SELinux is preventing gdm-binary (xdm_t) "unlink" to ... and npviewer

Paul Howarth paul at city-fan.org
Sat Nov 15 08:51:28 UTC 2008


On Fri, 14 Nov 2008 18:02:33 -0800 (PST)
Antonio Olivares <olivares14031 at yahoo.com> wrote:

> --- On Fri, 11/14/08, Daniel J Walsh <dwalsh at redhat.com> wrote:
> 
> > From: Daniel J Walsh <dwalsh at redhat.com>
> > Subject: Re: SELinux is preventing gdm-binary (xdm_t) "unlink"
> > to ... and npviewer To: olivares14031 at yahoo.com
> > Cc: fedora-selinux-list at redhat.com
> > Date: Friday, November 14, 2008, 6:08 AM
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> > 
> > Antonio Olivares wrote:
> > > Dear selinux experts, 
> > > 
> > > running fedora 10 preview updated to latest packages 
> > > 
> > > [olivares at riohigh2 ~]$ uname -r
> > > 2.6.27.5-101.fc10.i686
> > > [olivares at riohigh2 ~]$ rpm -qa selinux*
> > > selinux-policy-3.5.13-18.fc10.noarch
> > > selinux-policy-targeted-3.5.13-18.fc10.noarch
> > > 
> > > 
> > > Summary:
> > > 
> > > SELinux is preventing gdm-binary (xdm_t)
> > "unlink" to
> > > ./force-display-on-active-vt (var_spool_t).
> > > 
> > > Detailed Description:
> > > 
> > > SELinux is preventing gdm-binary (xdm_t)
> > "unlink" to
> > > ./force-display-on-active-vt (var_spool_t). The
> > SELinux type var_spool_t, is a
> > > generic type for all files in the directory and very
> > few processes (SELinux
> > > Domains) are allowed to write to this SELinux type.
> > This type of denial usual
> > > indicates a mislabeled file. By default a file created
> > in a directory has the
> > > gets the context of the parent directory, but SELinux
> > policy has rules about the
> > > creation of directories, that say if a process running
> > in one SELinux Domain
> > > (D1) creates a file in a directory with a particular
> > SELinux File Context (F1)
> > > the file gets a different File Context (F2). The
> > policy usually allows the
> > > SELinux Domain (D1) the ability to write, unlink, and
> > append on (F2). But if for
> > > some reason a file (./force-display-on-active-vt) was
> > created with the wrong
> > > context, this domain will be denied. The usual
> > solution to this problem is to
> > > reset the file context on the target file, restorecon
> > -v
> > > './force-display-on-active-vt'. If the file
> > context does not change from
> > > var_spool_t, then this is probably a bug in policy.
> > Please file a bug report
> > > (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
> > against the selinux-policy
> > > package. If it does change, you can try your
> > application again to see if it
> > > works. The file context could have been mislabeled by
> > editing the file or moving
> > > the file from a different directory, if the file keeps
> > getting mislabeled, check
> > > the init scripts to see if they are doing something to
> > mislabel the file.
> > > 
> > > Allowing Access:
> > > 
> > > You can attempt to fix file context by executing
> > restorecon -v
> > > './force-display-on-active-vt'
> > > 
> > > Fix Command:
> > > 
> > > restorecon './force-display-on-active-vt'
> > > 
> > > Additional Information:
> > > 
> > > Source Context               
> > system_u:system_r:xdm_t:s0-s0:c0.c1023
> > > Target Context               
> > system_u:object_r:var_spool_t:s0
> > > Target Objects               
> > ./force-display-on-active-vt [ file ]
> > > Source                        gdm-binary
> > > Source Path                   /usr/sbin/gdm-binary
> > > Port                          <Unknown>
> > > Host                          riohigh2
> > > Source RPM Packages           gdm-2.24.0-12.fc10
> > > Target RPM Packages           
> > > Policy RPM                   
> > selinux-policy-3.5.13-18.fc10
> > > Selinux Enabled               True
> > > Policy Type                   targeted
> > > MLS Enabled                   True
> > > Enforcing Mode                Enforcing
> > > Plugin Name                   mislabeled_file
> > > Host Name                     riohigh2
> > > Platform                      Linux riohigh2
> > 2.6.27.5-94.fc10.i686 #1 SMP Mon
> > >                               Nov 10 15:51:55 EST 2008
> > i686 athlon
> > > Alert Count                   17
> > > First Seen                    Mon 03 Nov 2008 07:08:33
> > AM CST
> > > Last Seen                     Thu 13 Nov 2008 04:21:21
> > PM CST
> > > Local ID                     
> > a66adf6c-89d5-4d90-83ca-f34c94bb4d45
> > > Line Numbers                  
> > > 
> > > Raw Audit Messages            
> > > 
