Results 1 to 3 of 3

Thread: SELinux now blocking ports and printer.. what gives?

  1. #1
    Join Date
    Aug 2005
    Location
    Other Side of My Monitor
    Posts
    3,494
    Thanks
    5
    Thanked 105 Times in 104 Posts
    Blog Entries
    1

    Default SELinux now blocking ports and printer.. what gives?

    So I run Fedora 7, standard install with a few extras (beryl, wine, etc.)

    Just went through an update and everything appeared fine. I tried to print something yesterday and got an setroubleshoot error.

    Code:
        SELinux is preventing sh (cupsd_t) "read" to hpijs (hplip_exec_t).
    
        SELinux is preventing /usr/bin/hpijs (cupsd_t) "execute_no_trans" to
        /usr/bin/hpijs (hplip_exec_t).
    and a couple others.

    one of the complete errors here:

    Code:
    Summary
        SELinux is preventing sh (cupsd_t) "execute" to hpijs (hplip_exec_t).
    
    Detailed Description
        SELinux denied access requested by sh. It is not expected that this access
        is required by sh and this access may signal an intrusion attempt. It is
        also possible that the specific version or configuration of the application
        is causing it to require additional access.
    
    Allowing Access
        Sometimes labeling problems can cause SELinux denials.  You could try to
        restore the default system file context for hpijs, restorecon -v hpijs If
        this does not work, there is currently no automatic way to allow this
        access. Instead,  you can generate a local policy module to allow this
        access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you
        can disable SELinux protection altogether. Disabling SELinux protection is
        not recommended. Please file a
        http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
    
    Additional Information        
    
    Source Context                system_u:system_r:cupsd_t:SystemLow-SystemHigh
    Target Context                system_u:object_r:hplip_exec_t
    Target Objects                hpijs [ file ]
    Affected RPM Packages         
    Policy RPM                    selinux-policy-2.6.4-61.fc7
    Selinux Enabled               True
    Policy Type                   targeted
    MLS Enabled                   True
    Enforcing Mode                Permissive
    Plugin Name                   plugins.catchall_file
    Host Name                     localhost.localdomain
    Platform                      Linux localhost.localdomain 2.6.23.8-34.fc7 #1 SMP
                                  Thu Nov 22 23:05:33 EST 2007 i686 i686
    Alert Count                   1
    First Seen                    Mon 17 Dec 2007 12:20:20 AM PST
    Last Seen                     Mon 17 Dec 2007 12:20:20 AM PST
    Local ID                      4701b7a0-8d2c-42ee-bc3d-b2f0bcab6e90
    Line Numbers                  
    
    Raw Audit Messages            
    
    avc: denied { execute } for comm="sh" dev=dm-0 egid=7 euid=4 exe="/bin/bash"
    exit=0 fsgid=7 fsuid=4 gid=7 items=0 name="hpijs" pid=25459
    scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 sgid=7
    subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 suid=4 tclass=file
    tcontext=system_u:object_r:hplip_exec_t:s0 tty=(none) uid=4
    I tried restorecon and nothing. I am not sure that it was due to the upgrade as I have not printed from this machine for about 2 months, so it could be anything.

    I disabled SELinux so I could print, but there has to be a better way.. ideas?
    {CWoT - Riddle } {Freelance Copywriter} {Learn to Write}
    Follow Me on Twitter: @InkingHubris
    PHP Code:
    $result mysql_query("SELECT finger FROM hand WHERE id=3");
    echo 
    $result

  2. #2
    Join Date
    Jun 2005
    Location
    英国
    Posts
    11,876
    Thanks
    1
    Thanked 180 Times in 172 Posts
    Blog Entries
    2

    Default

    Twey | I understand English | 日本語が分かります | mi jimpe fi le jbobau | mi esperanton komprenas | je comprends français | entiendo español | tôi ít hiểu tiếng Việt | ich verstehe ein bisschen Deutsch | beware XHTML | common coding mistakes | tutorials | various stuff | argh PHP!

  3. #3
    Join Date
    Aug 2005
    Location
    Other Side of My Monitor
    Posts
    3,494
    Thanks
    5
    Thanked 105 Times in 104 Posts
    Blog Entries
    1

    Default

    That sounds promising, but I tried to run this in terminal:

    semodule -i local.pp

    and I got this:

    bash: semodule: command not found

    Ideas? everything else seemed to work fine...

    Edit:
    never mind, there wasn't a path in bash file, so I used /user/sbin/module -i local.pp and it worked, just re-enforced SeLinux and printed a page, and no problems.

    Thanks for the help Twey!
    Last edited by BLiZZaRD; 12-17-2007 at 07:36 PM.
    {CWoT - Riddle } {Freelance Copywriter} {Learn to Write}
    Follow Me on Twitter: @InkingHubris
    PHP Code:
    $result mysql_query("SELECT finger FROM hand WHERE id=3");
    echo 
    $result

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •