AVC every server boot: SELinux is preventing the setxkbmap from using potentially mislabeled files (./.X11-unix).
8:05 p.m.
I am running Centos 5.3 in permissive mode - and recently I started
getting 4 avcs every time I boot the server. I am not sure - but I think
these might have started when I changed my desktop from Gnome to KDE. I
have tried the relabelling suggested in the AVC - but this hasn't fixed it.
Does it look like I have something set up wrong - or is there a policy
problem?
Richard.
Summary
SELinux is preventing the setxkbmap from using potentially mislabeled
files (./.X11-unix).
Detailed Description
[SELinux is in permissive mode, the operation would have been denied but
was permitted due to permissive mode.]
SELinux has denied setxkbmap access to potentially mislabeled file(s)
(./.X11-unix). This means that SELinux will not allow setxkbmap to use
these files. It is common for users to edit files in their home
directory or tmp directories and then move (mv) them to system
directories. The problem is that the files end up with the wrong file
context which confined applications are not allowed to access.
Allowing Access
If you want setxkbmap to access this files, you need to relabel them
using restorecon -v './.X11-unix'. You might want to relabel the entire
directory using restorecon -R -v './.X11-unix'.
Additional Information
Source Context: system_u:system_r:rhgb_t
Target Context: system_u:object_r:initrc_tmp_t
Target Objects: ./.X11-unix [ dir ]
Source: setxkbmap
Source Path: /usr/bin/setxkbmap
Port: <Unknown>
Host: C5.aardvark.com.au
Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
Target RPM Packages:
Policy RPM: selinux-policy-2.4.6-225.el5
Selinux Enabled: True
Policy Type: targeted
MLS Enabled: True
Enforcing Mode: Permissive
Plugin Name: home_tmp_bad_labels
Host Name: C5.aardvark.com.au
Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue Aug
4 20:19:25 EDT 2009 x86_64 x86_64
Alert Count: 34
First Seen: Sun Jan 11 17:55:13 2009
Last Seen: Mon Aug 10 18:13:15 2009
Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1249899195.897:15): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1249899195.897:15): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899195.897:15):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=3d29351a30 items=0 ppid=4021 pid=4022 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="setxkbmap" exe="/usr/bin/setxkbmap"
subj=system_u:system_r:rhgb_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899195.897:15):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=3d29351a30 items=0 ppid=4021 pid=4022 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="setxkbmap" exe="/usr/bin/setxkbmap"
subj=system_u:system_r:rhgb_t:s0 key=(null)
Summary
SELinux is preventing the setxkbmap from using potentially mislabeled
files (./.X11-unix).
Detailed Description
[SELinux is in permissive mode, the operation would have been denied but
was permitted due to permissive mode.]
SELinux has denied setxkbmap access to potentially mislabeled file(s)
(./.X11-unix). This means that SELinux will not allow setxkbmap to use
these files. It is common for users to edit files in their home
directory or tmp directories and then move (mv) them to system
directories. The problem is that the files end up with the wrong file
context which confined applications are not allowed to access.
Allowing Access
If you want setxkbmap to access this files, you need to relabel them
using restorecon -v './.X11-unix'. You might want to relabel the entire
directory using restorecon -R -v './.X11-unix'.
Additional Information
Source Context: system_u:system_r:rhgb_t
Target Context: system_u:object_r:initrc_tmp_t
Target Objects: ./.X11-unix [ dir ]
Source: setxkbmap
Source Path: /usr/bin/setxkbmap
Port: <Unknown>
Host: C5.aardvark.com.au
Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
Target RPM Packages:
Policy RPM: selinux-policy-2.4.6-225.el5
Selinux Enabled: True
Policy Type: targeted
MLS Enabled: True
Enforcing Mode: Permissive
Plugin Name: home_tmp_bad_labels
Host Name: C5.aardvark.com.au
Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue Aug
4 20:19:25 EDT 2009 x86_64 x86_64
Alert Count: 35
First Seen: Sun Jan 11 17:55:13 2009
Last Seen: Mon Aug 10 18:13:16 2009
Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1249899196.898:16): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1249899196.898:16): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899196.898:16):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899196.898:16):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
Summary
SELinux is preventing the setxkbmap from using potentially mislabeled
files (./.X11-unix).
Detailed Description
[SELinux is in permissive mode, the operation would have been denied but
was permitted due to permissive mode.]
SELinux has denied setxkbmap access to potentially mislabeled file(s)
(./.X11-unix). This means that SELinux will not allow setxkbmap to use
these files. It is common for users to edit files in their home
directory or tmp directories and then move (mv) them to system
directories. The problem is that the files end up with the wrong file
context which confined applications are not allowed to access.
Allowing Access
If you want setxkbmap to access this files, you need to relabel them
using restorecon -v './.X11-unix'. You might want to relabel the entire
directory using restorecon -R -v './.X11-unix'.
Additional Information
Source Context: system_u:system_r:rhgb_t
Target Context: system_u:object_r:initrc_tmp_t
Target Objects: ./.X11-unix [ dir ]
Source: setxkbmap
Source Path: /usr/bin/setxkbmap
Port: <Unknown>
Host: C5.aardvark.com.au
Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
Target RPM Packages:
Policy RPM: selinux-policy-2.4.6-225.el5
Selinux Enabled: True
Policy Type: targeted
MLS Enabled: True
Enforcing Mode: Permissive
Plugin Name: home_tmp_bad_labels
Host Name: C5.aardvark.com.au
Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue Aug
4 20:19:25 EDT 2009 x86_64 x86_64
Alert Count: 36
First Seen: Sun Jan 11 17:55:13 2009
Last Seen: Mon Aug 10 18:13:17 2009
Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1249899197.933:18): avc:
denied { search } for pid=4041 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1249899197.933:18): avc:
denied { search } for pid=4041 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899197.933:18):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fff31d13e20 a2=13
a3=8 items=0 ppid=1 pid=4041 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899197.933:18):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fff31d13e20 a2=13
a3=8 items=0 ppid=1 pid=4041 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
Summary
SELinux is preventing the setxkbmap from using potentially mislabeled
files (./.X11-unix).
Detailed Description
[SELinux is in permissive mode, the operation would have been denied but
was permitted due to permissive mode.]
SELinux has denied setxkbmap access to potentially mislabeled file(s)
(./.X11-unix). This means that SELinux will not allow setxkbmap to use
these files. It is common for users to edit files in their home
directory or tmp directories and then move (mv) them to system
directories. The problem is that the files end up with the wrong file
context which confined applications are not allowed to access.
Allowing Access
If you want setxkbmap to access this files, you need to relabel them
using restorecon -v './.X11-unix'. You might want to relabel the entire
directory using restorecon -R -v './.X11-unix'.
