setroubleshoot

#20 restorecon plugin: detect when syscalls fail because of search denials in path resolution
Opened by janzarsky. Modified

Open
Close Issue

Sometimes syscalls fail because the search permission is denied on some directory in the path and EACCESS is returned. The restorecon plugin does not recognize this situation and associates the 'denied { search }' AVC with the complete path provided to the syscall.

See the original bug: https://bugzilla.redhat.com/show_bug.cgi?id=1332097

The restorecon plugin should look at the name field in the AVC and compare it with the path field in the PATH message. Or it could somehow use the inode numbers to check which directory is connected to the AVC message.

Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.