* python gui gconf policy problem
@ 2008-07-15 16:29 Xavier Toth
2008-07-15 16:51 ` Stephen Smalley
0 siblings, 1 reply; 8+ messages in thread
From: Xavier Toth @ 2008-07-15 16:29 UTC (permalink / raw)
To: SELinux List; +Cc: Daniel J Walsh
I'm writing policy for a python gui and having a problem getting preferences:
gobject.GError: Failed to contact configuration server; some possible
causes are that you need to enable TCP/IP networking for ORBit, or you
have a stale NFS locks due to a system crash. See
http://www.gnome.org/project/gconf/ for information. (Details - 1:
Could not send message to gconf daemon: An SELinux policy prevents
this sender from sending this message to this recipient (rejected
message had interface "org.gnome.GConf member "GetIOR" error name
"(unset)" destination "org.gnome.GConf"))
The error message states that policy is preventing this operation but
there isn't a corresponding AVC in the audit log. I'm using the
gnome_stream_connect_gconf_template but that doesn't help and I'm not
sure it is the right thing to do anyway.
Ted
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: python gui gconf policy problem
2008-07-15 16:29 python gui gconf policy problem Xavier Toth
@ 2008-07-15 16:51 ` Stephen Smalley
2008-07-15 18:25 ` Xavier Toth
0 siblings, 1 reply; 8+ messages in thread
From: Stephen Smalley @ 2008-07-15 16:51 UTC (permalink / raw)
To: Xavier Toth; +Cc: SELinux List, Daniel J Walsh
On Tue, 2008-07-15 at 11:29 -0500, Xavier Toth wrote:
> I'm writing policy for a python gui and having a problem getting preferences:
>
> gobject.GError: Failed to contact configuration server; some possible
> causes are that you need to enable TCP/IP networking for ORBit, or you
> have a stale NFS locks due to a system crash. See
> http://www.gnome.org/project/gconf/ for information. (Details - 1:
> Could not send message to gconf daemon: An SELinux policy prevents
> this sender from sending this message to this recipient (rejected
> message had interface "org.gnome.GConf member "GetIOR" error name
> "(unset)" destination "org.gnome.GConf"))
>
> The error message states that policy is preventing this operation but
> there isn't a corresponding AVC in the audit log. I'm using the
> gnome_stream_connect_gconf_template but that doesn't help and I'm not
> sure it is the right thing to do anyway.
Sounds like a dbus denial, which would show up as a USER_AVC.
Or might be dontaudit'd - try semodule -DB.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: python gui gconf policy problem
2008-07-15 16:51 ` Stephen Smalley
@ 2008-07-15 18:25 ` Xavier Toth
2008-07-15 20:13 ` Daniel J Walsh
2008-07-16 11:44 ` Stephen Smalley
0 siblings, 2 replies; 8+ messages in thread
From: Xavier Toth @ 2008-07-15 18:25 UTC (permalink / raw)
To: Stephen Smalley; +Cc: SELinux List, Daniel J Walsh
On Tue, Jul 15, 2008 at 11:51 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
>
> On Tue, 2008-07-15 at 11:29 -0500, Xavier Toth wrote:
>> I'm writing policy for a python gui and having a problem getting preferences:
>>
>> gobject.GError: Failed to contact configuration server; some possible
>> causes are that you need to enable TCP/IP networking for ORBit, or you
>> have a stale NFS locks due to a system crash. See
>> http://www.gnome.org/project/gconf/ for information. (Details - 1:
>> Could not send message to gconf daemon: An SELinux policy prevents
>> this sender from sending this message to this recipient (rejected
>> message had interface "org.gnome.GConf member "GetIOR" error name
>> "(unset)" destination "org.gnome.GConf"))
>>
>> The error message states that policy is preventing this operation but
>> there isn't a corresponding AVC in the audit log. I'm using the
>> gnome_stream_connect_gconf_template but that doesn't help and I'm not
>> sure it is the right thing to do anyway.
>
> Sounds like a dbus denial, which would show up as a USER_AVC.
> Or might be dontaudit'd - try semodule -DB.
>
> --
> Stephen Smalley
> National Security Agency
>
>
I have used 'semodule -DB' and I don't see any dbus AVCs and this
strace shows that a dbus connection is established and some reads and
writes occur
11201 read(6, "", 8192) = 0
11201 close(6) = 0
11201 munmap(0xb802a000, 4096) = 0
11201 socket(PF_FILE, SOCK_STREAM, 0) = 6
11201 connect(6, {sa_family=AF_FILE, path=@/tmp/dbus-9MZAW1huFg}, 23) = 0
11201 fcntl64(6, F_GETFL) = 0x2 (flags O_RDWR)
11201 fcntl64(6, F_SETFL, O_RDWR|O_NONBLOCK) = 0
11201 fcntl64(6, F_GETFD) = 0
11201 fcntl64(6, F_SETFD, FD_CLOEXEC) = 0
11201 geteuid32() = 500
11201 rt_sigaction(SIGPIPE, {SIG_IGN}, {SIG_IGN}, 8) = 0
11201 poll([{fd=6, events=POLLOUT, revents=POLLOUT}], 1, 0) = 1
11201 write(6, "\0", 1) = 1
11201 write(6, "AUTH EXTERNAL 353030\r\n", 22) = 22
11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, -1) = 1
11201 read(6, "OK 9d1044c841e17b3bd63f63b3487cc"..., 2048) = 37
11201 poll([{fd=6, events=POLLOUT, revents=POLLOUT}], 1, -1) = 1
11201 write(6, "BEGIN\r\n", 7) = 7
11201 poll([{fd=6, events=POLLIN|POLLOUT, revents=POLLOUT}], 1, -1) = 1
11201 writev(6,
[{"l\1\0\1\0\0\0\0\1\0\0\0n\0\0\0\1\1o\0\25\0\0\0/org/fre"..., 128},
{"", 0}], 2) = 128
11201 gettimeofday({1216142988, 595361}, NULL) = 0
11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
11201 read(6, "l\2\1\1\n\0\0\0\1\0\0\0=\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
2048) = 260
11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
temporarily unavailable)
11201 writev(6,
[{"l\1\2\1\0\0\0\0\2\0\0\0_\0\0\0\1\1o\0\20\0\0\0/org/gno"..., 112},
{"", 0}], 2) = 112
11201 gettimeofday({1216142988, 598242}, NULL) = 0
11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
11201 read(6, "l\3\1\1\315\0\0\0\3\0\0\0m\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
2048) = 333
11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
temporarily unavailable)
11201 open("/usr/share/locale/en_US.UTF-8/LC_MESSAGES/GConf2.mo",
O_RDONLY) = -1 ENOENT (No such file or directory)
11201 open("/usr/share/locale/en_US.utf8/LC_MESSAGES/GConf2.mo",
O_RDONLY) = -1 ENOENT (No such file or directory)
11201 open("/usr/share/locale/en_US/LC_MESSAGES/GConf2.mo", O_RDONLY)
= -1 ENOENT (No such file or directory)
11201 open("/usr/share/locale/en.UTF-8/LC_MESSAGES/GConf2.mo",
O_RDONLY) = -1 ENOENT (No such file or directory)
11201 open("/usr/share/locale/en.utf8/LC_MESSAGES/GConf2.mo",
O_RDONLY) = -1 ENOENT (No such file or directory)
11201 open("/usr/share/locale/en/LC_MESSAGES/GConf2.mo", O_RDONLY) =
-1 ENOENT (No such file or directory)
11201 writev(6,
[{"l\1\0\1\0\0\0\0\3\0\0\0_\0\0\0\1\1o\0\20\0\0\0/org/gno"..., 112},