Additional Information
Source Context: system_u:system_r:rhgb_t
Target Context: system_u:object_r:initrc_tmp_t
Target Objects: ./.X11-unix [ dir ]
Source: setxkbmap
Source Path: /usr/bin/setxkbmap
Port: <Unknown>
Host: C5.aardvark.com.au
Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
Target RPM Packages:
Policy RPM: selinux-policy-2.4.6-225.el5
Selinux Enabled: True
Policy Type: targeted
MLS Enabled: True
Enforcing Mode: Permissive
Plugin Name: home_tmp_bad_labels
Host Name: C5.aardvark.com.au
Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue Aug
4 20:19:25 EDT 2009 x86_64 x86_64
Alert Count: 37
First Seen: Sun Jan 11 17:55:13 2009
Last Seen: Mon Aug 10 18:13:19 2009
Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1249899199.903:20): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1249899199.903:20): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899199.903:20):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899199.903:20):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
6:53 p.m.
I am running Centos 5.3 in permissive mode - and recently I started
getting 4 avcs every time I boot the server. I am not sure - but I think
these might have started when I changed my desktop from Gnome to KDE. I
have tried the relabelling suggested in the AVC - but this hasn't fixed it.
Does it look like I have something set up wrong - or is there a policy
problem?
Richard.
Summary
SELinux is preventing the setxkbmap from using potentially mislabeled
files (./.X11-unix).
Detailed Description
[SELinux is in permissive mode, the operation would have been denied but
was permitted due to permissive mode.]
SELinux has denied setxkbmap access to potentially mislabeled file(s)
(./.X11-unix). This means that SELinux will not allow setxkbmap to use
these files. It is common for users to edit files in their home
directory or tmp directories and then move (mv) them to system
directories. The problem is that the files end up with the wrong file
context which confined applications are not allowed to access.
Allowing Access
If you want setxkbmap to access this files, you need to relabel them
using restorecon -v './.X11-unix'. You might want to relabel the entire
directory using restorecon -R -v './.X11-unix'.
Additional Information
Source Context: system_u:system_r:rhgb_t
Target Context: system_u:object_r:initrc_tmp_t
Target Objects: ./.X11-unix [ dir ]
Source: setxkbmap
Source Path: /usr/bin/setxkbmap
Port: <Unknown>
Host: C5.aardvark.com.au
Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
Target RPM Packages:
Policy RPM: selinux-policy-2.4.6-225.el5
Selinux Enabled: True
Policy Type: targeted
MLS Enabled: True
Enforcing Mode: Permissive
Plugin Name: home_tmp_bad_labels
Host Name: C5.aardvark.com.au
Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue
Aug 4 20:19:25 EDT 2009 x86_64 x86_64
Alert Count: 34
First Seen: Sun Jan 11 17:55:13 2009
Last Seen: Mon Aug 10 18:13:15 2009
Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1249899195.897:15): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1249899195.897:15): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899195.897:15):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=3d29351a30 items=0 ppid=4021 pid=4022 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="setxkbmap" exe="/usr/bin/setxkbmap"
subj=system_u:system_r:rhgb_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899195.897:15):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=3d29351a30 items=0 ppid=4021 pid=4022 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="setxkbmap" exe="/usr/bin/setxkbmap"
subj=system_u:system_r:rhgb_t:s0 key=(null)
Summary
SELinux is preventing the setxkbmap from using potentially mislabeled
files (./.X11-unix).
Detailed Description
[SELinux is in permissive mode, the operation would have been denied but
was permitted due to permissive mode.]
SELinux has denied setxkbmap access to potentially mislabeled file(s)
(./.X11-unix). This means that SELinux will not allow setxkbmap to use
these files. It is common for users to edit files in their home
directory or tmp directories and then move (mv) them to system
directories. The problem is that the files end up with the wrong file
context which confined applications are not allowed to access.
Allowing Access
If you want setxkbmap to access this files, you need to relabel them
using restorecon -v './.X11-unix'. You might want to relabel the entire
directory using restorecon -R -v './.X11-unix'.
Additional Information
Source Context: system_u:system_r:rhgb_t
Target Context: system_u:object_r:initrc_tmp_t
Target Objects: ./.X11-unix [ dir ]
Source: setxkbmap
Source Path: /usr/bin/setxkbmap
Port: <Unknown>
Host: C5.aardvark.com.au
Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
Target RPM Packages:
Policy RPM: selinux-policy-2.4.6-225.el5
Selinux Enabled: True
Policy Type: targeted
MLS Enabled: True
Enforcing Mode: Permissive
Plugin Name: home_tmp_bad_labels
Host Name: C5.aardvark.com.au
Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue
Aug 4 20:19:25 EDT 2009 x86_64 x86_64
Alert Count: 35
First Seen: Sun Jan 11 17:55:13 2009
Last Seen: Mon Aug 10 18:13:16 2009
Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1249899196.898:16): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1249899196.898:16): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899196.898:16):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899196.898:16):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
Summary
SELinux is preventing the setxkbmap from using potentially mislabeled
files (./.X11-unix).
Detailed Description
[SELinux is in permissive mode, the operation would have been denied but
was permitted due to permissive mode.]
SELinux has denied setxkbmap access to potentially mislabeled file(s)
(./.X11-unix). This means that SELinux will not allow setxkbmap to use
these files. It is common for users to edit files in their home
directory or tmp directories and then move (mv) them to system
directories. The problem is that the files end up with the wrong file
context which confined applications are not allowed to access.
Allowing Access
If you want setxkbmap to access this files, you need to relabel them
using restorecon -v './.X11-unix'. You might want to relabel the entire
directory using restorecon -R -v './.X11-unix'.
Additional Information
Source Context: system_u:system_r:rhgb_t
Target Context: system_u:object_r:initrc_tmp_t
Target Objects: ./.X11-unix [ dir ]
Source: setxkbmap
Source Path: /usr/bin/setxkbmap
Port: <Unknown>
Host: C5.aardvark.com.au
Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
Target RPM Packages:
Policy RPM: selinux-policy-2.4.6-225.el5
Selinux Enabled: True
Policy Type: targeted
MLS Enabled: True
Enforcing Mode: Permissive
Plugin Name: home_tmp_bad_labels
Host Name: C5.aardvark.com.au
Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue
Aug 4 20:19:25 EDT 2009 x86_64 x86_64
Alert Count: 36
First Seen: Sun Jan 11 17:55:13 2009
Last Seen: Mon Aug 10 18:13:17 2009
Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1249899197.933:18): avc:
denied { search } for pid=4041 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1249899197.933:18): avc:
denied { search } for pid=4041 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899197.933:18):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fff31d13e20 a2=13
a3=8 items=0 ppid=1 pid=4041 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899197.933:18):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fff31d13e20 a2=13
a3=8 items=0 ppid=1 pid=4041 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
Summary
SELinux is preventing the setxkbmap from using potentially mislabeled
files (./.X11-unix).
Detailed Description
[SELinux is in permissive mode, the operation would have been denied but
was permitted due to permissive mode.]
SELinux has denied setxkbmap access to potentially mislabeled file(s)
(./.X11-unix). This means that SELinux will not allow setxkbmap to use
these files. It is common for users to edit files in their home
directory or tmp directories and then move (mv) them to system
directories. The problem is that the files end up with the wrong file
context which confined applications are not allowed to access.
