Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 625367 - SELinux is preventing /usr/libexec/kde4/kdm_greet "write" access on /usr/libexec/kde4/lnusertemp
Summary: SELinux is preventing /usr/libexec/kde4/kdm_greet "write" access on /usr/libe...
Keywords:
Status: CLOSED DUPLICATE of bug 590883
Alias: None
Product: Fedora
Classification: Fedora
Component: kdebase-workspace
Version: 13
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Than Ngo
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: F14Blocker, F14FinalBlocker
TreeView+ depends on / blocked
 
Reported: 2010-08-19 08:01 UTC by Michal Hlavinka
Modified: 2010-09-30 13:10 UTC (History)
14 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-09-30 13:10:17 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Michal Hlavinka 2010-08-19 08:01:03 UTC
this happens during/just after login, because selinux alert shows up always just after login. I use autologin (with session lock) and user switching

Summary:

SELinux is preventing /usr/libexec/kde4/kdm_greet "write" access on
/usr/libexec/kde4/lnusertemp.

Detailed Description:

SELinux denied access requested by kdm_greet. It is not expected that this
access is required by kdm_greet and this access may signal an intrusion attempt.
It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context                system_u:object_r:bin_t:s0
Target Objects                /usr/libexec/kde4/lnusertemp [ file ]
Source                        kdm_greet
Source Path                   /usr/libexec/kde4/kdm_greet
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           kdm-4.5.0-2.fc13
Target RPM Packages           kdelibs-4.5.0-1.fc13
Policy RPM                    selinux-policy-3.7.19-47.fc13
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     (removed)
Platform                      Linux nbone.mihlnet 2.6.34.4-40.fc13.x86_64 #1 SMP
                              Tue Aug 17 04:57:20 UTC 2010 x86_64 x86_64
Alert Count                   10
First Seen                    Wed 18 Aug 2010 08:56:34 AM CEST
Last Seen                     Wed 18 Aug 2010 06:11:16 PM CEST
Local ID                      a0f7a1e7-d4e1-442f-ac47-3a505b4d8dad
Line Numbers                  

Raw Audit Messages            

node=nbone.mihlnet type=AVC msg=audit(1282147876.74:22491): avc:  denied  { write } for  pid=27911 comm="kdm_greet" name="lnusertemp" dev=sda5 ino=139022 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file

node=nbone.mihlnet type=SYSCALL msg=audit(1282147876.74:22491): arch=c000003e syscall=21 success=no exit=-13 a0=26fef48 a1=2 a2=7fffaf6dc300 a3=34 items=0 ppid=27908 pid=27911 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kdm_greet" exe="/usr/libexec/kde4/kdm_greet" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)

Comment 1 Michal Hlavinka 2010-08-26 12:48:55 UTC
I just got the same selinux error in F-14 Alpha

Comment 2 Todd Jackson 2010-09-17 22:35:07 UTC
I get this same error also, Fedora14 Alpha
This is a fresh install.

Summary:

SELinux is preventing /usr/libexec/kde4/kdm_greet "write" access on
/usr/libexec/kde4/lnusertemp.

Detailed Description:

SELinux denied access requested by kdm_greet. It is not expected that this
access is required by kdm_greet and this access may signal an intrusion attempt.
It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context                system_u:object_r:bin_t:s0
Target Objects                /usr/libexec/kde4/lnusertemp [ file ]
Source                        kdm_greet
Source Path                   /usr/libexec/kde4/kdm_greet
Port                          <Unknown>
Host                          f14alpha
Source RPM Packages           kdm-4.5.1-2.fc14
Target RPM Packages           kdelibs-4.5.1-3.fc14
Policy RPM                    selinux-policy-3.9.3-4.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     f14alpha
Platform                      Linux f14alpha 2.6.35.4-12.fc14.x86_64 #1 SMP Fri
                              Aug 27 07:45:05 UTC 2010 x86_64 x86_64
Alert Count                   10
First Seen                    Tue 14 Sep 2010 02:26:31 PM PDT
Last Seen                     Fri 17 Sep 2010 01:19:49 PM PDT
Local ID                      af9eda4b-5fa1-4b27-8bcd-2737e366288d
Line Numbers                  

Raw Audit Messages            

node=f14alpha type=AVC msg=audit(1284754789.962:14): avc:  denied  { write } for  pid=1668 comm="kdm_greet" name="lnusertemp" dev=dm-0 ino=1709931 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file

node=f14alpha type=SYSCALL msg=audit(1284754789.962:14): arch=c000003e syscall=21 success=no exit=-13 a0=aafd38 a1=2 a2=7fff3dab5f10 a3=e8 items=0 ppid=1665 pid=1668 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kdm_greet" exe="/usr/libexec/kde4/kdm_greet" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)

Comment 3 Adam Williamson 2010-09-22 13:35:09 UTC
Same denial on boot of a clean installed F14 Beta RC3 KDE spin, x86-64 install. Proposing for F14Blocker: "In most cases, there must be no SELinux 'AVC: denied' messages or abrt crash notifications on initial boot and subsequent login (see Blocker_Bug_FAQ)"

Summary:

SELinux is preventing /usr/libexec/kde4/kdm_greet "write" access on lnusertemp.

Detailed Description:

SELinux denied access requested by kdm_greet. It is not expected that this
access is required by kdm_greet and this access may signal an intrusion attempt.
It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context                system_u:object_r:bin_t:s0
Target Objects                lnusertemp [ file ]
Source                        kdm_greet
Source Path                   /usr/libexec/kde4/kdm_greet
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           kdm-4.5.1-3.fc14
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.3-1.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     (removed)
Platform                      Linux localhost.localdomain
                              2.6.35.4-28.fc14.x86_64 #1 SMP Wed Sep 15 01:56:54
                              UTC 2010 x86_64 x86_64
Alert Count                   5
First Seen                    Wed 22 Sep 2010 03:16:08 PM BST
Last Seen                     Wed 22 Sep 2010 03:16:10 PM BST
Local ID                      83265b5d-9304-463b-8b13-da7118fff251
Line Numbers                  

Raw Audit Messages            

node=localhost.localdomain type=AVC msg=audit(1285164970.178:16): avc:  denied  { write } for  pid=1768 comm="kdm_greet" name="lnusertemp" dev=sdb1 ino=41966 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file

node=localhost.localdomain type=SYSCALL msg=audit(1285164970.178:16): arch=c000003e syscall=21 success=no exit=-13 a0=1c9fdd8 a1=2 a2=7fff65640ec0 a3=e8 items=0 ppid=1765 pid=1768 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kdm_greet" exe="/usr/libexec/kde4/kdm_greet" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)



-- 
Fedora Bugzappers volunteer triage team
https://fedoraproject.org/wiki/BugZappers

Comment 4 Radek Novacek 2010-09-30 13:10:17 UTC

*** This bug has been marked as a duplicate of bug 590883 ***


Note You need to log in before you can comment on or make changes to this bug.