{"", 0}], 2) = 112
11201 gettimeofday({1216142988, 602061}, NULL) = 0
11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
11201 read(6, "l\3\1\1\315\0\0\0\4\0\0\0m\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
2048) = 333
11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
temporarily unavailable)
11201 write(2, "Traceback (most recent call last"..., 35) = 35
11201 open("/usr/share/ml-launch/ml-launch.py", O_RDONLY|O_LARGEFILE) = 7
11201 write(2, " File \"/usr/share/ml-launch/ml-"..., 66) = 66
11201 fstat64(7, {st_mode=S_IFREG|0755, st_size=7901, ...}) = 0
11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
11201 read(7, " gtk.gdk.flush()\n "..., 4096) = 3805
11201 write(2, " ", 4) = 4
11201 write(2, "main()\n", 7) = 7
11201 close(7) = 0
11201 munmap(0xb802a000, 4096) = 0
11201 open("/usr/share/ml-launch/ml-launch.py", O_RDONLY|O_LARGEFILE) = 7
11201 write(2, " File \"/usr/share/ml-launch/ml-"..., 62) = 62
11201 fstat64(7, {st_mode=S_IFREG|0755, st_size=7901, ...}) = 0
11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
11201 read(7, " gtk.gdk.flush()\n "..., 4096) = 3805
11201 write(2, " ", 4) = 4
11201 write(2, "launchLevelDialog = LabelDialog("..., 46) = 46
11201 close(7) = 0
11201 munmap(0xb802a000, 4096) = 0
11201 open("/usr/share/ml-launch/label_dialog.py", O_RDONLY|O_LARGEFILE) = 7
11201 write(2, " File \"/usr/share/ml-launch/lab"..., 69) = 69
11201 fstat64(7, {st_mode=S_IFREG|0644, st_size=22290, ...}) = 0
11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
11201 read(7, "ifications[key].sensitivities.va"..., 4096) = 4096
11201 read(7, " if wordIndex < wordCount:\n "..., 4096) = 4096
11201 write(2, " ", 4) = 4
11201 write(2, "self.init_preferences()\n", 24) = 24
11201 close(7) = 0
11201 munmap(0xb802a000, 4096) = 0
11201 open("/usr/share/ml-launch/label_dialog.py", O_RDONLY|O_LARGEFILE) = 7
11201 write(2, " File \"/usr/share/ml-launch/lab"..., 77) = 77
11201 fstat64(7, {st_mode=S_IFREG|0644, st_size=22290, ...}) = 0
11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
11201 read(7, "ifications[key].sensitivities.va"..., 4096) = 4096
11201 read(7, " if wordIndex < wordCount:\n "..., 4096) = 4096
11201 read(7, " self.levels_combobox.connect(\""..., 4096) = 4096
11201 read(7, " %s\" % (key)\n "..., 4096) = 4096
11201 write(2, " ", 4) = 4
11201 write(2, "self.saved_labels_max = self.pre"..., 88) = 88
11201 close(7) = 0
11201 munmap(0xb802a000, 4096) = 0
11201 write(2, "gobject", 7) = 7
11201 write(2, ".", 1) = 1
11201 write(2, "GError", 6) = 6
11201 write(2, ": ", 2) = 2
11201 write(2, "Failed to contact configuration "..., 483) = 483
11201 write(2, "\n", 1) = 1
11201 close(3) = 0
11201 rt_sigaction(SIGINT, {SIG_DFL}, {0x4d651c0, [], 0}, 8) = 0
11200 exit_group(0) = ?
11199 <... waitpid resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 11200
11199 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
11199 --- SIGCHLD (Child exited) @ 0 (0) ---
11199 waitpid(-1, 0xbf98ea38, WNOHANG) = -1 ECHILD (No child processes)
11199 sigreturn() = ? (mask now [])
11199 rt_sigaction(SIGINT, {SIG_DFL}, {0x807c670, [], 0}, 8) = 0
11199 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0
11199 read(255, "\n", 67) = 1
11199 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0
11199 read(255, "", 67) = 0
11199 exit_group(0) = ?
11201 exit_group(1) = ?
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: python gui gconf policy problem
2008-07-15 18:25 ` Xavier Toth
@ 2008-07-15 20:13 ` Daniel J Walsh
2008-07-15 20:57 ` Xavier Toth
2008-07-16 11:44 ` Stephen Smalley
1 sibling, 1 reply; 8+ messages in thread
From: Daniel J Walsh @ 2008-07-15 20:13 UTC (permalink / raw)
To: Xavier Toth; +Cc: Stephen Smalley, SELinux List
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Xavier Toth wrote:
> On Tue, Jul 15, 2008 at 11:51 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
>> On Tue, 2008-07-15 at 11:29 -0500, Xavier Toth wrote:
>>> I'm writing policy for a python gui and having a problem getting preferences:
>>>
>>> gobject.GError: Failed to contact configuration server; some possible
>>> causes are that you need to enable TCP/IP networking for ORBit, or you
>>> have a stale NFS locks due to a system crash. See
>>> http://www.gnome.org/project/gconf/ for information. (Details - 1:
>>> Could not send message to gconf daemon: An SELinux policy prevents
>>> this sender from sending this message to this recipient (rejected
>>> message had interface "org.gnome.GConf member "GetIOR" error name
>>> "(unset)" destination "org.gnome.GConf"))
>>>
>>> The error message states that policy is preventing this operation but
>>> there isn't a corresponding AVC in the audit log. I'm using the
>>> gnome_stream_connect_gconf_template but that doesn't help and I'm not
>>> sure it is the right thing to do anyway.
>> Sounds like a dbus denial, which would show up as a USER_AVC.
>> Or might be dontaudit'd - try semodule -DB.
>>
>> --
>> Stephen Smalley
>> National Security Agency
>>
>>
>
> I have used 'semodule -DB' and I don't see any dbus AVCs and this
> strace shows that a dbus connection is established and some reads and
> writes occur
>
> 11201 read(6, "", 8192) = 0
> 11201 close(6) = 0
> 11201 munmap(0xb802a000, 4096) = 0
> 11201 socket(PF_FILE, SOCK_STREAM, 0) = 6
> 11201 connect(6, {sa_family=AF_FILE, path=@/tmp/dbus-9MZAW1huFg}, 23) = 0
> 11201 fcntl64(6, F_GETFL) = 0x2 (flags O_RDWR)
> 11201 fcntl64(6, F_SETFL, O_RDWR|O_NONBLOCK) = 0
> 11201 fcntl64(6, F_GETFD) = 0
> 11201 fcntl64(6, F_SETFD, FD_CLOEXEC) = 0
> 11201 geteuid32() = 500
> 11201 rt_sigaction(SIGPIPE, {SIG_IGN}, {SIG_IGN}, 8) = 0
> 11201 poll([{fd=6, events=POLLOUT, revents=POLLOUT}], 1, 0) = 1
> 11201 write(6, "\0", 1) = 1
> 11201 write(6, "AUTH EXTERNAL 353030\r\n", 22) = 22
> 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, -1) = 1
> 11201 read(6, "OK 9d1044c841e17b3bd63f63b3487cc"..., 2048) = 37
> 11201 poll([{fd=6, events=POLLOUT, revents=POLLOUT}], 1, -1) = 1
> 11201 write(6, "BEGIN\r\n", 7) = 7
> 11201 poll([{fd=6, events=POLLIN|POLLOUT, revents=POLLOUT}], 1, -1) = 1
> 11201 writev(6,
> [{"l\1\0\1\0\0\0\0\1\0\0\0n\0\0\0\1\1o\0\25\0\0\0/org/fre"..., 128},
> {"", 0}], 2) = 128
> 11201 gettimeofday({1216142988, 595361}, NULL) = 0
> 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
> 11201 read(6, "l\2\1\1\n\0\0\0\1\0\0\0=\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
> 2048) = 260
> 11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
> temporarily unavailable)
> 11201 writev(6,
> [{"l\1\2\1\0\0\0\0\2\0\0\0_\0\0\0\1\1o\0\20\0\0\0/org/gno"..., 112},
> {"", 0}], 2) = 112