Allowing Access
If you want setxkbmap to access this files, you need to relabel them
using restorecon -v './.X11-unix'. You might want to relabel the entire
directory using restorecon -R -v './.X11-unix'.
Additional Information
Source Context: system_u:system_r:rhgb_t
Target Context: system_u:object_r:initrc_tmp_t
Target Objects: ./.X11-unix [ dir ]
Source: setxkbmap
Source Path: /usr/bin/setxkbmap
Port: <Unknown>
Host: C5.aardvark.com.au
Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
Target RPM Packages:
Policy RPM: selinux-policy-2.4.6-225.el5
Selinux Enabled: True
Policy Type: targeted
MLS Enabled: True
Enforcing Mode: Permissive
Plugin Name: home_tmp_bad_labels
Host Name: C5.aardvark.com.au
Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue
Aug 4 20:19:25 EDT 2009 x86_64 x86_64
Alert Count: 37
First Seen: Sun Jan 11 17:55:13 2009
Last Seen: Mon Aug 10 18:13:19 2009
Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1249899199.903:20): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1249899199.903:20): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899199.903:20):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899199.903:20):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
1:19 p.m.
On 08/12/2009 07:53 PM, Richard Chapman wrote:
I am running Centos 5.3 in permissive mode - and recently I started
getting 4 avcs every time I boot the server. I am not sure - but I think
these might have started when I changed my desktop from Gnome to KDE. I
have tried the relabelling suggested in the AVC - but this hasn't fixed it.
Does it look like I have something set up wrong - or is there a policy
problem?
Richard.
Summary
SELinux is preventing the setxkbmap from using potentially mislabeled
files (./.X11-unix).
Detailed Description
[SELinux is in permissive mode, the operation would have been denied but
was permitted due to permissive mode.]
SELinux has denied setxkbmap access to potentially mislabeled file(s)
(./.X11-unix). This means that SELinux will not allow setxkbmap to use
these files. It is common for users to edit files in their home
directory or tmp directories and then move (mv) them to system
directories. The problem is that the files end up with the wrong file
context which confined applications are not allowed to access.
Allowing Access
If you want setxkbmap to access this files, you need to relabel them
using restorecon -v './.X11-unix'. You might want to relabel the entire
directory using restorecon -R -v './.X11-unix'.
Additional Information
Source Context: system_u:system_r:rhgb_t
Target Context: system_u:object_r:initrc_tmp_t
Target Objects: ./.X11-unix [ dir ]
Source: setxkbmap
Source Path: /usr/bin/setxkbmap
Port: <Unknown>
Host: C5.aardvark.com.au
Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
Target RPM Packages: Policy RPM: selinux-policy-2.4.6-225.el5
Selinux Enabled: True
Policy Type: targeted
MLS Enabled: True
Enforcing Mode: Permissive
Plugin Name: home_tmp_bad_labels
Host Name: C5.aardvark.com.au
Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue
Aug 4 20:19:25 EDT 2009 x86_64 x86_64
Alert Count: 34
First Seen: Sun Jan 11 17:55:13 2009
Last Seen: Mon Aug 10 18:13:15 2009
Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1249899195.897:15): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1249899195.897:15): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899195.897:15):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=3d29351a30 items=0 ppid=4021 pid=4022 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="setxkbmap" exe="/usr/bin/setxkbmap"
subj=system_u:system_r:rhgb_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899195.897:15):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=3d29351a30 items=0 ppid=4021 pid=4022 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="setxkbmap" exe="/usr/bin/setxkbmap"
subj=system_u:system_r:rhgb_t:s0 key=(null)
Summary
SELinux is preventing the setxkbmap from using potentially mislabeled
files (./.X11-unix).
Detailed Description
[SELinux is in permissive mode, the operation would have been denied but
was permitted due to permissive mode.]
SELinux has denied setxkbmap access to potentially mislabeled file(s)
(./.X11-unix). This means that SELinux will not allow setxkbmap to use
these files. It is common for users to edit files in their home
directory or tmp directories and then move (mv) them to system
directories. The problem is that the files end up with the wrong file
context which confined applications are not allowed to access.
Allowing Access
If you want setxkbmap to access this files, you need to relabel them
using restorecon -v './.X11-unix'. You might want to relabel the entire
directory using restorecon -R -v './.X11-unix'.
Additional Information
Source Context: system_u:system_r:rhgb_t
Target Context: system_u:object_r:initrc_tmp_t
Target Objects: ./.X11-unix [ dir ]
Source: setxkbmap
Source Path: /usr/bin/setxkbmap
Port: <Unknown>
Host: C5.aardvark.com.au
Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
Target RPM Packages: Policy RPM: selinux-policy-2.4.6-225.el5
Selinux Enabled: True
Policy Type: targeted
MLS Enabled: True
Enforcing Mode: Permissive
Plugin Name: home_tmp_bad_labels
Host Name: C5.aardvark.com.au
Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue
Aug 4 20:19:25 EDT 2009 x86_64 x86_64
Alert Count: 35
First Seen: Sun Jan 11 17:55:13 2009
Last Seen: Mon Aug 10 18:13:16 2009
Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1249899196.898:16): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1249899196.898:16): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899196.898:16):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899196.898:16):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
Summary
SELinux is preventing the setxkbmap from using potentially mislabeled
files (./.X11-unix).
Detailed Description
[SELinux is in permissive mode, the operation would have been denied but
was permitted due to permissive mode.]
SELinux has denied setxkbmap access to potentially mislabeled file(s)
(./.X11-unix). This means that SELinux will not allow setxkbmap to use
these files. It is common for users to edit files in their home
directory or tmp directories and then move (mv) them to system
directories. The problem is that the files end up with the wrong file
context which confined applications are not allowed to access.
Allowing Access
If you want setxkbmap to access this files, you need to relabel them
using restorecon -v './.X11-unix'. You might want to relabel the entire
directory using restorecon -R -v './.X11-unix'.
Additional Information
Source Context: system_u:system_r:rhgb_t
Target Context: system_u:object_r:initrc_tmp_t
Target Objects: ./.X11-unix [ dir ]
Source: setxkbmap
Source Path: /usr/bin/setxkbmap
Port: <Unknown>
Host: C5.aardvark.com.au
Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
Target RPM Packages: Policy RPM: selinux-policy-2.4.6-225.el5
Selinux Enabled: True
Policy Type: targeted
MLS Enabled: True
Enforcing Mode: Permissive
Plugin Name: home_tmp_bad_labels
Host Name: C5.aardvark.com.au
Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue
Aug 4 20:19:25 EDT 2009 x86_64 x86_64
Alert Count: 36
First Seen: Sun Jan 11 17:55:13 2009
Last Seen: Mon Aug 10 18:13:17 2009
Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1249899197.933:18): avc:
denied { search } for pid=4041 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1249899197.933:18): avc:
denied { search } for pid=4041 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899197.933:18):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fff31d13e20 a2=13
a3=8 items=0 ppid=1 pid=4041 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899197.933:18):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fff31d13e20 a2=13
a3=8 items=0 ppid=1 pid=4041 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
Summary
SELinux is preventing the setxkbmap from using potentially mislabeled
files (./.X11-unix).
