LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > CentOS
User Name
Password
CentOS This forum is for the discussion of CentOS Linux. Note: This forum does not have any official participation.

Notices


Reply
  Search this Thread
Old 03-10-2016, 10:43 PM   #1
gatliffe
Member
 
Registered: Nov 2003
Posts: 32

Rep: Reputation: 15
Question SElinux blocking printer


New green horn to centos this is a new install, I have a Brother MFC J485dw printer I install all the driver the printer is showing up and show it as waiting to print but a message was coming up telling it block from printing by SElinux i think it blocking cups here what SElinux troubleshooter tell me, any ideas Thanks

SELinux is preventing /opt/brother/Printers/mfcj480dw/cupswrapper/brcupsconfpt1 from execute access on the file /etc/ld.so.cache.

***** Plugin catchall (100. confidence) suggests **************************

If you believe that brcupsconfpt1 should be allowed execute access on the ld.so.cache file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep brcupsconfpt1 /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context system_u:system_r:cupsd_t:s0-s0:c0.c1023
Target Context system_ubject_r:ld_so_cache_t:s0
Target Objects /etc/ld.so.cache [ file ]
Source brcupsconfpt1
Source Path /opt/brother/Printers/mfcj480dw/cupswrapper/brcups
confpt1
Port <Unknown>
Host localhost.localdomain
Source RPM Packages mfcj480dwlpr-1.0.0-0.i386
Target RPM Packages glibc-2.17-106.el7_2.4.x86_64
glibc-2.17-106.el7_2.4.i686
Policy RPM selinux-policy-3.13.1-60.el7_2.3.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name localhost.localdomain
Platform Linux localhost.localdomain
3.10.0-327.10.1.el7.x86_64 #1 SMP Tue Feb 16
17:03:50 UTC 2016 x86_64 x86_64
Alert Count 88
First Seen 2016-03-10 19:04:06 CST
Last Seen 2016-03-10 22:19:10 CST
Local ID 362bbd0e-b646-483e-92ad-49ca20a018da

Raw Audit Messages
type=AVC msg=audit(1457669950.985:662): avc: denied { execute } for pid=10235 comm="brmfcj480dwfilt" path="/etc/ld.so.cache" dev="dm-0" ino=140160984 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_ubject_r:ld_so_cache_t:s0 tclass=file


type=SYSCALL msg=audit(1457669950.985:662): arch=i386 syscall=lgetxattr per=400000 success=no exit=EACCES a0=0 a1=15699 a2=1 a3=2 items=0 ppid=10131 pid=10235 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm=brmfcj480dwfilt exe=/opt/brother/Printers/mfcj480dw/lpd/brmfcj480dwfilter subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)

Hash: brcupsconfpt1,cupsd_t,ld_so_cache_t,file,execute

Last edited by gatliffe; 03-10-2016 at 11:55 PM.
 
Old 03-11-2016, 08:48 AM   #2
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: Rocky Linux
Posts: 4,782

Rep: Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214
/etc/ld.so.cache is not an executable file. It makes no sense that brcupsconfpt1 would be trying to execute it. That exec() call is going to fail anyway. Try running in permissive mode to see if SELinux is really the issue. I suspect that the AVC denial is just noise and the problem is elsewhere.
 
Old 03-11-2016, 01:21 PM   #3
John VV
LQ Muse
 
Registered: Aug 2005
Location: A2 area Mi.
Posts: 17,627

Rep: Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651
" /opt/brother/Printers "
that is a NON standard location and likley not even in the system path ( unless you manually edited /etc/profile )

HOW exactly did you " I install all the driver the printer" ????

cups should have seen it

did you use the normal cups web interface ?

http://localhost:631/

the link above is YOUR computer

click it and set up with that
 
Old 03-11-2016, 03:39 PM   #4
gatliffe
Member
 
Registered: Nov 2003
Posts: 32

Original Poster
Rep: Reputation: 15
The printer was install by downloading the drivers from Brothers site then application installer install them , I try doing cups but say "Forbidden"
 
Old 03-11-2016, 04:06 PM   #5
John VV
LQ Muse
 
Registered: Aug 2005
Location: A2 area Mi.
Posts: 17,627

Rep: Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651
you do need to be root
a pop up asking for the root password will pop up on the cups 631 port

select add new printer and select from the list

most printers are listed

https://access.redhat.com/documentat...g_Printer.html

recheck the security policy
https://access.redhat.com/documentat...olicy-x86.html
 
  


Reply

Tags
cups, printing



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Why is SELinux blocking my FTP uploads? fakefake Linux - Server 26 10-13-2017 08:16 PM
selinux is blocking apache and causing a 403 daemon_byte Linux - Security 9 08-15-2011 02:30 PM
Red Hat SeLinux is blocking ssh and http unix1adm Linux - Security 11 03-07-2011 02:04 PM
SELinux is blocking Webalizer on RHEL5.2 Install BeauSanders Linux - Security 1 10-01-2008 02:17 PM
Help, Selinux blocking append to named.log. mysteron Linux - Security 2 07-15-2008 07:01 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > CentOS

All times are GMT -5. The time now is 03:47 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration