Running strict/enforcing, latest Rawhide.
When logging in, cups, running in cupsd_config_t wants to write /usr/lib/python/site-packages/printconf_tui.pyo, and /usr/share/printconf/util/printconf_tui.pyo. Strict and Permissive avc's shown below.
Two things: 1. Didn't these files get moved to /var under an earlier bugzilla? 2. Can we add a 'dontaudit' to cups.te for this: dontaudit cupsd_config_t lib_t:dir write; dontaudit cupsd_config_t usr_t:dir write;
tom
Strict avcs: Dec 4 10:20:41 fedora kernel: audit(1102184441.369:0): avc: denied { write } for pid=2844 exe=/usr/bin/python name=util dev=hda2 ino=4309019 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:usr_t tclass=dir Dec 4 10:20:41 fedora kernel: audit(1102184441.619:0): avc: denied { write } for pid=2844 exe=/usr/bin/python name=site-packages dev=hda2 ino=4525331 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:lib_t tclass=dir
Permissive avc: Dec 4 10:35:08 fedora kernel: audit(1102185308.369:0): avc: denied { write } for pid=3591 exe=/usr/bin/python name=util dev=hda2 ino=4309019 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:usr_t tclass=dir Dec 4 10:35:08 fedora kernel: audit(1102185308.370:0): avc: denied { remove_name } for pid=3591 exe=/usr/bin/python name=printconf_tui.pyo dev=hda2 ino=4309180 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:usr_t tclass=dir Dec 4 10:35:08 fedora kernel: audit(1102185308.370:0): avc: denied { unlink } for pid=3591 exe=/usr/bin/python name=printconf_tui.pyo dev=hda2 ino=4309180 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:printconf_t tclass=file Dec 4 10:35:08 fedora kernel: audit(1102185308.606:0): avc: denied { add_name } for pid=3591 exe=/usr/bin/python name=printconf_tui.pyo scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:usr_t tclass=dir Dec 4 10:35:08 fedora kernel: audit(1102185308.606:0): avc: denied { create } for pid=3591 exe=/usr/bin/python name=printconf_tui.pyo scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:usr_t tclass=file Dec 4 10:35:08 fedora kernel: audit(1102185308.606:0): avc: denied { write } for pid=3591 exe=/usr/bin/python path=/usr/share/printconf/util/printconf_tui.pyo dev=hda2 ino=4309025 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:usr_t tclass=file
On Sat, Dec 04, 2004 at 10:48:54AM -0800, Tom London wrote:
Running strict/enforcing, latest Rawhide.
When logging in, cups, running in cupsd_config_t wants to write /usr/lib/python/site-packages/printconf_tui.pyo, and /usr/share/printconf/util/printconf_tui.pyo. Strict and Permissive avc's shown below.
*sigh*
This comes up periodically. I am still waiting for the rpm configuration bit that fixes this to be turned on.
Tim. */
Tim Waugh wrote:
On Sat, Dec 04, 2004 at 10:48:54AM -0800, Tom London wrote:
Running strict/enforcing, latest Rawhide.
When logging in, cups, running in cupsd_config_t wants to write /usr/lib/python/site-packages/printconf_tui.pyo, and /usr/share/printconf/util/printconf_tui.pyo. Strict and Permissive avc's shown below.
*sigh*
This comes up periodically. I am still waiting for the rpm configuration bit that fixes this to be turned on.
Me too.
So I'll add brp-python-bytecompile to the automagic build root policy script collection in the macro %__os_install_post within rpm default configuration in my next rpm-4.3.3-2 build.
Which is a bit rude, much like inflicting -debuginfo everywhere was a bit rude, and won't get rpm-4.3.3-2 into beehive build trees, and won't rebuild the packages that need to include *.pyo, but perhaps Godot will come along in a bit.
73 de Jeff
Index: platform.in =================================================================== RCS file: /cvs/devel/rpm/platform.in,v retrieving revision 2.17 diff -u -b -B -w -p -r2.17 platform.in --- platform.in 8 Jan 2003 21:37:01 -0000 2.17 +++ platform.in 5 Dec 2004 14:27:39 -0000 @@ -57,6 +57,7 @@ @RPMCONFIGDIR@/brp-strip \ @RPMCONFIGDIR@/brp-strip-static-archive \ @RPMCONFIGDIR@/brp-strip-comment-note \ + @RPMCONFIGDIR@/brp-python-bytecompile \ %{nil}
%__spec_install_post\
Tim Waugh wrote:
On Sat, Dec 04, 2004 at 10:48:54AM -0800, Tom London wrote:
Running strict/enforcing, latest Rawhide.
When logging in, cups, running in cupsd_config_t wants to write /usr/lib/python/site-packages/printconf_tui.pyo, and /usr/share/printconf/util/printconf_tui.pyo. Strict and Permissive avc's shown below.
*sigh*
This comes up periodically. I am still waiting for the rpm configuration bit that fixes this to be turned on.
The automagic brp-python-bytecompile policy is turned on by default in rpm-4.3.3-8, which should be in FC4 tomorrow.
Beehive (and redhat-rpm-config) is promised as well.
And all python packages are going to need rebuild to acquire Requires: python(abi) = 2.4 so perhaps the problem of associating file contexts with lazily compiled/created *.pyc and *.pyo will finally be headed towards resolution without forcing python to link libselinux.
73 de Jeff
selinux@lists.fedoraproject.org