Detailed Description
[SELinux is in permissive mode, the operation would have been denied but
was permitted due to permissive mode.]
SELinux has denied setxkbmap access to potentially mislabeled file(s)
(./.X11-unix). This means that SELinux will not allow setxkbmap to use
these files. It is common for users to edit files in their home
directory or tmp directories and then move (mv) them to system
directories. The problem is that the files end up with the wrong file
context which confined applications are not allowed to access.
Allowing Access
If you want setxkbmap to access this files, you need to relabel them
using restorecon -v './.X11-unix'. You might want to relabel the entire
directory using restorecon -R -v './.X11-unix'.
Additional Information
Source Context: system_u:system_r:rhgb_t
Target Context: system_u:object_r:initrc_tmp_t
Target Objects: ./.X11-unix [ dir ]
Source: setxkbmap
Source Path: /usr/bin/setxkbmap
Port: <Unknown>
Host: C5.aardvark.com.au
Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
Target RPM Packages: Policy RPM: selinux-policy-2.4.6-225.el5
Selinux Enabled: True
Policy Type: targeted
MLS Enabled: True
Enforcing Mode: Permissive
Plugin Name: home_tmp_bad_labels
Host Name: C5.aardvark.com.au
Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue
Aug 4 20:19:25 EDT 2009 x86_64 x86_64
Alert Count: 37
First Seen: Sun Jan 11 17:55:13 2009
Last Seen: Mon Aug 10 18:13:19 2009
Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1249899199.903:20): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1249899199.903:20): avc:
denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899199.903:20):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899199.903:20):
arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
chcon -R -t
xserver_tmp_t /tmp/.X11-unix
I always use tmpfs for /tmp, so I never end up with garbage on a reboot.
11:19 p.m.
Daniel J Walsh wrote:
On 08/12/2009 07:53 PM, Richard Chapman wrote:
> I am running Centos 5.3 in permissive mode - and recently I started
> getting 4 avcs every time I boot the server. I am not sure - but I think
> these might have started when I changed my desktop from Gnome to KDE. I
> have tried the relabelling suggested in the AVC - but this hasn't fixed it.
> Does it look like I have something set up wrong - or is there a policy
> problem?
> Richard.
>
>
> Summary
> SELinux is preventing the setxkbmap from using potentially mislabeled
> files (./.X11-unix).
> Detailed Description
> [SELinux is in permissive mode, the operation would have been denied but
> was permitted due to permissive mode.]
>
> SELinux has denied setxkbmap access to potentially mislabeled file(s)
> (./.X11-unix). This means that SELinux will not allow setxkbmap to use
> these files. It is common for users to edit files in their home
> directory or tmp directories and then move (mv) them to system
> directories. The problem is that the files end up with the wrong file
> context which confined applications are not allowed to access.
>
> Allowing Access
> If you want setxkbmap to access this files, you need to relabel them
> using restorecon -v './.X11-unix'. You might want to relabel the entire
> directory using restorecon -R -v './.X11-unix'.
> Additional Information
>
> Source Context: system_u:system_r:rhgb_t
> Target Context: system_u:object_r:initrc_tmp_t
> Target Objects: ./.X11-unix [ dir ]
> Source: setxkbmap
> Source Path: /usr/bin/setxkbmap
> Port: <Unknown>
> Host: C5.aardvark.com.au
> Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
> Target RPM Packages: Policy RPM: selinux-policy-2.4.6-225.el5
> Selinux Enabled: True
> Policy Type: targeted
> MLS Enabled: True
> Enforcing Mode: Permissive
> Plugin Name: home_tmp_bad_labels
> Host Name: C5.aardvark.com.au
> Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue
> Aug 4 20:19:25 EDT 2009 x86_64 x86_64
> Alert Count: 34
> First Seen: Sun Jan 11 17:55:13 2009
> Last Seen: Mon Aug 10 18:13:15 2009
> Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
> Line Numbers:
> Raw Audit Messages :
>
> host=C5.aardvark.com.au type=AVC msg=audit(1249899195.897:15): avc:
> denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
> host=C5.aardvark.com.au type=AVC msg=audit(1249899195.897:15): avc:
> denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899195.897:15):
> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
> a3=3d29351a30 items=0 ppid=4021 pid=4022 auid=4294967295 uid=0 gid=0
> euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
> comm="setxkbmap" exe="/usr/bin/setxkbmap"
> subj=system_u:system_r:rhgb_t:s0 key=(null)
> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899195.897:15):
> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
> a3=3d29351a30 items=0 ppid=4021 pid=4022 auid=4294967295 uid=0 gid=0
> euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
> comm="setxkbmap" exe="/usr/bin/setxkbmap"
> subj=system_u:system_r:rhgb_t:s0 key=(null)
>
>
> Summary
> SELinux is preventing the setxkbmap from using potentially mislabeled
> files (./.X11-unix).
> Detailed Description
> [SELinux is in permissive mode, the operation would have been denied but
> was permitted due to permissive mode.]
>
> SELinux has denied setxkbmap access to potentially mislabeled file(s)
> (./.X11-unix). This means that SELinux will not allow setxkbmap to use
> these files. It is common for users to edit files in their home
> directory or tmp directories and then move (mv) them to system
> directories. The problem is that the files end up with the wrong file
> context which confined applications are not allowed to access.
>
> Allowing Access
> If you want setxkbmap to access this files, you need to relabel them
> using restorecon -v './.X11-unix'. You might want to relabel the entire
> directory using restorecon -R -v './.X11-unix'.
> Additional Information
>
> Source Context: system_u:system_r:rhgb_t
> Target Context: system_u:object_r:initrc_tmp_t
> Target Objects: ./.X11-unix [ dir ]
> Source: setxkbmap
> Source Path: /usr/bin/setxkbmap
> Port: <Unknown>
> Host: C5.aardvark.com.au
> Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
> Target RPM Packages: Policy RPM: selinux-policy-2.4.6-225.el5
> Selinux Enabled: True
> Policy Type: targeted
> MLS Enabled: True
> Enforcing Mode: Permissive
> Plugin Name: home_tmp_bad_labels
> Host Name: C5.aardvark.com.au
> Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue
> Aug 4 20:19:25 EDT 2009 x86_64 x86_64
> Alert Count: 35
> First Seen: Sun Jan 11 17:55:13 2009
> Last Seen: Mon Aug 10 18:13:16 2009
> Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
> Line Numbers:
> Raw Audit Messages :
>
> host=C5.aardvark.com.au type=AVC msg=audit(1249899196.898:16): avc:
> denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
> host=C5.aardvark.com.au type=AVC msg=audit(1249899196.898:16): avc:
> denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899196.898:16):
> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
> a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899196.898:16):
> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
> a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
>
>
> Summary
> SELinux is preventing the setxkbmap from using potentially mislabeled
> files (./.X11-unix).