> 11201 gettimeofday({1216142988, 598242}, NULL) = 0
> 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
> 11201 read(6, "l\3\1\1\315\0\0\0\3\0\0\0m\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
> 2048) = 333
> 11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
> temporarily unavailable)
> 11201 open("/usr/share/locale/en_US.UTF-8/LC_MESSAGES/GConf2.mo",
> O_RDONLY) = -1 ENOENT (No such file or directory)
> 11201 open("/usr/share/locale/en_US.utf8/LC_MESSAGES/GConf2.mo",
> O_RDONLY) = -1 ENOENT (No such file or directory)
> 11201 open("/usr/share/locale/en_US/LC_MESSAGES/GConf2.mo", O_RDONLY)
> = -1 ENOENT (No such file or directory)
> 11201 open("/usr/share/locale/en.UTF-8/LC_MESSAGES/GConf2.mo",
> O_RDONLY) = -1 ENOENT (No such file or directory)
> 11201 open("/usr/share/locale/en.utf8/LC_MESSAGES/GConf2.mo",
> O_RDONLY) = -1 ENOENT (No such file or directory)
> 11201 open("/usr/share/locale/en/LC_MESSAGES/GConf2.mo", O_RDONLY) =
> -1 ENOENT (No such file or directory)
> 11201 writev(6,
> [{"l\1\0\1\0\0\0\0\3\0\0\0_\0\0\0\1\1o\0\20\0\0\0/org/gno"..., 112},
> {"", 0}], 2) = 112
> 11201 gettimeofday({1216142988, 602061}, NULL) = 0
> 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
> 11201 read(6, "l\3\1\1\315\0\0\0\4\0\0\0m\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
> 2048) = 333
> 11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
> temporarily unavailable)
> 11201 write(2, "Traceback (most recent call last"..., 35) = 35
> 11201 open("/usr/share/ml-launch/ml-launch.py", O_RDONLY|O_LARGEFILE) = 7
> 11201 write(2, " File \"/usr/share/ml-launch/ml-"..., 66) = 66
> 11201 fstat64(7, {st_mode=S_IFREG|0755, st_size=7901, ...}) = 0
> 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
> 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
> 11201 read(7, " gtk.gdk.flush()\n "..., 4096) = 3805
> 11201 write(2, " ", 4) = 4
> 11201 write(2, "main()\n", 7) = 7
> 11201 close(7) = 0
> 11201 munmap(0xb802a000, 4096) = 0
> 11201 open("/usr/share/ml-launch/ml-launch.py", O_RDONLY|O_LARGEFILE) = 7
> 11201 write(2, " File \"/usr/share/ml-launch/ml-"..., 62) = 62
> 11201 fstat64(7, {st_mode=S_IFREG|0755, st_size=7901, ...}) = 0
> 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
> 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
> 11201 read(7, " gtk.gdk.flush()\n "..., 4096) = 3805
> 11201 write(2, " ", 4) = 4
> 11201 write(2, "launchLevelDialog = LabelDialog("..., 46) = 46
> 11201 close(7) = 0
> 11201 munmap(0xb802a000, 4096) = 0
> 11201 open("/usr/share/ml-launch/label_dialog.py", O_RDONLY|O_LARGEFILE) = 7
> 11201 write(2, " File \"/usr/share/ml-launch/lab"..., 69) = 69
> 11201 fstat64(7, {st_mode=S_IFREG|0644, st_size=22290, ...}) = 0
> 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
> 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
> 11201 read(7, "ifications[key].sensitivities.va"..., 4096) = 4096
> 11201 read(7, " if wordIndex < wordCount:\n "..., 4096) = 4096
> 11201 write(2, " ", 4) = 4
> 11201 write(2, "self.init_preferences()\n", 24) = 24
> 11201 close(7) = 0
> 11201 munmap(0xb802a000, 4096) = 0
> 11201 open("/usr/share/ml-launch/label_dialog.py", O_RDONLY|O_LARGEFILE) = 7
> 11201 write(2, " File \"/usr/share/ml-launch/lab"..., 77) = 77
> 11201 fstat64(7, {st_mode=S_IFREG|0644, st_size=22290, ...}) = 0
> 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
> 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
> 11201 read(7, "ifications[key].sensitivities.va"..., 4096) = 4096
> 11201 read(7, " if wordIndex < wordCount:\n "..., 4096) = 4096
> 11201 read(7, " self.levels_combobox.connect(\""..., 4096) = 4096
> 11201 read(7, " %s\" % (key)\n "..., 4096) = 4096
> 11201 write(2, " ", 4) = 4
> 11201 write(2, "self.saved_labels_max = self.pre"..., 88) = 88
> 11201 close(7) = 0
> 11201 munmap(0xb802a000, 4096) = 0
> 11201 write(2, "gobject", 7) = 7
> 11201 write(2, ".", 1) = 1
> 11201 write(2, "GError", 6) = 6
> 11201 write(2, ": ", 2) = 2
> 11201 write(2, "Failed to contact configuration "..., 483) = 483
> 11201 write(2, "\n", 1) = 1
> 11201 close(3) = 0
> 11201 rt_sigaction(SIGINT, {SIG_DFL}, {0x4d651c0, [], 0}, 8) = 0
> 11200 exit_group(0) = ?
> 11199 <... waitpid resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 11200
> 11199 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
> 11199 --- SIGCHLD (Child exited) @ 0 (0) ---
> 11199 waitpid(-1, 0xbf98ea38, WNOHANG) = -1 ECHILD (No child processes)
> 11199 sigreturn() = ? (mask now [])
> 11199 rt_sigaction(SIGINT, {SIG_DFL}, {0x807c670, [], 0}, 8) = 0
> 11199 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0
> 11199 read(255, "\n", 67) = 1
> 11199 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0
> 11199 read(255, "", 67) = 0
> 11199 exit_group(0) = ?
> 11201 exit_group(1) = ?
Does it happen in permissive ? If yes, then we are the fall guy for
some other dbus problem.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkh9BOgACgkQrlYvE4MpobO2SwCgq1DdaaVVpbaOpaWloOa5R6IP
FNwAoMXBSmV8KVDpEu53+QrdVWeK7dgS
=zN60
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: python gui gconf policy problem
2008-07-15 20:13 ` Daniel J Walsh
@ 2008-07-15 20:57 ` Xavier Toth
0 siblings, 0 replies; 8+ messages in thread
From: Xavier Toth @ 2008-07-15 20:57 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: Stephen Smalley, SELinux List
On Tue, Jul 15, 2008 at 3:13 PM, Daniel J Walsh <dwalsh@redhat.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Xavier Toth wrote:
>> On Tue, Jul 15, 2008 at 11:51 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
>>> On Tue, 2008-07-15 at 11:29 -0500, Xavier Toth wrote:
>>>> I'm writing policy for a python gui and having a problem getting preferences:
>>>>
>>>> gobject.GError: Failed to contact configuration server; some possible
>>>> causes are that you need to enable TCP/IP networking for ORBit, or you
>>>> have a stale NFS locks due to a system crash. See
>>>> http://www.gnome.org/project/gconf/ for information. (Details - 1:
>>>> Could not send message to gconf daemon: An SELinux policy prevents
>>>> this sender from sending this message to this recipient (rejected
>>>> message had interface "org.gnome.GConf member "GetIOR" error name
>>>> "(unset)" destination "org.gnome.GConf"))
>>>>
>>>> The error message states that policy is preventing this operation but
>>>> there isn't a corresponding AVC in the audit log. I'm using the
>>>> gnome_stream_connect_gconf_template but that doesn't help and I'm not
>>>> sure it is the right thing to do anyway.
>>> Sounds like a dbus denial, which would show up as a USER_AVC.
>>> Or might be dontaudit'd - try semodule -DB.
