1950642 – selinux is preventing gnome-shell to access sock_file with write access.

Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 1950642 - selinux is preventing gnome-shell to access sock_file with write access.

Summary: selinux is preventing gnome-shell to access sock_file with write access.

Keywords:
Status:	CLOSED DUPLICATE of bug 1949712
Alias:	None
Product:	Fedora
Classification:	Fedora
Component:	selinux-policy
Sub Component:
Version:	34
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	unspecified
Target Milestone:	---
Assignee:	Zdenek Pytela
QA Contact:	Fedora Extras Quality Assurance
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2021-04-17 10:42 UTC by Martin Wolf
Modified:	2021-04-19 16:16 UTC (History)
CC List:	8 users (show)
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:	2021-04-19 16:16:00 UTC
Type:	Bug
Embargoed:
Dependent Products:

Attachments	(Terms of Use)

Description Martin Wolf 2021-04-17 10:42:52 UTC

sealert -l 9f7c707c-592b-42b1-8a01-4ccd44e43d40
SELinux hindert gnome-shell daran, mit write-Zugriff auf sock_file dbus-ZQv2LliIUE zuzugreifen.

*****  Plugin catchall (100. Wahrscheinlichkeit) schlägt vor    **************

Wenn Sie denken, dass es gnome-shell standardmäßig erlaubt sein sollte, write Zugriff auf dbus-ZQv2LliIUE sock_file zu erhalten.
Dann sie sollten dies als Fehler melden.
Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen.
Ausführen
zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen:
# ausearch -c 'gnome-shell' --raw | audit2allow -M my-gnomeshell
# semodule -X 300 -i my-gnomeshell.pp


zusätzliche Information:
Quellkontext                  system_u:system_r:xdm_t:s0-s0:c0.c1023
Zielkontext                   system_u:object_r:tmp_t:s0
Zielobjekte                   dbus-ZQv2LliIUE [ sock_file ]
Quelle                        gnome-shell
Quellpfad                     gnome-shell
Port                          <Unknown>
Host                          localhost.localdomain
RPM-Pakete der Quelle         
RPM-Pakete des Ziels          
SELinux Policy RPM            selinux-policy-targeted-34-1.fc34.noarch
Local Policy RPM              selinux-policy-targeted-34-1.fc34.noarch
SELinux aktiviert             True
Richtlinientyp                targeted
Enforcing-Modus               Enforcing
Rechnername                   localhost.localdomain
Plattform                     Linux localhost.localdomain
                              5.11.14-300.fc34.x86_64 #1 SMP Wed Apr 14 15:25:23
                              UTC 2021 x86_64 x86_64
Anzahl der Alarme             49
Zuerst gesehen                2021-04-16 16:30:57 CEST
Zuletzt gesehen               2021-04-17 12:36:57 CEST
Lokale ID                     9f7c707c-592b-42b1-8a01-4ccd44e43d40

Raw-Audit-Meldungen
type=AVC msg=audit(1618655817.322:807): avc:  denied  { write } for  pid=1743 comm="ibus-x11" name="dbus-ZQv2LliIUE" dev="tmpfs" ino=49 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=sock_file permissive=0


Hash: gnome-shell,xdm_t,tmp_t,sock_file,write

Comment 1 Zdenek Pytela 2021-04-19 16:16:00 UTC


*** This bug has been marked as a duplicate of bug 1949712 ***

Note You need to log in before you can comment on or make changes to this bug.