> Detailed Description
> [SELinux is in permissive mode, the operation would have been denied but
> was permitted due to permissive mode.]
>
> SELinux has denied setxkbmap access to potentially mislabeled file(s)
> (./.X11-unix). This means that SELinux will not allow setxkbmap to use
> these files. It is common for users to edit files in their home
> directory or tmp directories and then move (mv) them to system
> directories. The problem is that the files end up with the wrong file
> context which confined applications are not allowed to access.
>
> Allowing Access
> If you want setxkbmap to access this files, you need to relabel them
> using restorecon -v './.X11-unix'. You might want to relabel the entire
> directory using restorecon -R -v './.X11-unix'.
> Additional Information
>
> Source Context: system_u:system_r:rhgb_t
> Target Context: system_u:object_r:initrc_tmp_t
> Target Objects: ./.X11-unix [ dir ]
> Source: setxkbmap
> Source Path: /usr/bin/setxkbmap
> Port: <Unknown>
> Host: C5.aardvark.com.au
> Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
> Target RPM Packages: Policy RPM: selinux-policy-2.4.6-225.el5
> Selinux Enabled: True
> Policy Type: targeted
> MLS Enabled: True
> Enforcing Mode: Permissive
> Plugin Name: home_tmp_bad_labels
> Host Name: C5.aardvark.com.au
> Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue
> Aug 4 20:19:25 EDT 2009 x86_64 x86_64
> Alert Count: 36
> First Seen: Sun Jan 11 17:55:13 2009
> Last Seen: Mon Aug 10 18:13:17 2009
> Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
> Line Numbers:
> Raw Audit Messages :
>
> host=C5.aardvark.com.au type=AVC msg=audit(1249899197.933:18): avc:
> denied { search } for pid=4041 comm="setxkbmap" name=".X11-unix"
> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
> host=C5.aardvark.com.au type=AVC msg=audit(1249899197.933:18): avc:
> denied { search } for pid=4041 comm="setxkbmap" name=".X11-unix"
> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899197.933:18):
> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fff31d13e20 a2=13
> a3=8 items=0 ppid=1 pid=4041 auid=4294967295 uid=0 gid=0 euid=0 suid=0
> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899197.933:18):
> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fff31d13e20 a2=13
> a3=8 items=0 ppid=1 pid=4041 auid=4294967295 uid=0 gid=0 euid=0 suid=0
> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
>
>
>
> Summary
> SELinux is preventing the setxkbmap from using potentially mislabeled
> files (./.X11-unix).
> Detailed Description
> [SELinux is in permissive mode, the operation would have been denied but
> was permitted due to permissive mode.]
>
> SELinux has denied setxkbmap access to potentially mislabeled file(s)
> (./.X11-unix). This means that SELinux will not allow setxkbmap to use
> these files. It is common for users to edit files in their home
> directory or tmp directories and then move (mv) them to system
> directories. The problem is that the files end up with the wrong file
> context which confined applications are not allowed to access.
>
> Allowing Access
> If you want setxkbmap to access this files, you need to relabel them
> using restorecon -v './.X11-unix'. You might want to relabel the entire
> directory using restorecon -R -v './.X11-unix'.
> Additional Information
>
> Source Context: system_u:system_r:rhgb_t
> Target Context: system_u:object_r:initrc_tmp_t
> Target Objects: ./.X11-unix [ dir ]
> Source: setxkbmap
> Source Path: /usr/bin/setxkbmap
> Port: <Unknown>
> Host: C5.aardvark.com.au
> Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
> Target RPM Packages: Policy RPM: selinux-policy-2.4.6-225.el5
> Selinux Enabled: True
> Policy Type: targeted
> MLS Enabled: True
> Enforcing Mode: Permissive
> Plugin Name: home_tmp_bad_labels
> Host Name: C5.aardvark.com.au
> Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue
> Aug 4 20:19:25 EDT 2009 x86_64 x86_64
> Alert Count: 37
> First Seen: Sun Jan 11 17:55:13 2009
> Last Seen: Mon Aug 10 18:13:19 2009
> Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
> Line Numbers:
> Raw Audit Messages :
>
> host=C5.aardvark.com.au type=AVC msg=audit(1249899199.903:20): avc:
> denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
> host=C5.aardvark.com.au type=AVC msg=audit(1249899199.903:20): avc:
> denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix"
> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899199.903:20):
> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
> a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899199.903:20):
> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
> a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setxkbmap"
> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
>
>
>
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>
chcon -R -t xserver_tmp_t /tmp/.X11-unix
I always use tmpfs for /tmp, so I never end up with garbage on a reboot.
Thanks Daniel - but this is the response...
[root@C5 ~]# chcon -R -t xserver_tmp_t /tmp/.X11-unix
chcon: failed to change context of /tmp/.X11-unix to
system_u:object_r:xserver_t mp_t: Invalid
argument
chcon: failed to change context of /tmp/.X11-unix/X0 to
system_u:object_r:xserve r_tmp_t: Invalid
argument
chcon: failed to change context of /tmp/.X11-unix/X1005 to
user_u:object_r:xserv er_tmp_t: Invalid argument
[root@C5 ~]#
Being pretty green - I don't really understand the problem here. Also -
if this chcon worked - would this be a permanent solution - or does it
need to be executed in a boot script?
I like your idea of using tmpfs - but is it ever a problem that tmpfs is
relatively small and finite? Also - please excuse my ignorance - but how
do I make tmpfs the tmp folder?
Richard.
7:25 a.m.
On 08/14/2009 12:19 AM, Richard Chapman wrote:
Daniel J Walsh wrote:
> On 08/12/2009 07:53 PM, Richard Chapman wrote:
>
>> I am running Centos 5.3 in permissive mode - and recently I started
>> getting 4 avcs every time I boot the server. I am not sure - but I think
>> these might have started when I changed my desktop from Gnome to KDE. I
>> have tried the relabelling suggested in the AVC - but this hasn't
>> fixed it.
>> Does it look like I have something set up wrong - or is there a policy
>> problem?
>> Richard.
>>
>>
>> Summary
>> SELinux is preventing the setxkbmap from using potentially mislabeled
>> files (./.X11-unix).
>> Detailed Description
>> [SELinux is in permissive mode, the operation would have been denied but
>> was permitted due to permissive mode.]
>>
>> SELinux has denied setxkbmap access to potentially mislabeled file(s)
>> (./.X11-unix). This means that SELinux will not allow setxkbmap to use
>> these files. It is common for users to edit files in their home
>> directory or tmp directories and then move (mv) them to system
>> directories. The problem is that the files end up with the wrong file
>> context which confined applications are not allowed to access.
>>
>> Allowing Access
>> If you want setxkbmap to access this files, you need to relabel them
>> using restorecon -v './.X11-unix'. You might want to relabel the entire
>> directory using restorecon -R -v './.X11-unix'.