>>>
>>> --
>>> Stephen Smalley
>>> National Security Agency
>>>
>>>
>>
>> I have used 'semodule -DB' and I don't see any dbus AVCs and this
>> strace shows that a dbus connection is established and some reads and
>> writes occur
>>
>> 11201 read(6, "", 8192) = 0
>> 11201 close(6) = 0
>> 11201 munmap(0xb802a000, 4096) = 0
>> 11201 socket(PF_FILE, SOCK_STREAM, 0) = 6
>> 11201 connect(6, {sa_family=AF_FILE, path=@/tmp/dbus-9MZAW1huFg}, 23) = 0
>> 11201 fcntl64(6, F_GETFL) = 0x2 (flags O_RDWR)
>> 11201 fcntl64(6, F_SETFL, O_RDWR|O_NONBLOCK) = 0
>> 11201 fcntl64(6, F_GETFD) = 0
>> 11201 fcntl64(6, F_SETFD, FD_CLOEXEC) = 0
>> 11201 geteuid32() = 500
>> 11201 rt_sigaction(SIGPIPE, {SIG_IGN}, {SIG_IGN}, 8) = 0
>> 11201 poll([{fd=6, events=POLLOUT, revents=POLLOUT}], 1, 0) = 1
>> 11201 write(6, "\0", 1) = 1
>> 11201 write(6, "AUTH EXTERNAL 353030\r\n", 22) = 22
>> 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, -1) = 1
>> 11201 read(6, "OK 9d1044c841e17b3bd63f63b3487cc"..., 2048) = 37
>> 11201 poll([{fd=6, events=POLLOUT, revents=POLLOUT}], 1, -1) = 1
>> 11201 write(6, "BEGIN\r\n", 7) = 7
>> 11201 poll([{fd=6, events=POLLIN|POLLOUT, revents=POLLOUT}], 1, -1) = 1
>> 11201 writev(6,
>> [{"l\1\0\1\0\0\0\0\1\0\0\0n\0\0\0\1\1o\0\25\0\0\0/org/fre"..., 128},
>> {"", 0}], 2) = 128
>> 11201 gettimeofday({1216142988, 595361}, NULL) = 0
>> 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
>> 11201 read(6, "l\2\1\1\n\0\0\0\1\0\0\0=\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
>> 2048) = 260
>> 11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
>> temporarily unavailable)
>> 11201 writev(6,
>> [{"l\1\2\1\0\0\0\0\2\0\0\0_\0\0\0\1\1o\0\20\0\0\0/org/gno"..., 112},
>> {"", 0}], 2) = 112
>> 11201 gettimeofday({1216142988, 598242}, NULL) = 0
>> 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
>> 11201 read(6, "l\3\1\1\315\0\0\0\3\0\0\0m\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
>> 2048) = 333
>> 11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
>> temporarily unavailable)
>> 11201 open("/usr/share/locale/en_US.UTF-8/LC_MESSAGES/GConf2.mo",
>> O_RDONLY) = -1 ENOENT (No such file or directory)
>> 11201 open("/usr/share/locale/en_US.utf8/LC_MESSAGES/GConf2.mo",
>> O_RDONLY) = -1 ENOENT (No such file or directory)
>> 11201 open("/usr/share/locale/en_US/LC_MESSAGES/GConf2.mo", O_RDONLY)
>> = -1 ENOENT (No such file or directory)
>> 11201 open("/usr/share/locale/en.UTF-8/LC_MESSAGES/GConf2.mo",
>> O_RDONLY) = -1 ENOENT (No such file or directory)
>> 11201 open("/usr/share/locale/en.utf8/LC_MESSAGES/GConf2.mo",
>> O_RDONLY) = -1 ENOENT (No such file or directory)
>> 11201 open("/usr/share/locale/en/LC_MESSAGES/GConf2.mo", O_RDONLY) =
>> -1 ENOENT (No such file or directory)
>> 11201 writev(6,
>> [{"l\1\0\1\0\0\0\0\3\0\0\0_\0\0\0\1\1o\0\20\0\0\0/org/gno"..., 112},
>> {"", 0}], 2) = 112
>> 11201 gettimeofday({1216142988, 602061}, NULL) = 0
>> 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
>> 11201 read(6, "l\3\1\1\315\0\0\0\4\0\0\0m\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
>> 2048) = 333
>> 11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
>> temporarily unavailable)
>> 11201 write(2, "Traceback (most recent call last"..., 35) = 35
>> 11201 open("/usr/share/ml-launch/ml-launch.py", O_RDONLY|O_LARGEFILE) = 7
>> 11201 write(2, " File \"/usr/share/ml-launch/ml-"..., 66) = 66
>> 11201 fstat64(7, {st_mode=S_IFREG|0755, st_size=7901, ...}) = 0
>> 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
>> MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
>> 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
>> 11201 read(7, " gtk.gdk.flush()\n "..., 4096) = 3805
>> 11201 write(2, " ", 4) = 4
>> 11201 write(2, "main()\n", 7) = 7
>> 11201 close(7) = 0
>> 11201 munmap(0xb802a000, 4096) = 0
>> 11201 open("/usr/share/ml-launch/ml-launch.py", O_RDONLY|O_LARGEFILE) = 7
>> 11201 write(2, " File \"/usr/share/ml-launch/ml-"..., 62) = 62
>> 11201 fstat64(7, {st_mode=S_IFREG|0755, st_size=7901, ...}) = 0
>> 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
>> MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
>> 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
>> 11201 read(7, " gtk.gdk.flush()\n "..., 4096) = 3805
>> 11201 write(2, " ", 4) = 4
>> 11201 write(2, "launchLevelDialog = LabelDialog("..., 46) = 46
>> 11201 close(7) = 0
>> 11201 munmap(0xb802a000, 4096) = 0
>> 11201 open("/usr/share/ml-launch/label_dialog.py", O_RDONLY|O_LARGEFILE) = 7
>> 11201 write(2, " File \"/usr/share/ml-launch/lab"..., 69) = 69
>> 11201 fstat64(7, {st_mode=S_IFREG|0644, st_size=22290, ...}) = 0
>> 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
>> MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
>> 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
>> 11201 read(7, "ifications[key].sensitivities.va"..., 4096) = 4096
>> 11201 read(7, " if wordIndex < wordCount:\n "..., 4096) = 4096
>> 11201 write(2, " ", 4) = 4
>> 11201 write(2, "self.init_preferences()\n", 24) = 24
>> 11201 close(7) = 0
>> 11201 munmap(0xb802a000, 4096) = 0
>> 11201 open("/usr/share/ml-launch/label_dialog.py", O_RDONLY|O_LARGEFILE) = 7
>> 11201 write(2, " File \"/usr/share/ml-launch/lab"..., 77) = 77
>> 11201 fstat64(7, {st_mode=S_IFREG|0644, st_size=22290, ...}) = 0
>> 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
>> MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
>> 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
>> 11201 read(7, "ifications[key].sensitivities.va"..., 4096) = 4096
>> 11201 read(7, " if wordIndex < wordCount:\n "..., 4096) = 4096
>> 11201 read(7, " self.levels_combobox.connect(\""..., 4096) = 4096
>> 11201 read(7, " %s\" % (key)\n "..., 4096) = 4096
>> 11201 write(2, " ", 4) = 4
>> 11201 write(2, "self.saved_labels_max = self.pre"..., 88) = 88
>> 11201 close(7) = 0
>> 11201 munmap(0xb802a000, 4096) = 0
>> 11201 write(2, "gobject", 7) = 7
>> 11201 write(2, ".", 1) = 1
>> 11201 write(2, "GError", 6) = 6
>> 11201 write(2, ": ", 2) = 2
>> 11201 write(2, "Failed to contact configuration "..., 483) = 483
>> 11201 write(2, "\n", 1) = 1
>> 11201 close(3) = 0
>> 11201 rt_sigaction(SIGINT, {SIG_DFL}, {0x4d651c0, [], 0}, 8) = 0
>> 11200 exit_group(0) = ?
>> 11199 <... waitpid resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 11200
>> 11199 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
>> 11199 --- SIGCHLD (Child exited) @ 0 (0) ---
>> 11199 waitpid(-1, 0xbf98ea38, WNOHANG) = -1 ECHILD (No child processes)
>> 11199 sigreturn() = ? (mask now [])
>> 11199 rt_sigaction(SIGINT, {SIG_DFL}, {0x807c670, [], 0}, 8) = 0
>> 11199 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0
>> 11199 read(255, "\n", 67) = 1
>> 11199 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0
>> 11199 read(255, "", 67) = 0
>> 11199 exit_group(0) = ?
>> 11201 exit_group(1) = ?
> Does it happen in permissive ? If yes, then we are the fall guy for
> some other dbus problem.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkh9BOgACgkQrlYvE4MpobO2SwCgq1DdaaVVpbaOpaWloOa5R6IP
> FNwAoMXBSmV8KVDpEu53+QrdVWeK7dgS
> =zN60
> -----END PGP SIGNATURE-----
>
No, it does not happen in permissive.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: python gui gconf policy problem
2008-07-15 18:25 ` Xavier Toth
2008-07-15 20:13 ` Daniel J Walsh
@ 2008-07-16 11:44 ` Stephen Smalley
2008-07-16 11:44 ` Stephen Smalley
1 sibling, 1 reply; 8+ messages in thread
From: Stephen Smalley @ 2008-07-16 11:44 UTC (permalink / raw)
To: Xavier Toth; +Cc: SELinux List, Daniel J Walsh
On Tue, 2008-07-15 at 13:25 -0500, Xavier Toth wrote:
> On Tue, Jul 15, 2008 at 11:51 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> >
> > On Tue, 2008-07-15 at 11:29 -0500, Xavier Toth wrote:
> >> I'm writing policy for a python gui and having a problem getting preferences:
> >>
> >> gobject.GError: Failed to contact configuration server; some possible
> >> causes are that you need to enable TCP/IP networking for ORBit, or you
> >> have a stale NFS locks due to a system crash. See
> >> http://www.gnome.org/project/gconf/ for information. (Details - 1:
> >> Could not send message to gconf daemon: An SELinux policy prevents
> >> this sender from sending this message to this recipient (rejected
> >> message had interface "org.gnome.GConf member "GetIOR" error name
> >> "(unset)" destination "org.gnome.GConf"))
> >>
> >> The error message states that policy is preventing this operation but
> >> there isn't a corresponding AVC in the audit log. I'm using the
> >> gnome_stream_connect_gconf_template but that doesn't help and I'm not
> >> sure it is the right thing to do anyway.
> >
> > Sounds like a dbus denial, which would show up as a USER_AVC.
> > Or might be dontaudit'd - try semodule -DB.
> >
> > --
> > Stephen Smalley
> > National Security Agency
> >
> >
>
> I have used 'semodule -DB' and I don't see any dbus AVCs and this
> strace shows that a dbus connection is established and some reads and
> writes occur
dbus denials would show up as USER_AVC messages, and they would
successfully connect and read/write, but the daemon would send back an
error message in the reply to the client.
Is this the system bus or the session bus? session bus might not be
able to audit; I don't recall, but audit required capabilities and the
session bus runs as the user.
> 11201 read(6, "", 8192) = 0
> 11201 close(6) = 0
> 11201 munmap(0xb802a000, 4096) = 0
> 11201 socket(PF_FILE, SOCK_STREAM, 0) = 6
> 11201 connect(6, {sa_family=AF_FILE, path=@/tmp/dbus-9MZAW1huFg}, 23) = 0
> 11201 fcntl64(6, F_GETFL) = 0x2 (flags O_RDWR)
> 11201 fcntl64(6, F_SETFL, O_RDWR|O_NONBLOCK) = 0
> 11201 fcntl64(6, F_GETFD) = 0
> 11201 fcntl64(6, F_SETFD, FD_CLOEXEC) = 0
> 11201 geteuid32() = 500
> 11201 rt_sigaction(SIGPIPE, {SIG_IGN}, {SIG_IGN}, 8) = 0
> 11201 poll([{fd=6, events=POLLOUT, revents=POLLOUT}], 1, 0) = 1
> 11201 write(6, "\0", 1) = 1
> 11201 write(6, "AUTH EXTERNAL 353030\r\n", 22) = 22
> 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, -1) = 1
> 11201 read(6, "OK 9d1044c841e17b3bd63f63b3487cc"..., 2048) = 37
> 11201 poll([{fd=6, events=POLLOUT, revents=POLLOUT}], 1, -1) = 1
> 11201 write(6, "BEGIN\r\n", 7) = 7
> 11201 poll([{fd=6, events=POLLIN|POLLOUT, revents=POLLOUT}], 1, -1) = 1
> 11201 writev(6,
> [{"l\1\0\1\0\0\0\0\1\0\0\0n\0\0\0\1\1o\0\25\0\0\0/org/fre"..., 128},
> {"", 0}], 2) = 128
> 11201 gettimeofday({1216142988, 595361}, NULL) = 0
> 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
> 11201 read(6, "l\2\1\1\n\0\0\0\1\0\0\0=\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
> 2048) = 260
> 11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
> temporarily unavailable)
> 11201 writev(6,
> [{"l\1\2\1\0\0\0\0\2\0\0\0_\0\0\0\1\1o\0\20\0\0\0/org/gno"..., 112},
> {"", 0}], 2) = 112
> 11201 gettimeofday({1216142988, 598242}, NULL) = 0
> 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
> 11201 read(6, "l\3\1\1\315\0\0\0\3\0\0\0m\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
> 2048) = 333
> 11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
> temporarily unavailable)
> 11201 open("/usr/share/locale/en_US.UTF-8/LC_MESSAGES/GConf2.mo",
> O_RDONLY) = -1 ENOENT (No such file or directory)
> 11201 open("/usr/share/locale/en_US.utf8/LC_MESSAGES/GConf2.mo",
> O_RDONLY) = -1 ENOENT (No such file or directory)
> 11201 open("/usr/share/locale/en_US/LC_MESSAGES/GConf2.mo", O_RDONLY)
> = -1 ENOENT (No such file or directory)
> 11201 open("/usr/share/locale/en.UTF-8/LC_MESSAGES/GConf2.mo",
> O_RDONLY) = -1 ENOENT (No such file or directory)
> 11201 open("/usr/share/locale/en.utf8/LC_MESSAGES/GConf2.mo",
> O_RDONLY) = -1 ENOENT (No such file or directory)
> 11201 open("/usr/share/locale/en/LC_MESSAGES/GConf2.mo", O_RDONLY) =
> -1 ENOENT (No such file or directory)
> 11201 writev(6,
> [{"l\1\0\1\0\0\0\0\3\0\0\0_\0\0\0\1\1o\0\20\0\0\0/org/gno"..., 112},
> {"", 0}], 2) = 112
> 11201 gettimeofday({1216142988, 602061}, NULL) = 0
> 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
> 11201 read(6, "l\3\1\1\315\0\0\0\4\0\0\0m\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
> 2048) = 333
> 11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
> temporarily unavailable)
> 11201 write(2, "Traceback (most recent call last"..., 35) = 35
> 11201 open("/usr/share/ml-launch/ml-launch.py", O_RDONLY|O_LARGEFILE) = 7
> 11201 write(2, " File \"/usr/share/ml-launch/ml-"..., 66) = 66
> 11201 fstat64(7, {st_mode=S_IFREG|0755, st_size=7901, ...}) = 0
> 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
> 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
> 11201 read(7, " gtk.gdk.flush()\n "..., 4096) = 3805
> 11201 write(2, " ", 4) = 4
> 11201 write(2, "main()\n", 7) = 7
> 11201 close(7) = 0
> 11201 munmap(0xb802a000, 4096) = 0
> 11201 open("/usr/share/ml-launch/ml-launch.py", O_RDONLY|O_LARGEFILE) = 7
> 11201 write(2, " File \"/usr/share/ml-launch/ml-"..., 62) = 62
> 11201 fstat64(7, {st_mode=S_IFREG|0755, st_size=7901, ...}) = 0
> 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
> 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
> 11201 read(7, " gtk.gdk.flush()\n "..., 4096) = 3805
> 11201 write(2, " ", 4) = 4
> 11201 write(2, "launchLevelDialog = LabelDialog("..., 46) = 46
> 11201 close(7) = 0
> 11201 munmap(0xb802a000, 4096) = 0
> 11201 open("/usr/share/ml-launch/label_dialog.py", O_RDONLY|O_LARGEFILE) = 7
> 11201 write(2, " File \"/usr/share/ml-launch/lab"..., 69) = 69
> 11201 fstat64(7, {st_mode=S_IFREG|0644, st_size=22290, ...}) = 0
> 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
> 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
> 11201 read(7, "ifications[key].sensitivities.va"..., 4096) = 4096
> 11201 read(7, " if wordIndex < wordCount:\n "..., 4096) = 4096
> 11201 write(2, " ", 4) = 4
> 11201 write(2, "self.init_preferences()\n", 24) = 24
> 11201 close(7) = 0
> 11201 munmap(0xb802a000, 4096) = 0
> 11201 open("/usr/share/ml-launch/label_dialog.py", O_RDONLY|O_LARGEFILE) = 7
> 11201 write(2, " File \"/usr/share/ml-launch/lab"..., 77) = 77
> 11201 fstat64(7, {st_mode=S_IFREG|0644, st_size=22290, ...}) = 0
> 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
> 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
> 11201 read(7, "ifications[key].sensitivities.va"..., 4096) = 4096
> 11201 read(7, " if wordIndex < wordCount:\n "..., 4096) = 4096
> 11201 read(7, " self.levels_combobox.connect(\""..., 4096) = 4096
> 11201 read(7, " %s\" % (key)\n "..., 4096) = 4096
> 11201 write(2, " ", 4) = 4
> 11201 write(2, "self.saved_labels_max = self.pre"..., 88) = 88
> 11201 close(7) = 0
> 11201 munmap(0xb802a000, 4096) = 0
> 11201 write(2, "gobject", 7) = 7
> 11201 write(2, ".", 1) = 1
> 11201 write(2, "GError", 6) = 6
> 11201 write(2, ": ", 2) = 2
> 11201 write(2, "Failed to contact configuration "..., 483) = 483
> 11201 write(2, "\n", 1) = 1
> 11201 close(3) = 0
> 11201 rt_sigaction(SIGINT, {SIG_DFL}, {0x4d651c0, [], 0}, 8) = 0
> 11200 exit_group(0) = ?
