AVC:s on xauth file when doing su

[Göran Uddeborg]

Göran Uddeborg:
> It seems to be so.  I can't trigger it any more.

When I stopped trying, I could trigger it again. :-(

I did "su" in an xterm (NOT from an ssh session) and got the avc:s
below again.  Looking at root's home directory after it happened, I
see these files

    mimmi# ll .xauth*
    -rw------- 1 root root 51  3 jan 11.48 .xauth2nqqtg
    -rw------- 1 root root  0  3 jan 11.48 .xauthrZ8z8F
    -rw------- 2 root root  0  3 jan 11.48 .xauthrZ8z8F-c
    -rw------- 2 root root  0  3 jan 11.48 .xauthrZ8z8F-l
    mimmi# ll -Z .xauth*
    -rw-------  root root unconfined_u:object_r:xauth_home_t:SystemLow .xauth2nqqtg
    -rw-------  root root system_u:object_r:xauth_home_t:SystemLow .xauthrZ8z8F
    -rw-------  root root unconfined_u:object_r:xauth_home_t:SystemLow .xauthrZ8z8F-c
    -rw-------  root root unconfined_u:object_r:xauth_home_t:SystemLow .xauthrZ8z8F-l

TWO .xauth*-files were generated at the same time, the time when I did
"su".  But only one of them triggered these avc:s.  The su session
points its XAUTHORITY to .xauth2nqqtg, i.e. the one which didn't
trigger any avc:s.

Furthermore, now the file does have the correct context, xauth_home_t!

Of course, simply trying another "su" in the same way doesn't trigger
anything.  The search goes on.

time->Sun Jan  3 11:48:42 2010
type=SYSCALL msg=audit(1262515722.636:63657): arch=c000003e syscall=21 success=no exit=-13 a0=7fff04ce14dc a1=2 a2=0 a3=7fff04cdf4c0 items=0 ppid=21356 pid=21406 auid=503 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts5 ses=137 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1262515722.636:63657): avc:  denied  { write } for  pid=21406 comm="xauth" name=".xauthrZ8z8F" dev=dm-0 ino=25002031 scontext=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
----
time->Sun Jan  3 11:48:42 2010
type=SYSCALL msg=audit(1262515722.637:63658): arch=c000003e syscall=2 success=no exit=-13 a0=7fff04ce14dc a1=0 a2=1b6 a3=0 items=0 ppid=21356 pid=21406 auid=503 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts5 ses=137 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1262515722.637:63658): avc:  denied  { read } for  pid=21406 comm="xauth" name=".xauthrZ8z8F" dev=dm-0 ino=25002031 scontext=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file