>> Additional Information
>>
>> Source Context: system_u:system_r:rhgb_t
>> Target Context: system_u:object_r:initrc_tmp_t
>> Target Objects: ./.X11-unix [ dir ]
>> Source: setxkbmap
>> Source Path: /usr/bin/setxkbmap
>> Port: <Unknown>
>> Host: C5.aardvark.com.au
>> Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
>> Target RPM Packages: Policy RPM: selinux-policy-2.4.6-225.el5
>> Selinux Enabled: True
>> Policy Type: targeted
>> MLS Enabled: True
>> Enforcing Mode: Permissive
>> Plugin Name: home_tmp_bad_labels
>> Host Name: C5.aardvark.com.au
>> Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue
>> Aug 4 20:19:25 EDT 2009 x86_64 x86_64
>> Alert Count: 34
>> First Seen: Sun Jan 11 17:55:13 2009
>> Last Seen: Mon Aug 10 18:13:15 2009
>> Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
>> Line Numbers: Raw Audit Messages :
>>
>> host=C5.aardvark.com.au type=AVC msg=audit(1249899195.897:15): avc:
>> denied { search } for pid=4022 comm="setxkbmap"
name=".X11-unix"
>> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
>> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
>> host=C5.aardvark.com.au type=AVC msg=audit(1249899195.897:15): avc:
>> denied { search } for pid=4022 comm="setxkbmap"
name=".X11-unix"
>> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
>> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
>> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899195.897:15):
>> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
>> a3=3d29351a30 items=0 ppid=4021 pid=4022 auid=4294967295 uid=0 gid=0
>> euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
>> comm="setxkbmap" exe="/usr/bin/setxkbmap"
>> subj=system_u:system_r:rhgb_t:s0 key=(null)
>> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899195.897:15):
>> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
>> a3=3d29351a30 items=0 ppid=4021 pid=4022 auid=4294967295 uid=0 gid=0
>> euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
>> comm="setxkbmap" exe="/usr/bin/setxkbmap"
>> subj=system_u:system_r:rhgb_t:s0 key=(null)
>>
>>
>> Summary
>> SELinux is preventing the setxkbmap from using potentially mislabeled
>> files (./.X11-unix).
>> Detailed Description
>> [SELinux is in permissive mode, the operation would have been denied but
>> was permitted due to permissive mode.]
>>
>> SELinux has denied setxkbmap access to potentially mislabeled file(s)
>> (./.X11-unix). This means that SELinux will not allow setxkbmap to use
>> these files. It is common for users to edit files in their home
>> directory or tmp directories and then move (mv) them to system
>> directories. The problem is that the files end up with the wrong file
>> context which confined applications are not allowed to access.
>>
>> Allowing Access
>> If you want setxkbmap to access this files, you need to relabel them
>> using restorecon -v './.X11-unix'. You might want to relabel the entire
>> directory using restorecon -R -v './.X11-unix'.
>> Additional Information
>>
>> Source Context: system_u:system_r:rhgb_t
>> Target Context: system_u:object_r:initrc_tmp_t
>> Target Objects: ./.X11-unix [ dir ]
>> Source: setxkbmap
>> Source Path: /usr/bin/setxkbmap
>> Port: <Unknown>
>> Host: C5.aardvark.com.au
>> Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
>> Target RPM Packages: Policy RPM: selinux-policy-2.4.6-225.el5
>> Selinux Enabled: True
>> Policy Type: targeted
>> MLS Enabled: True
>> Enforcing Mode: Permissive
>> Plugin Name: home_tmp_bad_labels
>> Host Name: C5.aardvark.com.au
>> Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue
>> Aug 4 20:19:25 EDT 2009 x86_64 x86_64
>> Alert Count: 35
>> First Seen: Sun Jan 11 17:55:13 2009
>> Last Seen: Mon Aug 10 18:13:16 2009
>> Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
>> Line Numbers: Raw Audit Messages :
>>
>> host=C5.aardvark.com.au type=AVC msg=audit(1249899196.898:16): avc:
>> denied { search } for pid=4022 comm="setxkbmap"
name=".X11-unix"
>> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
>> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
>> host=C5.aardvark.com.au type=AVC msg=audit(1249899196.898:16): avc:
>> denied { search } for pid=4022 comm="setxkbmap"
name=".X11-unix"
>> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
>> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
>> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899196.898:16):
>> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
>> a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="setxkbmap"
>> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
>> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899196.898:16):
>> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
>> a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="setxkbmap"
>> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
>>
>>
>> Summary
>> SELinux is preventing the setxkbmap from using potentially mislabeled
>> files (./.X11-unix).
>> Detailed Description
>> [SELinux is in permissive mode, the operation would have been denied but
>> was permitted due to permissive mode.]
>>
>> SELinux has denied setxkbmap access to potentially mislabeled file(s)
>> (./.X11-unix). This means that SELinux will not allow setxkbmap to use
>> these files. It is common for users to edit files in their home
>> directory or tmp directories and then move (mv) them to system
>> directories. The problem is that the files end up with the wrong file
>> context which confined applications are not allowed to access.
>>
>> Allowing Access
>> If you want setxkbmap to access this files, you need to relabel them
>> using restorecon -v './.X11-unix'. You might want to relabel the entire
>> directory using restorecon -R -v './.X11-unix'.
>> Additional Information
>>
>> Source Context: system_u:system_r:rhgb_t
>> Target Context: system_u:object_r:initrc_tmp_t
>> Target Objects: ./.X11-unix [ dir ]
>> Source: setxkbmap
>> Source Path: /usr/bin/setxkbmap
>> Port: <Unknown>
>> Host: C5.aardvark.com.au
>> Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
>> Target RPM Packages: Policy RPM: selinux-policy-2.4.6-225.el5
>> Selinux Enabled: True
>> Policy Type: targeted
>> MLS Enabled: True
>> Enforcing Mode: Permissive
>> Plugin Name: home_tmp_bad_labels
>> Host Name: C5.aardvark.com.au
>> Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue
>> Aug 4 20:19:25 EDT 2009 x86_64 x86_64
>> Alert Count: 36
>> First Seen: Sun Jan 11 17:55:13 2009
>> Last Seen: Mon Aug 10 18:13:17 2009
>> Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
>> Line Numbers: Raw Audit Messages :
>>
>> host=C5.aardvark.com.au type=AVC msg=audit(1249899197.933:18): avc:
>> denied { search } for pid=4041 comm="setxkbmap"
name=".X11-unix"
>> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
>> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
>> host=C5.aardvark.com.au type=AVC msg=audit(1249899197.933:18): avc:
>> denied { search } for pid=4041 comm="setxkbmap"
name=".X11-unix"
>> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
>> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
>> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899197.933:18):
>> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fff31d13e20 a2=13
>> a3=8 items=0 ppid=1 pid=4041 auid=4294967295 uid=0 gid=0 euid=0 suid=0
>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="setxkbmap"
>> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
>> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899197.933:18):
>> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fff31d13e20 a2=13
>> a3=8 items=0 ppid=1 pid=4041 auid=4294967295 uid=0 gid=0 euid=0 suid=0
>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="setxkbmap"
>> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
>>
>>
>>
>> Summary
>> SELinux is preventing the setxkbmap from using potentially mislabeled
>> files (./.X11-unix).