> 11199 <... waitpid resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 11200
> 11199 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
> 11199 --- SIGCHLD (Child exited) @ 0 (0) ---
> 11199 waitpid(-1, 0xbf98ea38, WNOHANG) = -1 ECHILD (No child processes)
> 11199 sigreturn() = ? (mask now [])
> 11199 rt_sigaction(SIGINT, {SIG_DFL}, {0x807c670, [], 0}, 8) = 0
> 11199 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0
> 11199 read(255, "\n", 67) = 1
> 11199 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0
> 11199 read(255, "", 67) = 0
> 11199 exit_group(0) = ?
> 11201 exit_group(1) = ?
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: python gui gconf policy problem
2008-07-16 11:44 ` Stephen Smalley
@ 2008-07-16 11:44 ` Stephen Smalley
2008-07-16 15:40 ` Xavier Toth
0 siblings, 1 reply; 8+ messages in thread
From: Stephen Smalley @ 2008-07-16 11:44 UTC (permalink / raw)
To: Xavier Toth; +Cc: SELinux List, Daniel J Walsh
On Wed, 2008-07-16 at 07:44 -0400, Stephen Smalley wrote:
> On Tue, 2008-07-15 at 13:25 -0500, Xavier Toth wrote:
> > On Tue, Jul 15, 2008 at 11:51 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> > >
> > > On Tue, 2008-07-15 at 11:29 -0500, Xavier Toth wrote:
> > >> I'm writing policy for a python gui and having a problem getting preferences:
> > >>
> > >> gobject.GError: Failed to contact configuration server; some possible
> > >> causes are that you need to enable TCP/IP networking for ORBit, or you
> > >> have a stale NFS locks due to a system crash. See
> > >> http://www.gnome.org/project/gconf/ for information. (Details - 1:
> > >> Could not send message to gconf daemon: An SELinux policy prevents
> > >> this sender from sending this message to this recipient (rejected
> > >> message had interface "org.gnome.GConf member "GetIOR" error name
> > >> "(unset)" destination "org.gnome.GConf"))
> > >>
> > >> The error message states that policy is preventing this operation but
> > >> there isn't a corresponding AVC in the audit log. I'm using the
> > >> gnome_stream_connect_gconf_template but that doesn't help and I'm not
> > >> sure it is the right thing to do anyway.
> > >
> > > Sounds like a dbus denial, which would show up as a USER_AVC.
> > > Or might be dontaudit'd - try semodule -DB.
> > >
> > > --
> > > Stephen Smalley
> > > National Security Agency
> > >
> > >
> >
> > I have used 'semodule -DB' and I don't see any dbus AVCs and this
> > strace shows that a dbus connection is established and some reads and
> > writes occur
>
> dbus denials would show up as USER_AVC messages, and they would
> successfully connect and read/write, but the daemon would send back an
> error message in the reply to the client.
>
> Is this the system bus or the session bus? session bus might not be
> able to audit; I don't recall, but audit required capabilities and the
> session bus runs as the user.
in which case I believe it will fall back to syslog
i.e. /var/log/messages for output.
>
>
> > 11201 read(6, "", 8192) = 0
> > 11201 close(6) = 0
> > 11201 munmap(0xb802a000, 4096) = 0
> > 11201 socket(PF_FILE, SOCK_STREAM, 0) = 6
> > 11201 connect(6, {sa_family=AF_FILE, path=@/tmp/dbus-9MZAW1huFg}, 23) = 0
> > 11201 fcntl64(6, F_GETFL) = 0x2 (flags O_RDWR)
> > 11201 fcntl64(6, F_SETFL, O_RDWR|O_NONBLOCK) = 0
> > 11201 fcntl64(6, F_GETFD) = 0
> > 11201 fcntl64(6, F_SETFD, FD_CLOEXEC) = 0
> > 11201 geteuid32() = 500
> > 11201 rt_sigaction(SIGPIPE, {SIG_IGN}, {SIG_IGN}, 8) = 0
> > 11201 poll([{fd=6, events=POLLOUT, revents=POLLOUT}], 1, 0) = 1
> > 11201 write(6, "\0", 1) = 1
> > 11201 write(6, "AUTH EXTERNAL 353030\r\n", 22) = 22
> > 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, -1) = 1
> > 11201 read(6, "OK 9d1044c841e17b3bd63f63b3487cc"..., 2048) = 37
> > 11201 poll([{fd=6, events=POLLOUT, revents=POLLOUT}], 1, -1) = 1
> > 11201 write(6, "BEGIN\r\n", 7) = 7
> > 11201 poll([{fd=6, events=POLLIN|POLLOUT, revents=POLLOUT}], 1, -1) = 1
> > 11201 writev(6,
> > [{"l\1\0\1\0\0\0\0\1\0\0\0n\0\0\0\1\1o\0\25\0\0\0/org/fre"..., 128},
> > {"", 0}], 2) = 128
> > 11201 gettimeofday({1216142988, 595361}, NULL) = 0
> > 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
> > 11201 read(6, "l\2\1\1\n\0\0\0\1\0\0\0=\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
> > 2048) = 260
> > 11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
> > temporarily unavailable)
> > 11201 writev(6,
> > [{"l\1\2\1\0\0\0\0\2\0\0\0_\0\0\0\1\1o\0\20\0\0\0/org/gno"..., 112},
> > {"", 0}], 2) = 112
> > 11201 gettimeofday({1216142988, 598242}, NULL) = 0
> > 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
> > 11201 read(6, "l\3\1\1\315\0\0\0\3\0\0\0m\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
> > 2048) = 333
> > 11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
> > temporarily unavailable)
> > 11201 open("/usr/share/locale/en_US.UTF-8/LC_MESSAGES/GConf2.mo",
> > O_RDONLY) = -1 ENOENT (No such file or directory)
> > 11201 open("/usr/share/locale/en_US.utf8/LC_MESSAGES/GConf2.mo",
> > O_RDONLY) = -1 ENOENT (No such file or directory)
> > 11201 open("/usr/share/locale/en_US/LC_MESSAGES/GConf2.mo", O_RDONLY)
> > = -1 ENOENT (No such file or directory)
> > 11201 open("/usr/share/locale/en.UTF-8/LC_MESSAGES/GConf2.mo",
> > O_RDONLY) = -1 ENOENT (No such file or directory)
> > 11201 open("/usr/share/locale/en.utf8/LC_MESSAGES/GConf2.mo",
> > O_RDONLY) = -1 ENOENT (No such file or directory)
> > 11201 open("/usr/share/locale/en/LC_MESSAGES/GConf2.mo", O_RDONLY) =
> > -1 ENOENT (No such file or directory)
> > 11201 writev(6,
> > [{"l\1\0\1\0\0\0\0\3\0\0\0_\0\0\0\1\1o\0\20\0\0\0/org/gno"..., 112},
> > {"", 0}], 2) = 112
> > 11201 gettimeofday({1216142988, 602061}, NULL) = 0
> > 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
> > 11201 read(6, "l\3\1\1\315\0\0\0\4\0\0\0m\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
> > 2048) = 333
> > 11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
> > temporarily unavailable)
> > 11201 write(2, "Traceback (most recent call last"..., 35) = 35
> > 11201 open("/usr/share/ml-launch/ml-launch.py", O_RDONLY|O_LARGEFILE) = 7