> > > node=riohigh2 type=AVC msg=audit(1226614881.881:36):
> > avc:  denied  { unlink } for  pid=2090
> > comm="gdm-binary"
> > name="force-display-on-active-vt" dev=sda6
> > ino=190494 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
> > tcontext=system_u:object_r:var_spool_t:s0 tclass=file
> > > 
> > > node=riohigh2 type=SYSCALL
> > msg=audit(1226614881.881:36): arch=40000003 syscall=10
> > success=no exit=-13 a0=8063b84 a1=0 a2=4f86dc a3=9940400
> > items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0
> > suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
> > ses=4294967295 comm="gdm-binary"
> > exe="/usr/sbin/gdm-binary"
> > subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
> > > 
> > > 
> > THe question here is which process created this file?
> > force-display-on-active-vt
> > 
> > > 
> > > 
> > > Summary:
> > > 
> > > SELinux is preventing the npviewer.bin from using
> > potentially mislabeled files
> > >
> > (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer).
> > > 
> > > Detailed Description:
> > > 
> > > SELinux has denied npviewer.bin access to potentially
> > mislabeled file(s)
> > >
> > (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer).
> > This means that
> > > SELinux will not allow npviewer.bin to use these
> > files. It is common for users
> > > to edit files in their home directory or tmp
> > directories and then move (mv) them
> > > to system directories. The problem is that the files
> > end up with the wrong file
> > > context which confined applications are not allowed to
> > access.
> > > 
> > > Allowing Access:
> > > 
> > > If you want npviewer.bin to access this files, you
> > need to relabel them using
> > > restorecon -v
> > '/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer'.
> > > You might want to relabel the entire directory using
> > restorecon -R -v '<Unknown>'.
> > > 
> > > Additional Information:
> > > 
> > > Source Context               
> > unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102
> > >                               3
> > > Target Context               
> > unconfined_u:object_r:user_home_t:s0
> > > Target Objects               
> > /home/olivares/.icedteaplugin/icedtea-plugin-to-
> > >                               appletviewer [ fifo_file
> > ]
> > > Source                        npviewer.bin
> > > Source Path                  
> > /usr/lib/nspluginwrapper/npviewer.bin
> > > Port                          <Unknown>
> > > Host                          riohigh2
> > > Source RPM Packages          
> > nspluginwrapper-1.1.2-4.fc10
> > > Target RPM Packages           
> > > Policy RPM                   
> > selinux-policy-3.5.13-18.fc10
> > > Selinux Enabled               True
> > > Policy Type                   targeted
> > > MLS Enabled                   True
> > > Enforcing Mode                Enforcing
> > > Plugin Name                   home_tmp_bad_labels
> > > Host Name                     riohigh2
> > > Platform                      Linux riohigh2
> > 2.6.27.5-101.fc10.i686 #1 SMP Wed
> > >                               Nov 12 00:50:43 EST 2008
> > i686 athlon
> > > Alert Count                   4
> > > First Seen                    Thu 13 Nov 2008 06:31:50
> > PM CST
> > > Last Seen                     Thu 13 Nov 2008 06:31:55
> > PM CST
> > > Local ID                     
> > 81d406be-b7e4-4bf4-a8c7-f12b7c36ee27
> > > Line Numbers                  
> > > 
> > > Raw Audit Messages            
> > > 
> > > node=riohigh2 type=AVC msg=audit(1226622715.909:38):
> > avc:  denied  { write } for  pid=4732
> > comm="npviewer.bin"
> > path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer"
> > dev=sda6 ino=263881
> > scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> > tcontext=unconfined_u:object_r:user_home_t:s0
> > tclass=fifo_file
> > > 
> > > node=riohigh2 type=AVC msg=audit(1226622715.909:38):
> > avc:  denied  { read } for  pid=4732
> > comm="npviewer.bin"
> > path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin"
> > dev=sda6 ino=263847
> > scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> > tcontext=unconfined_u:object_r:user_home_t:s0
> > tclass=fifo_file
> > > 
> > > node=riohigh2 type=SYSCALL
> > msg=audit(1226622715.909:38): arch=40000003 syscall=11
> > success=yes exit=0 a0=9e70d28 a1=9e71d40 a2=9e72210 a3=0
> > items=0 ppid=3572 pid=4732 auid=500 uid=500 gid=500 euid=500
> > suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none)
> > ses=1 comm="npviewer.bin"
> > exe="/usr/lib/nspluginwrapper/npviewer.bin"
> > subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> > key=(null)
> > > 
> > > 
> > > 
> > > Has someone else encountered these before and what
> > should I do about them?
> > > 
> > > Thanks,
> > > 
> > > Antonio 
> > > 
> > > 
> > >       
> > > 
> > > --
> > > fedora-selinux-list mailing list
> > > fedora-selinux-list at redhat.com
> > >
> > https://www.redhat.com/mailman/listinfo/fedora-selinux-list
> > If you change the context of this directory to
> > 
> > chcon -R -t nsplugin_home_t ~/.icedteaplugin
> > 
> > You should eliminate this avc.  I will change the layout in
> > selinux-policy-3.5.13-21.fc10
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.4.9 (GNU/Linux)
> > Comment: Using GnuPG with Fedora -
> > http://enigmail.mozdev.org
> > 
> > iEYEARECAAYFAkkdhmcACgkQrlYvE4MpobMjuwCZAZh4YDlxJW30wanjBHUZ15CF
> > EL0AoNjcjHePhXKzyHjPSc4Ed/WaYnXE
> > =m4dV
> > -----END PGP SIGNATURE-----
> 
> I tried the chcon command and this is what happened 
> 
> Nov 14 20:00:05 localhost kernel: type=1400
> audit(1226714405.352:155): avc:  denied  { write } for  pid=5155
> comm="npviewer.bin"
> path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer"
> dev=dm-0 ino=7734395
> scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14
> 20:00:05 localhost kernel: type=1400 audit(1226714405.352:156): avc:
> denied  { read } for  pid=5155 comm="npviewer.bin"
> path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin"
> dev=dm-0 ino=7734394
> scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14
> 20:00:05 localhost kernel: type=1400 audit(1226714405.388:157): avc:
> denied  { write } for  pid=5159 comm="npviewer.bin"
> path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer"
> dev=dm-0 ino=7734395
> scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14
> 20:00:05 localhost kernel: type=1400 audit(1226714405.388:158): avc:
> denied  { read } for  pid=5159 comm="npviewer.bin"
> path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin"
> dev=dm-0 ino=7734394
> scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14
> 20:00:15 localhost kernel: type=1400 audit(1226714415.618:159): avc:
> denied  { write } for  pid=5166 comm="npviewer.bin"
> path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer"
> dev=dm-0 ino=7734395
> scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14
> 20:00:15 localhost kernel: type=1400 audit(1226714415.618:160): avc:
> denied  { read } for  pid=5166 comm="npviewer.bin"
> path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin"
> dev=dm-0 ino=7734394
> scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14
> 20:00:15 localhost kernel: type=1400 audit(1226714415.654:161): avc:
> denied  { write } for  pid=5169 comm="npviewer.bin"
> path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer"
> dev=dm-0 ino=7734395
> scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14
> 20:00:15 localhost kernel: type=1400 audit(1226714415.654:162): avc:
> denied  { read } for  pid=5169 comm="npviewer.bin"
> path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin"
> dev=dm-0 ino=7734394
> scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14
> 20:00:22 localhost kernel: type=1400 audit(1226714422.242:163): avc:
> denied  { write } for  pid=5176 comm="npviewer.bin"
> path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer"
> dev=dm-0 ino=7734395
> scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14
> 20:00:22 localhost kernel: type=1400 audit(1226714422.242:164): avc:
> denied  { read } for  pid=5176 comm="npviewer.bin"
> path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin"
> dev=dm-0 ino=7734394
> scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14
> 20:00:22 localhost kernel: type=1400 audit(1226714422.279:165): avc:
> denied  { write } for  pid=5179 comm="npviewer.bin"
> path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer"
> dev=dm-0 ino=7734395
> scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file Nov 14
> 20:00:22 localhost kernel: type=1400 audit(1226714422.279:166): avc:
> denied  { read } for  pid=5179 comm="npviewer.bin"
> path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin"
> dev=dm-0 ino=7734394
> scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file ^C
> [root at localhost ~]# chcon -R -t nsplugin_home_t ~/.icedteaplugin
> chcon: cannot access `/root/.icedteaplugin': No such file or
> directory 

The SELinux denials are for the "olivares" user, not "root". So you
need to run the chcon command as user olivares.

Paul.




More information about the selinux mailing list