needinfo canceled: [Bug 592089] SELinux is preventing /usr/lib/cups/backend/mfp "getattr" access to device /dev/mfpports/probe.
Product: Fedora
Version: 12
Component: selinux-policy
Simon <simon(a)conditional-fee.co.uk> has canceled Bug Zapper
<triage(a)lists.fedoraproject.org>'s request for needinfo:
Bug 592089: SELinux is preventing /usr/lib/cups/backend/mfp "getattr" access to
device /dev/mfpports/probe.
https://bugzilla.redhat.com/show_bug.cgi?id=592089
------- Additional Comments from Simon <simon(a)conditional-fee.co.uk>
Hello again,
I bought a samsung CLX-6220FX which prints OK but each time I try to use the
smatpanel or unified driver configurater selinux block it:-
SELinux is preventing /opt/Samsung/mfp/bin/Configurator from using the
execstack access on a process.
***** Plugin allow_execstack (53.1 confidence) suggests ********************
If you believe that
None
should not require execstack
Then you should clear the execstack flag and see if
/opt/Samsung/mfp/bin/Configurator works correctly.
Report this as a bug on None.
You can clear the exestack flag by executing:
Do
execstack -c None
***** Plugin catchall_boolean (42.6 confidence) suggests *******************
If you want to allow unconfined executables to make their stack executable.
This should never, ever be necessary. Probably indicates a badly coded
executable, but could indicate an attack. This executable should be reported in
bugzilla
Then you must tell SELinux about this by enabling the 'allow_execstack'
boolean.
Do
setsebool -P allow_execstack 1
***** Plugin catchall (5.76 confidence) suggests ***************************
If you believe that Configurator should be allowed execstack access on
processes labeled unconfined_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep Configurator /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
023
Target Context
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
023
Target Objects Unknown [ process ]
Source Configurator
Source Path /opt/Samsung/mfp/bin/Configurator
Port <Unknown>
Host www.conditional-fee.co.uk
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.9.7-44.fc14
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name www.conditional-fee.co.uk
Platform Linux www.conditional-fee.co.uk
2.6.35.14-97.fc14.i686.PAE #1 SMP Sat Sep 17
00:22:29 UTC 2011 i686 i686
Alert Count 1
First Seen Sat 15 Oct 2011 17:11:32 BST
Last Seen Sat 15 Oct 2011 17:11:32 BST
Local ID b1f3562c-ec3e-48c8-9798-73102216119f
Raw Audit Messages
type=AVC msg=audit(1318695092.132:2519): avc: denied { execstack } for
pid=14265 comm="Configurator"
scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process
type=SYSCALL msg=audit(1318695092.132:2519): arch=i386 syscall=mprotect
success=no exit=EACCES a0=bfb02000 a1=1000 a2=1000007 a3=bfb020ec items=0
ppid=1 pid=14265 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500
sgid=500 fsgid=500 tty=(none) ses=268 comm=Configurator
exe=/opt/Samsung/mfp/bin/Configurator
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
Hash: Configurator,unconfined_t,unconfined_t,process,execstack
audit2allow
#============= unconfined_t ==============
#!!!! This avc can be allowed using the boolean 'allow_execstack'
allow unconfined_t self:process execstack;
audit2allow -R
#============= unconfined_t ==============
#!!!! This avc can be allowed using the boolean 'allow_execstack'
I want to use the scanning capability but not if the method involves any
security risk (I've got another scanner -not as good)
What are the implications of using execstack -c None
please?