> > 11201 write(2, " File \"/usr/share/ml-launch/ml-"..., 66) = 66
> > 11201 fstat64(7, {st_mode=S_IFREG|0755, st_size=7901, ...}) = 0
> > 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
> > MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
> > 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
> > 11201 read(7, " gtk.gdk.flush()\n "..., 4096) = 3805
> > 11201 write(2, " ", 4) = 4
> > 11201 write(2, "main()\n", 7) = 7
> > 11201 close(7) = 0
> > 11201 munmap(0xb802a000, 4096) = 0
> > 11201 open("/usr/share/ml-launch/ml-launch.py", O_RDONLY|O_LARGEFILE) = 7
> > 11201 write(2, " File \"/usr/share/ml-launch/ml-"..., 62) = 62
> > 11201 fstat64(7, {st_mode=S_IFREG|0755, st_size=7901, ...}) = 0
> > 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
> > MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
> > 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
> > 11201 read(7, " gtk.gdk.flush()\n "..., 4096) = 3805
> > 11201 write(2, " ", 4) = 4
> > 11201 write(2, "launchLevelDialog = LabelDialog("..., 46) = 46
> > 11201 close(7) = 0
> > 11201 munmap(0xb802a000, 4096) = 0
> > 11201 open("/usr/share/ml-launch/label_dialog.py", O_RDONLY|O_LARGEFILE) = 7
> > 11201 write(2, " File \"/usr/share/ml-launch/lab"..., 69) = 69
> > 11201 fstat64(7, {st_mode=S_IFREG|0644, st_size=22290, ...}) = 0
> > 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
> > MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
> > 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
> > 11201 read(7, "ifications[key].sensitivities.va"..., 4096) = 4096
> > 11201 read(7, " if wordIndex < wordCount:\n "..., 4096) = 4096
> > 11201 write(2, " ", 4) = 4
> > 11201 write(2, "self.init_preferences()\n", 24) = 24
> > 11201 close(7) = 0
> > 11201 munmap(0xb802a000, 4096) = 0
> > 11201 open("/usr/share/ml-launch/label_dialog.py", O_RDONLY|O_LARGEFILE) = 7
> > 11201 write(2, " File \"/usr/share/ml-launch/lab"..., 77) = 77
> > 11201 fstat64(7, {st_mode=S_IFREG|0644, st_size=22290, ...}) = 0
> > 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
> > MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
> > 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
> > 11201 read(7, "ifications[key].sensitivities.va"..., 4096) = 4096
> > 11201 read(7, " if wordIndex < wordCount:\n "..., 4096) = 4096
> > 11201 read(7, " self.levels_combobox.connect(\""..., 4096) = 4096
> > 11201 read(7, " %s\" % (key)\n "..., 4096) = 4096
> > 11201 write(2, " ", 4) = 4
> > 11201 write(2, "self.saved_labels_max = self.pre"..., 88) = 88
> > 11201 close(7) = 0
> > 11201 munmap(0xb802a000, 4096) = 0
> > 11201 write(2, "gobject", 7) = 7
> > 11201 write(2, ".", 1) = 1
> > 11201 write(2, "GError", 6) = 6
> > 11201 write(2, ": ", 2) = 2
> > 11201 write(2, "Failed to contact configuration "..., 483) = 483
> > 11201 write(2, "\n", 1) = 1
> > 11201 close(3) = 0
> > 11201 rt_sigaction(SIGINT, {SIG_DFL}, {0x4d651c0, [], 0}, 8) = 0
> > 11200 exit_group(0) = ?
> > 11199 <... waitpid resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 11200
> > 11199 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
> > 11199 --- SIGCHLD (Child exited) @ 0 (0) ---
> > 11199 waitpid(-1, 0xbf98ea38, WNOHANG) = -1 ECHILD (No child processes)
> > 11199 sigreturn() = ? (mask now [])
> > 11199 rt_sigaction(SIGINT, {SIG_DFL}, {0x807c670, [], 0}, 8) = 0
> > 11199 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0
> > 11199 read(255, "\n", 67) = 1
> > 11199 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0
> > 11199 read(255, "", 67) = 0
> > 11199 exit_group(0) = ?
> > 11201 exit_group(1) = ?
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: python gui gconf policy problem
2008-07-16 11:44 ` Stephen Smalley
@ 2008-07-16 15:40 ` Xavier Toth
0 siblings, 0 replies; 8+ messages in thread
From: Xavier Toth @ 2008-07-16 15:40 UTC (permalink / raw)
To: Stephen Smalley; +Cc: SELinux List, Daniel J Walsh
On Wed, Jul 16, 2008 at 6:44 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
>
> On Wed, 2008-07-16 at 07:44 -0400, Stephen Smalley wrote:
>> On Tue, 2008-07-15 at 13:25 -0500, Xavier Toth wrote:
>> > On Tue, Jul 15, 2008 at 11:51 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
>> > >
>> > > On Tue, 2008-07-15 at 11:29 -0500, Xavier Toth wrote:
>> > >> I'm writing policy for a python gui and having a problem getting preferences:
>> > >>
>> > >> gobject.GError: Failed to contact configuration server; some possible
>> > >> causes are that you need to enable TCP/IP networking for ORBit, or you
>> > >> have a stale NFS locks due to a system crash. See
>> > >> http://www.gnome.org/project/gconf/ for information. (Details - 1:
>> > >> Could not send message to gconf daemon: An SELinux policy prevents
>> > >> this sender from sending this message to this recipient (rejected
>> > >> message had interface "org.gnome.GConf member "GetIOR" error name
>> > >> "(unset)" destination "org.gnome.GConf"))
>> > >>
>> > >> The error message states that policy is preventing this operation but
>> > >> there isn't a corresponding AVC in the audit log. I'm using the
>> > >> gnome_stream_connect_gconf_template but that doesn't help and I'm not
>> > >> sure it is the right thing to do anyway.
>> > >
>> > > Sounds like a dbus denial, which would show up as a USER_AVC.
>> > > Or might be dontaudit'd - try semodule -DB.
>> > >
>> > > --
>> > > Stephen Smalley
>> > > National Security Agency
>> > >
>> > >
>> >
>> > I have used 'semodule -DB' and I don't see any dbus AVCs and this
>> > strace shows that a dbus connection is established and some reads and
>> > writes occur
>>
>> dbus denials would show up as USER_AVC messages, and they would
>> successfully connect and read/write, but the daemon would send back an
>> error message in the reply to the client.
>>
>> Is this the system bus or the session bus? session bus might not be
>> able to audit; I don't recall, but audit required capabilities and the
>> session bus runs as the user.
>
> in which case I believe it will fall back to syslog
> i.e. /var/log/messages for output.
