needinfo canceled: [Bug 592089] SELinux is preventing /usr/lib/cups/backend/mfp "getattr" access to device /dev/mfpports/probe.

[Red Hat Bugzilla]

Product: Fedora
Version: 12
Component: selinux-policy

Simon <simon(a)conditional-fee.co.uk&gt; has canceled Bug Zapper
<triage(a)lists.fedoraproject.org&gt;&#39;s request for needinfo:
Bug 592089: SELinux is preventing /usr/lib/cups/backend/mfp "getattr" access to
device /dev/mfpports/probe.
https://bugzilla.redhat.com/show_bug.cgi?id=592089

------- Additional Comments from Simon <simon(a)conditional-fee.co.uk&gt;
Hello again,

I bought a samsung CLX-6220FX which prints OK but each time I try to use the
smatpanel or unified driver configurater selinux block it:-

SELinux is preventing /opt/Samsung/mfp/bin/Configurator from using the
execstack access on a process.

*****  Plugin allow_execstack (53.1 confidence) suggests  ********************

If you believe that 
None
should not require execstack
Then you should clear the execstack flag and see if
/opt/Samsung/mfp/bin/Configurator works correctly.
Report this as a bug on None.
You can clear the exestack flag by executing:
Do
execstack -c None

*****  Plugin catchall_boolean (42.6 confidence) suggests  *******************

If you want to allow unconfined executables to make their stack executable. 
This should never, ever be necessary. Probably indicates a badly coded
executable, but could indicate an attack. This executable should be reported in
bugzilla
Then you must tell SELinux about this by enabling the 'allow_execstack'
boolean.
Do
setsebool -P allow_execstack 1

*****  Plugin catchall (5.76 confidence) suggests  ***************************

If you believe that Configurator should be allowed execstack access on
processes labeled unconfined_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep Configurator /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context		     
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
			      023
Target Context		     
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
			      023
Target Objects		      Unknown [ process ]
Source			      Configurator
Source Path		      /opt/Samsung/mfp/bin/Configurator
Port			      <Unknown>
Host			      www.conditional-fee.co.uk
Source RPM Packages	      
Target RPM Packages	      
Policy RPM		      selinux-policy-3.9.7-44.fc14
Selinux Enabled 	      True
Policy Type		      targeted
Enforcing Mode		      Enforcing
Host Name		      www.conditional-fee.co.uk
Platform		      Linux www.conditional-fee.co.uk
			      2.6.35.14-97.fc14.i686.PAE #1 SMP Sat Sep 17
			      00:22:29 UTC 2011 i686 i686
Alert Count		      1
First Seen		      Sat 15 Oct 2011 17:11:32 BST
Last Seen		      Sat 15 Oct 2011 17:11:32 BST
Local ID		      b1f3562c-ec3e-48c8-9798-73102216119f

Raw Audit Messages
type=AVC msg=audit(1318695092.132:2519): avc:  denied  { execstack } for 
pid=14265 comm="Configurator"
scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process


type=SYSCALL msg=audit(1318695092.132:2519): arch=i386 syscall=mprotect
success=no exit=EACCES a0=bfb02000 a1=1000 a2=1000007 a3=bfb020ec items=0
ppid=1 pid=14265 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500
sgid=500 fsgid=500 tty=(none) ses=268 comm=Configurator
exe=/opt/Samsung/mfp/bin/Configurator
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)

Hash: Configurator,unconfined_t,unconfined_t,process,execstack

audit2allow

#============= unconfined_t ==============
#!!!! This avc can be allowed using the boolean 'allow_execstack'

allow unconfined_t self:process execstack;

audit2allow -R

#============= unconfined_t ==============
#!!!! This avc can be allowed using the boolean 'allow_execstack'


I want to use the scanning capability but not if the method involves any
security risk (I've got another scanner -not as good)

What are the implications of using execstack -c None
please?