>> Detailed Description
>> [SELinux is in permissive mode, the operation would have been denied but
>> was permitted due to permissive mode.]
>>
>> SELinux has denied setxkbmap access to potentially mislabeled file(s)
>> (./.X11-unix). This means that SELinux will not allow setxkbmap to use
>> these files. It is common for users to edit files in their home
>> directory or tmp directories and then move (mv) them to system
>> directories. The problem is that the files end up with the wrong file
>> context which confined applications are not allowed to access.
>>
>> Allowing Access
>> If you want setxkbmap to access this files, you need to relabel them
>> using restorecon -v './.X11-unix'. You might want to relabel the entire
>> directory using restorecon -R -v './.X11-unix'.
>> Additional Information
>>
>> Source Context: system_u:system_r:rhgb_t
>> Target Context: system_u:object_r:initrc_tmp_t
>> Target Objects: ./.X11-unix [ dir ]
>> Source: setxkbmap
>> Source Path: /usr/bin/setxkbmap
>> Port: <Unknown>
>> Host: C5.aardvark.com.au
>> Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1
>> Target RPM Packages: Policy RPM: selinux-policy-2.4.6-225.el5
>> Selinux Enabled: True
>> Policy Type: targeted
>> MLS Enabled: True
>> Enforcing Mode: Permissive
>> Plugin Name: home_tmp_bad_labels
>> Host Name: C5.aardvark.com.au
>> Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue
>> Aug 4 20:19:25 EDT 2009 x86_64 x86_64
>> Alert Count: 37
>> First Seen: Sun Jan 11 17:55:13 2009
>> Last Seen: Mon Aug 10 18:13:19 2009
>> Local ID: 0950df01-cfad-420a-9e84-4996a8d31942
>> Line Numbers: Raw Audit Messages :
>>
>> host=C5.aardvark.com.au type=AVC msg=audit(1249899199.903:20): avc:
>> denied { search } for pid=4022 comm="setxkbmap"
name=".X11-unix"
>> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
>> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
>> host=C5.aardvark.com.au type=AVC msg=audit(1249899199.903:20): avc:
>> denied { search } for pid=4022 comm="setxkbmap"
name=".X11-unix"
>> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0
>> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
>> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899199.903:20):
>> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
>> a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="setxkbmap"
>> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
>> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899199.903:20):
>> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13
>> a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0
>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="setxkbmap"
>> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null)
>>
>>
>>
>>
>> --
>> fedora-selinux-list mailing list
>> fedora-selinux-list(a)redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>>
> chcon -R -t xserver_tmp_t /tmp/.X11-unix
>
> I always use tmpfs for /tmp, so I never end up with garbage on a reboot.
>
>
Thanks Daniel - but this is the response...
[root@C5 ~]# chcon -R -t xserver_tmp_t /tmp/.X11-unix
chcon: failed to change context of /tmp/.X11-unix to
system_u:object_r:xserver_t mp_t: Invalid
argument
chcon: failed to change context of /tmp/.X11-unix/X0 to
system_u:object_r:xserve r_tmp_t: Invalid
argument
chcon: failed to change context of /tmp/.X11-unix/X1005 to
user_u:object_r:xserv er_tmp_t: Invalid
argument
[root@C5 ~]#
Being pretty green - I don't really understand the problem here. Also -
if this chcon worked - would this be a permanent solution - or does it
need to be executed in a boot script?
I like your idea of using tmpfs - but is it ever a problem that tmpfs is
relatively small and finite? Also - please excuse my ignorance - but how
do I make tmpfs the tmp folder?
Richard.
Must have changed between RHEL5 and F11
Try
chcon -R -t xdm_xserver_tmp_t /tmp/.X11-unix
Add this line to /etc/fstab
tmpfs /tmp tmpfs
rootcontext="system_u:object_r:tmp_t:s0",defaults 0 0
And reboot.
I don't tend to store huge abouts of stuff in /tmp. If I want to store big stuff I
can always use /var/tmp
7:50 a.m.
New subject: [OT] tmpfs - was : AVC every server boot: SELinux is preventing the setxkbmap from using potentially mislabeled files (./.X11-unix).
On Fri, 2009-08-14 at 08:25 -0400, Daniel J Walsh wrote:
On 08/14/2009 12:19 AM, Richard Chapman wrote:
> Daniel J Walsh wrote:
>> On 08/12/2009 07:53 PM, Richard Chapman wrote:
[snip]
>>
>> I always use tmpfs for /tmp, so I never end up with garbage on a reboot.
>>
>>
> I like your idea of using tmpfs - but is it ever a problem that tmpfs is
> relatively small and finite? Also - please excuse my ignorance - but how
> do I make tmpfs the tmp folder?
>
> Richard.
>
>
Must have changed between RHEL5 and F11
Try
chcon -R -t xdm_xserver_tmp_t /tmp/.X11-unix
Add this line to /etc/fstab
tmpfs /tmp tmpfs
rootcontext="system_u:object_r:tmp_t:s0",defaults 0 0
And reboot.
I don't tend to store huge abouts of stuff in /tmp. If I want to store big stuff I
can always use /var/tmp
Forgive the off-topic response, but I too like the idea of a
self-washing /tmp. However I am concerned that I don't really understand
how it works. What, for example, would be the effect of doing this on
server which has only limited RAM and is only rebooted periodically.
Would all the RAM get filled up over time by tmpfs and then everything
would have to run in swap?
Would I need to reboot regularly just to clean tmpfs?
I do like the idea and have just implemented it on my desktop machine
which has more RAM and gets shut down every day...
Thanks...
Mark
8:28 a.m.
New subject: [OT] tmpfs - was : AVC every server boot: SELinux is preventing the setxkbmap from using potentially mislabeled files (./.X11-unix).
On 08/14/2009 08:50 AM, Arthur Dent wrote:
On Fri, 2009-08-14 at 08:25 -0400, Daniel J Walsh wrote:
> On 08/14/2009 12:19 AM, Richard Chapman wrote:
>> Daniel J Walsh wrote:
>>> On 08/12/2009 07:53 PM, Richard Chapman wrote:
[snip]
>>>
>>> I always use tmpfs for /tmp, so I never end up with garbage on a reboot.
>>>
>>>
>> I like your idea of using tmpfs - but is it ever a problem that tmpfs is
>> relatively small and finite? Also - please excuse my ignorance - but how
>> do I make tmpfs the tmp folder?
>>
>> Richard.
>>
>>
> Must have changed between RHEL5 and F11
>
> Try
>
> chcon -R -t xdm_xserver_tmp_t /tmp/.X11-unix
>
> Add this line to /etc/fstab
>
> tmpfs /tmp tmpfs
rootcontext="system_u:object_r:tmp_t:s0",defaults 0 0
>
> And reboot.
