From a8b8cc2e1321eaaded36f703b33f7dfce683d4a9 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Apr 05 2017 13:55:11 +0000 Subject: plugins: fix restorecon "then" text In case a syscall fails due to insufficient permissions to parent directory of target object, PATH record provided by audit will contain path to the target object of the syscall (not the parent directory). Unfortunately I haven't found a way to distinguish this case (let alone determine the parent directory causing the denial). Update restorecon plugin "then" text to let the user know that the provided command may not help (since restorecon is called on the wrong object). fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1332097 Signed-off-by: Vit Mojzis --- diff --git a/plugins/src/restorecon.py b/plugins/src/restorecon.py index beef28f..8179703 100644 --- a/plugins/src/restorecon.py +++ b/plugins/src/restorecon.py @@ -92,7 +92,9 @@ class plugin(Plugin): def get_if_text(self, avc, args): return self.if_text % args[1] - then_text = _('you can run restorecon.') + + then_text = _('you can run restorecon. The access attempt may have been stopped due to insufficient' \ + + ' permissions to access a parent directory in which case try to change the following command accordingly.') do_text = '# /sbin/restorecon -v $TARGET_PATH' def __init__(self):