user pid=2801 uid=0
>  auid=4294967295 ses=4294967295
>  subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred
>  acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron
>  res=success)'
>  type=LOGIN msg=audit(1232406061.687:691): login pid=2801 uid=0 old
>  auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>  type=USER_START msg=audit(1232406061.689:692): user pid=2801 uid=0
>  auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023
>  msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond"
> (hostname=?,
>  addr=?, terminal=cron res=success)'
>  type=CRED_DISP msg=audit(1232406061.750:693): user pid=2801 uid=0 auid=0
>  ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred
>  acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron
>  res=success)'
>  type=USER_END msg=audit(1232406061.750:694): user pid=2801 uid=0 auid=0
>  ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023
>  msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond"
> (hostname=?,
>  addr=?, terminal=cron res=success)' 
None of these are related.

Very strange.

Are you running with nsplugin_t?  ps -eZ | grep nsplugin

What file system are you using?

What is the exact behaviour that is being blocked?

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkl1628ACgkQrlYvE4MpobO27ACg0E3MmN5ILPB76eQ7WTSZUZX2
> A70AnRrNgAHtCHVFKnIgdHMAsrf/k/eH
> =+VhF
> -----END PGP SIGNATURE-----

[Ole Ersoy]

>  Are you running with nsplugin_t?  ps -eZ | grep nsplugin 
[root@ole Download]# ps -eZ | grep nsplugin
[root@ole Download]# 

>  
>  What file system are you using? 
ext3

>  
>  What is the exact behaviour that is being blocked? 
I tried uploading a photo to facebook, and kept getting a "one sentence"
postback from facebook saying the image could not be uploaded.  I tried it 3-4 times, just
to make sure it was not a temporary thing on their side.  Then I ran setenforce 0, and the
image uploaded fine.  So I assumed selinux was blocking firefox from reading the image. 
I've been trying to duplicate the result with SELinux enforcing though, after
rebooting, and now I can upload images without a problem, so I'm wondering whether it
was just a coincidence that setenforce 0 worked.  If no one else has the problem, then
it's probably just a coincidence.  I have a better idea on how to isolate the message
in the log now, so if it happens again, I'll hopefully be able to get a better grasp
on why.

Thanks,
- Ole

[Serge E. Hallyn]

Quoting Ole Ersoy (ole.ersoy(a)gmail.com):
> > Are you running with nsplugin_t?  ps -eZ | grep nsplugin
>
>  [root@ole Download]# ps -eZ | grep nsplugin
>  [root@ole Download]# 
>
> >
> > What file system are you using?
>
>  ext3
>
> >
> > What is the exact behaviour that is being blocked?
>
>  I tried uploading a photo to facebook, and kept getting a "one
>  sentence" postback from facebook saying the image could not be 
Interesting.

Another thing to consider is that facebook (or someone else)
might have been trying to do something other than get that
picture, and selinux rightfully stopped it.

>  uploaded.  I tried it 3-4 times, just to make sure it was not a
>  temporary thing on their side.  Then I ran setenforce 0, and the image
>  uploaded fine.  So I assumed selinux was blocking firefox from reading
>  the image.  I've been trying to duplicate the result with SELinux
>  enforcing though, after rebooting, and now I can upload images without
>  a problem, so I'm wondering whether it was just a coincidence that
>  setenforce 0 worked.  If no one else has the problem, then it's
>  probably just a coincidence.  I have a better idea on how to isolate
>  the message in the log now, so if it happens again, I'll hopefully be
>  able to get a better grasp on why.
>
>  Thanks,
>  - Ole
>
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Serge E. Hallyn wrote:
>  Quoting Ole Ersoy (ole.ersoy(a)gmail.com):
> >> Are you running with nsplugin_t?  ps -eZ | grep nsplugin
> > [root@ole Download]# ps -eZ | grep nsplugin
> > [root@ole Download]# 
> >
> >> What file system are you using?
> > ext3
> >
> >> What is the exact behaviour that is being blocked?
> > I tried uploading a photo to facebook, and kept getting a "one
> > sentence" postback from facebook saying the image could not be
>  
>  Interesting.
>  
>  Another thing to consider is that facebook (or someone else)
>  might have been trying to do something other than get that
>  picture, and selinux rightfully stopped it.
>  
> > uploaded.  I tried it 3-4 times, just to make sure it was not a
> > temporary thing on their side.  Then I ran setenforce 0, and the image
> > uploaded fine.  So I assumed selinux was blocking firefox from reading
> > the image.  I've been trying to duplicate the result with SELinux
> > enforcing though, after rebooting, and now I can upload images without
> > a problem, so I'm wondering whether it was just a coincidence that
> > setenforce 0 worked.  If no one else has the problem, then it's
> > probably just a coincidence.  I have a better idea on how to isolate
> > the message in the log now, so if it happens again, I'll hopefully be
> > able to get a better grasp on why.
> >
> > Thanks,
> > - Ole
> >
> > --
> > fedora-selinux-list mailing list
> > fedora-selinux-list(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
Ok, if it happens
again, don't hesitate to ping me.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkl19oUACgkQrlYvE4MpobMqtQCfcMLys63o2TBh5ITnHFlE0WC3
> Fr4AniDElQN84WBH9W2MZWH9fxguDPfS
> =LlkN
> -----END PGP SIGNATURE-----

[Ole Ersoy]

>  
>  Another thing to consider is that facebook (or someone else)
>  might have been trying to do something other than get that
>  picture, and selinux rightfully stopped it. 
Good point.  I'm starting to think that cleaning things up with a reinstall will be
good.

Thanks,
- Ole