>
> I don't tend to store huge abouts of stuff in /tmp. If I want to store big stuff
I can always use /var/tmp
Forgive the off-topic response, but I too like the idea of a
self-washing /tmp. However I am concerned that I don't really understand
how it works. What, for example, would be the effect of doing this on
server which has only limited RAM and is only rebooted periodically.
Would all the RAM get filled up over time by tmpfs and then everything
would have to run in swap?
Would I need to reboot regularly just to clean tmpfs?
Well there are tools like tmpwatch and tmpreaper that periodically clean up /tmp
files.
On a server or system with limited ram, this might not be a great idea, since you could
run out of
memory. I do not know if you can put a quota on it. I just don't store a lot of junk
on /tmp, so it is
never a problem. And I have had problems in the past with mislabeled files either via
SELinux or UID problems in
/tmp causing havoc with login.
I am on a personal crusade to stop all system services (processes running as UID=0) from
using /tmp. /var/tmp
I do like the idea and have just implemented it on my desktop
machine
which has more RAM and gets shut down every day...
Thanks...
Mark
------------------------------------------------------------------------
--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
6:50 p.m.
New subject: [OT] tmpfs - was : AVC every server boot: SELinux is preventing the setxkbmap from using potentially mislabeled files (./.X11-unix).
Hello.
I am on a personal crusade to stop all system services (processes
running as UID=0) from using /tmp. /var/tmp
I'm interested in this topic but I don't know how to find processes
running as UID=0 using /tmp or /var/tmp.
Thanks in advance.
2009/8/14 Daniel J Walsh <dwalsh(a)redhat.com>:
> On 08/14/2009 08:50 AM, Arthur Dent wrote:
>> On Fri, 2009-08-14 at 08:25 -0400, Daniel J Walsh wrote:
>>> On 08/14/2009 12:19 AM, Richard Chapman wrote:
>>>> Daniel J Walsh wrote:
>>>>> On 08/12/2009 07:53 PM, Richard Chapman wrote:
>>
>> [snip]
>>
>>>>>
>>>>> I always use tmpfs for /tmp, so I never end up with garbage on a
reboot.
>>>>>
>>>>>
>>>> I like your idea of using tmpfs - but is it ever a problem that tmpfs is
>>>> relatively small and finite? Also - please excuse my ignorance - but how
>>>> do I make tmpfs the tmp folder?
>>>>
>>>> Richard.
>>>>
>>>>
>>> Must have changed between RHEL5 and F11
>>>
>>> Try
>>>
>>> chcon -R -t xdm_xserver_tmp_t /tmp/.X11-unix
>>>
>>> Add this line to /etc/fstab
>>>
>>> tmpfs /tmp tmpfs
rootcontext="system_u:object_r:tmp_t:s0",defaults 0 0
>>>
>>> And reboot.
>>>
>>> I don't tend to store huge abouts of stuff in /tmp. If I want to store
big stuff I can always use /var/tmp
>>
>> Forgive the off-topic response, but I too like the idea of a
>> self-washing /tmp. However I am concerned that I don't really understand
>> how it works. What, for example, would be the effect of doing this on
>> server which has only limited RAM and is only rebooted periodically.
>> Would all the RAM get filled up over time by tmpfs and then everything
>> would have to run in swap?
>>
>> Would I need to reboot regularly just to clean tmpfs?
>>
> Well there are tools like tmpwatch and tmpreaper that periodically clean up /tmp
files.
>
> On a server or system with limited ram, this might not be a great idea, since you
could run out of
> memory. I do not know if you can put a quota on it. I just don't store a lot of
junk on /tmp, so it is
> never a problem. And I have had problems in the past with mislabeled files either
via SELinux or UID problems in
> /tmp causing havoc with login.
>
I am on a personal crusade to stop all system services (processes
running as UID=0) from using /tmp. /var/tmp
>
>> I do like the idea and have just implemented it on my desktop machine
>> which has more RAM and gets shut down every day...
>>
>> Thanks...
>>
>> Mark
>>
>>
>>
>> ------------------------------------------------------------------------
>>
>> --
>> fedora-selinux-list mailing list
>> fedora-selinux-list(a)redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>
--
http://intrajp.no-ip.com/ Home Page
4:15 p.m.
New subject: [OT] tmpfs - was : AVC every server boot: SELinux is preventing the setxkbmap from using potentially mislabeled files (./.X11-unix).
On 08/15/2009 07:50 PM, Shintaro Fujiwara wrote:
Hello.
> I am on a personal crusade to stop all system services (processes running as UID=0)
from using /tmp. /var/tmp
I'm interested in this topic but I don't know how to find processes
running as UID=0 using /tmp or /var/tmp.
Thanks in advance.
There is no good way other then grep. But any time I see a domain asking for tmp_t in
SELinux I always suggest to the developers to use /var/run instead.
4:22 p.m.
New subject: [OT] tmpfs - was : AVC every server boot: SELinux is preventing the setxkbmap from using potentially mislabeled files (./.X11-unix).
Thanks.
I understand.
Please persuade programmers not to use /tmp so easily.
I will follow your instructions.
2009/8/19 Daniel J Walsh <dwalsh(a)redhat.com>:
On 08/15/2009 07:50 PM, Shintaro Fujiwara wrote:
> Hello.
>
>> I am on a personal crusade to stop all system services (processes running as
UID=0) from using /tmp. /var/tmp
>
> I'm interested in this topic but I don't know how to find processes
> running as UID=0 using /tmp or /var/tmp.
>
> Thanks in advance.
>
>
There is no good way other then grep. But any time I see a domain asking for tmp_t in
SELinux I always suggest to the developers to use /var/run instead.
--
http://intrajp.no-ip.com/ Home Page
7:56 a.m.
On Fri, 2009-08-14 at 08:31 -0400, Garry T. Williams wrote:
On Friday 14 August 2009 00:19:17 Richard Chapman wrote:
> how do I make tmpfs the tmp folder?
Add these lines to your /etc/fstab file and reboot:
tmpfs /tmp tmpfs defaults 0 0
tmpfs /var/tmp tmpfs defaults 0 0
Interesting...
Does this mean that if /tmp fills up the available RAM it will start
using /var/tmp instead?
8:25 a.m.
On 08/14/2009 08:56 AM, Arthur Dent wrote:
On Fri, 2009-08-14 at 08:31 -0400, Garry T. Williams wrote:
> On Friday 14 August 2009 00:19:17 Richard Chapman wrote:
>> how do I make tmpfs the tmp folder?
>
> Add these lines to your /etc/fstab file and reboot:
>
> tmpfs /tmp tmpfs defaults 0 0
> tmpfs /var/tmp tmpfs defaults 0 0
>
Interesting...
Does this mean that if /tmp fills up the available RAM it will start
using /var/tmp instead?
No Just means that both are separate temporary memory file systems.
------------------------------------------------------------------------
--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
5357
days inactive
5364
days old
selinux@lists.fedoraproject.org
12 comments
5 participants
participants (5)
-
Arthur Dent -
Daniel J Walsh -
Garry Williams -
Richard Chapman -
Shintaro Fujiwara