>
>>
>>
>> > 11201 read(6, "", 8192) = 0
>> > 11201 close(6) = 0
>> > 11201 munmap(0xb802a000, 4096) = 0
>> > 11201 socket(PF_FILE, SOCK_STREAM, 0) = 6
>> > 11201 connect(6, {sa_family=AF_FILE, path=@/tmp/dbus-9MZAW1huFg}, 23) = 0
>> > 11201 fcntl64(6, F_GETFL) = 0x2 (flags O_RDWR)
>> > 11201 fcntl64(6, F_SETFL, O_RDWR|O_NONBLOCK) = 0
>> > 11201 fcntl64(6, F_GETFD) = 0
>> > 11201 fcntl64(6, F_SETFD, FD_CLOEXEC) = 0
>> > 11201 geteuid32() = 500
>> > 11201 rt_sigaction(SIGPIPE, {SIG_IGN}, {SIG_IGN}, 8) = 0
>> > 11201 poll([{fd=6, events=POLLOUT, revents=POLLOUT}], 1, 0) = 1
>> > 11201 write(6, "\0", 1) = 1
>> > 11201 write(6, "AUTH EXTERNAL 353030\r\n", 22) = 22
>> > 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, -1) = 1
>> > 11201 read(6, "OK 9d1044c841e17b3bd63f63b3487cc"..., 2048) = 37
>> > 11201 poll([{fd=6, events=POLLOUT, revents=POLLOUT}], 1, -1) = 1
>> > 11201 write(6, "BEGIN\r\n", 7) = 7
>> > 11201 poll([{fd=6, events=POLLIN|POLLOUT, revents=POLLOUT}], 1, -1) = 1
>> > 11201 writev(6,
>> > [{"l\1\0\1\0\0\0\0\1\0\0\0n\0\0\0\1\1o\0\25\0\0\0/org/fre"..., 128},
>> > {"", 0}], 2) = 128
>> > 11201 gettimeofday({1216142988, 595361}, NULL) = 0
>> > 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
>> > 11201 read(6, "l\2\1\1\n\0\0\0\1\0\0\0=\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
>> > 2048) = 260
>> > 11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
>> > temporarily unavailable)
>> > 11201 writev(6,
>> > [{"l\1\2\1\0\0\0\0\2\0\0\0_\0\0\0\1\1o\0\20\0\0\0/org/gno"..., 112},
>> > {"", 0}], 2) = 112
>> > 11201 gettimeofday({1216142988, 598242}, NULL) = 0
>> > 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
>> > 11201 read(6, "l\3\1\1\315\0\0\0\3\0\0\0m\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
>> > 2048) = 333
>> > 11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
>> > temporarily unavailable)
>> > 11201 open("/usr/share/locale/en_US.UTF-8/LC_MESSAGES/GConf2.mo",
>> > O_RDONLY) = -1 ENOENT (No such file or directory)
>> > 11201 open("/usr/share/locale/en_US.utf8/LC_MESSAGES/GConf2.mo",
>> > O_RDONLY) = -1 ENOENT (No such file or directory)
>> > 11201 open("/usr/share/locale/en_US/LC_MESSAGES/GConf2.mo", O_RDONLY)
>> > = -1 ENOENT (No such file or directory)
>> > 11201 open("/usr/share/locale/en.UTF-8/LC_MESSAGES/GConf2.mo",
>> > O_RDONLY) = -1 ENOENT (No such file or directory)
>> > 11201 open("/usr/share/locale/en.utf8/LC_MESSAGES/GConf2.mo",
>> > O_RDONLY) = -1 ENOENT (No such file or directory)
>> > 11201 open("/usr/share/locale/en/LC_MESSAGES/GConf2.mo", O_RDONLY) =
>> > -1 ENOENT (No such file or directory)
>> > 11201 writev(6,
>> > [{"l\1\0\1\0\0\0\0\3\0\0\0_\0\0\0\1\1o\0\20\0\0\0/org/gno"..., 112},
>> > {"", 0}], 2) = 112
>> > 11201 gettimeofday({1216142988, 602061}, NULL) = 0
>> > 11201 poll([{fd=6, events=POLLIN, revents=POLLIN}], 1, 25000) = 1
>> > 11201 read(6, "l\3\1\1\315\0\0\0\4\0\0\0m\0\0\0\6\1s\0\5\0\0\0:1.29\0\0\0"...,
>> > 2048) = 333
>> > 11201 read(6, 0x867c4c0, 2048) = -1 EAGAIN (Resource
>> > temporarily unavailable)
>> > 11201 write(2, "Traceback (most recent call last"..., 35) = 35
>> > 11201 open("/usr/share/ml-launch/ml-launch.py", O_RDONLY|O_LARGEFILE) = 7
>> > 11201 write(2, " File \"/usr/share/ml-launch/ml-"..., 66) = 66
>> > 11201 fstat64(7, {st_mode=S_IFREG|0755, st_size=7901, ...}) = 0
>> > 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
>> > MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
>> > 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
>> > 11201 read(7, " gtk.gdk.flush()\n "..., 4096) = 3805
>> > 11201 write(2, " ", 4) = 4
>> > 11201 write(2, "main()\n", 7) = 7
>> > 11201 close(7) = 0
>> > 11201 munmap(0xb802a000, 4096) = 0
>> > 11201 open("/usr/share/ml-launch/ml-launch.py", O_RDONLY|O_LARGEFILE) = 7
>> > 11201 write(2, " File \"/usr/share/ml-launch/ml-"..., 62) = 62
>> > 11201 fstat64(7, {st_mode=S_IFREG|0755, st_size=7901, ...}) = 0
>> > 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
>> > MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
>> > 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
>> > 11201 read(7, " gtk.gdk.flush()\n "..., 4096) = 3805
>> > 11201 write(2, " ", 4) = 4
>> > 11201 write(2, "launchLevelDialog = LabelDialog("..., 46) = 46
>> > 11201 close(7) = 0
>> > 11201 munmap(0xb802a000, 4096) = 0
>> > 11201 open("/usr/share/ml-launch/label_dialog.py", O_RDONLY|O_LARGEFILE) = 7
>> > 11201 write(2, " File \"/usr/share/ml-launch/lab"..., 69) = 69
>> > 11201 fstat64(7, {st_mode=S_IFREG|0644, st_size=22290, ...}) = 0
>> > 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
>> > MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
>> > 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
>> > 11201 read(7, "ifications[key].sensitivities.va"..., 4096) = 4096
>> > 11201 read(7, " if wordIndex < wordCount:\n "..., 4096) = 4096
>> > 11201 write(2, " ", 4) = 4
>> > 11201 write(2, "self.init_preferences()\n", 24) = 24
>> > 11201 close(7) = 0
>> > 11201 munmap(0xb802a000, 4096) = 0
>> > 11201 open("/usr/share/ml-launch/label_dialog.py", O_RDONLY|O_LARGEFILE) = 7
>> > 11201 write(2, " File \"/usr/share/ml-launch/lab"..., 77) = 77
>> > 11201 fstat64(7, {st_mode=S_IFREG|0644, st_size=22290, ...}) = 0
>> > 11201 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
>> > MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb802a000
>> > 11201 read(7, "#!/usr/bin/env python\nimport log"..., 4096) = 4096
>> > 11201 read(7, "ifications[key].sensitivities.va"..., 4096) = 4096
>> > 11201 read(7, " if wordIndex < wordCount:\n "..., 4096) = 4096
>> > 11201 read(7, " self.levels_combobox.connect(\""..., 4096) = 4096
>> > 11201 read(7, " %s\" % (key)\n "..., 4096) = 4096
>> > 11201 write(2, " ", 4) = 4
>> > 11201 write(2, "self.saved_labels_max = self.pre"..., 88) = 88
>> > 11201 close(7) = 0
>> > 11201 munmap(0xb802a000, 4096) = 0
>> > 11201 write(2, "gobject", 7) = 7
>> > 11201 write(2, ".", 1) = 1
>> > 11201 write(2, "GError", 6) = 6
>> > 11201 write(2, ": ", 2) = 2
>> > 11201 write(2, "Failed to contact configuration "..., 483) = 483
>> > 11201 write(2, "\n", 1) = 1
>> > 11201 close(3) = 0
>> > 11201 rt_sigaction(SIGINT, {SIG_DFL}, {0x4d651c0, [], 0}, 8) = 0
>> > 11200 exit_group(0) = ?
>> > 11199 <... waitpid resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 11200
>> > 11199 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
>> > 11199 --- SIGCHLD (Child exited) @ 0 (0) ---
>> > 11199 waitpid(-1, 0xbf98ea38, WNOHANG) = -1 ECHILD (No child processes)
>> > 11199 sigreturn() = ? (mask now [])
>> > 11199 rt_sigaction(SIGINT, {SIG_DFL}, {0x807c670, [], 0}, 8) = 0
>> > 11199 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0
>> > 11199 read(255, "\n", 67) = 1
>> > 11199 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0
>> > 11199 read(255, "", 67) = 0
>> > 11199 exit_group(0) = ?
>> > 11201 exit_group(1) = ?
> --
> Stephen Smalley
> National Security Agency
>
>
Yes there were some dbus AVCs in /var/log/messages which when
addressed seems to have fix the problem.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2008-07-16 15:40 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-07-15 16:29 python gui gconf policy problem Xavier Toth
2008-07-15 16:51 ` Stephen Smalley
2008-07-15 18:25 ` Xavier Toth
2008-07-15 20:13 ` Daniel J Walsh
2008-07-15 20:57 ` Xavier Toth
2008-07-16 11:44 ` Stephen Smalley
2008-07-16 11:44 ` Stephen Smalley
2008-07-16 15:40 ` Xavier Toth
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.