OK, so setup CENTOS-5 on a laptop to learn about Xen stuff. KDE Desktop, wanted to print the virt.108.com xen howto. Needed to setup printer first. Open KDE control center, go to printers. Hear error sound, message says
"Unable to retrieve the printer list.... Connection to CUPS server failed. ..."
So I check to see that cups is running (it is). I check /var/log/messages and see:
Apr 19 15:19:52 fox setroubleshoot: SELinux is preventing /usr/sbin/cupsd (cupsd_t) "read write" access to socket:[15083] (rpm_var_lib_t). For complete SELinux messages. run sealert -l 23689411-4e18-4009-b105-779c58b0503f
So, I run sealert (as indicated) and see the message about cups (see below for output)
I checked in /usr/share/docs/selinux-policy-2.4.6/html and find no references (using grub) for "cupsd_disable_trans" I google on "cupsd_disable_trans" and find no references either.
How do I find out what this boolean object is or does? Is there a description of it somewhere? Is it dangerous to just run the command that sealert tells me to run?
[root@fox log]# sealert -l 23689411-4e18-4009-b105-779c58b0503f Summary SELinux is preventing /usr/sbin/cupsd (cupsd_t) "read write" access to socket:[15083] (rpm_var_lib_t).
Detailed Description SELinux denied access requested by /usr/sbin/cupsd. It is not expected that this access is required by /usr/sbin/cupsd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for socket:[15083], restorecon -v socket:[15083]. There is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 - or you can disable SELinux protection entirely for the application. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Changing the "cupsd_disable_trans" boolean to true will disable SELinux protection this application: "setsebool -P cupsd_disable_trans=1."
The following command will allow this access: setsebool -P cupsd_disable_trans=1
Additional Information
Source Context system_u:system_r:cupsd_t:SystemLow-SystemHigh Target Context system_u:object_r:rpm_var_lib_t Target Objects socket:[15083] [ file ] Affected RPM Packages cups-1.2.4-11.5.1.el5 [application] Policy RPM selinux-policy-2.4.6-30.el5 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.disable_trans Host Name fox Platform Linux fox 2.6.18-8.el5xen #1 SMP Thu Mar 15 21:02:53 EDT 2007 i686 i686 Alert Count 1 Line Numbers
Raw Audit Messages
avc: denied { read, write } for comm="cupsd" dev=dm-0 egid=0 euid=0 exe="/usr/sbin/cupsd" exit=0 fsgid=0 fsuid=0 gid=0 items=0 name="__db.000" path="socket:[15083]" pid=5515 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 sgid=0 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 suid=0 tclass=file tcontext=system_u:object_r:rpm_var_lib_t:s0 tty=tty1 uid=0
I checked in /usr/share/docs/selinux-policy-2.4.6/html and find no references (using grub) for "cupsd_disable_trans"
How do I find out what this boolean object is or does? Is there a description of it somewhere?