BLiZZaRD
12-17-2007, 04:33 PM
So I run Fedora 7, standard install with a few extras (beryl, wine, etc.)
Just went through an update and everything appeared fine. I tried to print something yesterday and got an setroubleshoot error.
SELinux is preventing sh (cupsd_t) "read" to hpijs (hplip_exec_t).
SELinux is preventing /usr/bin/hpijs (cupsd_t) "execute_no_trans" to
/usr/bin/hpijs (hplip_exec_t).
and a couple others.
one of the complete errors here:
Summary
SELinux is preventing sh (cupsd_t) "execute" to hpijs (hplip_exec_t).
Detailed Description
SELinux denied access requested by sh. It is not expected that this access
is required by sh and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application
is causing it to require additional access.
Allowing Access
Sometimes labeling problems can cause SELinux denials. You could try to
restore the default system file context for hpijs, restorecon -v hpijs If
this does not work, there is currently no automatic way to allow this
access. Instead, you can generate a local policy module to allow this
access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you
can disable SELinux protection altogether. Disabling SELinux protection is
not recommended. Please file a
http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
Additional Information
Source Context system_u:system_r:cupsd_t:SystemLow-SystemHigh
Target Context system_u:object_r:hplip_exec_t
Target Objects hpijs [ file ]
Affected RPM Packages
Policy RPM selinux-policy-2.6.4-61.fc7
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name plugins.catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain 2.6.23.8-34.fc7 #1 SMP
Thu Nov 22 23:05:33 EST 2007 i686 i686
Alert Count 1
First Seen Mon 17 Dec 2007 12:20:20 AM PST
Last Seen Mon 17 Dec 2007 12:20:20 AM PST
Local ID 4701b7a0-8d2c-42ee-bc3d-b2f0bcab6e90
Line Numbers
Raw Audit Messages
avc: denied { execute } for comm="sh" dev=dm-0 egid=7 euid=4 exe="/bin/bash"
exit=0 fsgid=7 fsuid=4 gid=7 items=0 name="hpijs" pid=25459
scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 sgid=7
subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 suid=4 tclass=file
tcontext=system_u:object_r:hplip_exec_t:s0 tty=(none) uid=4
I tried restorecon and nothing. I am not sure that it was due to the upgrade as I have not printed from this machine for about 2 months, so it could be anything.
I disabled SELinux so I could print, but there has to be a better way.. ideas?
Just went through an update and everything appeared fine. I tried to print something yesterday and got an setroubleshoot error.
SELinux is preventing sh (cupsd_t) "read" to hpijs (hplip_exec_t).
SELinux is preventing /usr/bin/hpijs (cupsd_t) "execute_no_trans" to
/usr/bin/hpijs (hplip_exec_t).
and a couple others.
one of the complete errors here:
Summary
SELinux is preventing sh (cupsd_t) "execute" to hpijs (hplip_exec_t).
Detailed Description
SELinux denied access requested by sh. It is not expected that this access
is required by sh and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application
is causing it to require additional access.
Allowing Access
Sometimes labeling problems can cause SELinux denials. You could try to
restore the default system file context for hpijs, restorecon -v hpijs If
this does not work, there is currently no automatic way to allow this
access. Instead, you can generate a local policy module to allow this
access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you
can disable SELinux protection altogether. Disabling SELinux protection is
not recommended. Please file a
http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
Additional Information
Source Context system_u:system_r:cupsd_t:SystemLow-SystemHigh
Target Context system_u:object_r:hplip_exec_t
Target Objects hpijs [ file ]
Affected RPM Packages
Policy RPM selinux-policy-2.6.4-61.fc7
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name plugins.catchall_file
Host Name localhost.localdomain
Platform Linux localhost.localdomain 2.6.23.8-34.fc7 #1 SMP
Thu Nov 22 23:05:33 EST 2007 i686 i686
Alert Count 1
First Seen Mon 17 Dec 2007 12:20:20 AM PST
Last Seen Mon 17 Dec 2007 12:20:20 AM PST
Local ID 4701b7a0-8d2c-42ee-bc3d-b2f0bcab6e90
Line Numbers
Raw Audit Messages
avc: denied { execute } for comm="sh" dev=dm-0 egid=7 euid=4 exe="/bin/bash"
exit=0 fsgid=7 fsuid=4 gid=7 items=0 name="hpijs" pid=25459
scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 sgid=7
subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 suid=4 tclass=file
tcontext=system_u:object_r:hplip_exec_t:s0 tty=(none) uid=4
I tried restorecon and nothing. I am not sure that it was due to the upgrade as I have not printed from this machine for about 2 months, so it could be anything.
I disabled SELinux so I could print, but there has to be a better way.. ideas?