Bug 1038675

Description of problem:
I installed the 'openlmi' meta-package and the 'openlmi-tools package' and started the tog-pegasus service (via 'systemctl start tog-pegasus'). I ran the following script with the lmishell command (as 'lmishell ./indication_demo.lmi'). I received the AVC reported in this ABRT message.



import sys
import time
import pynotify
import os
import getpass

if not pynotify.init("lmishell_indication"):
    sys.exit(4)

def useradd_notifier(indication, **kwargs):
    sys.stdout.write("new user\n")
    n = pynotify.Notification("New user", "A new user was added to the system")

    if not n.show():
        sys.stdout.write("Failed to send notification")
        sys.exit(5)

listening_port = 65500

# Run this script as root and this will use the
# local UNIX socket. Otherwise, modify this line
# to match the system you are connecting to

if os.getuid() == 0:
    c = connect('localhost')
else:
    # Prompt for username and password of CIM user
    user = raw_input('User: ')
    passwd = getpass.getpass("Password: ")
    
    c = connect('localhost', user, passwd)

if not c:
    sys.stdout.write("Couldn't authenticate\n")
    sys.exit(1)

sys.stdout.write("Starting up indication listener\n")

# First, start up an indication listener
listener = LMIIndicationListener("0.0.0.0", listening_port)
uniquename = listener.add_handler("useradd-XXXXXXXX", useradd_notifier)

sys.stdout.write("useradd handler created, starting listener for %s\n" % uniquename)

res = listener.start()
if not res:
    sys.stdout.write("I'm a poor listener\n")
    sys.exit(2)

sys.stdout.write("listener started, subscribing to indication\n")

# Subscribe to the account creation indication
retval = c.subscribe_indication(
    FilterCreationClassName="CIM_IndicationFilter",
    FilterSystemCreationClassName="CIM_ComputerSystem",
    FilterSourceNamespace="root/cimv2",
    QueryLanguage="DMTF:CQL",
    Query='SELECT * FROM LMI_AccountInstanceCreationIndication WHERE SOURCEINSTANCE ISA LMI_Account',
    Name=uniquename,
    CreationNamespace="root/interop",
    SubscriptionCreationClassName="CIM_IndicationSubscription",
    HandlerCreationClassName="CIM_IndicationHandlerCIMXML",
    HandlerSystemCreationClassName="CIM_ComputerSystem",
    # this is the destination computer, where all the indications will be
    # delivered
    Destination="http://localhost:%d" % (listening_port)
)

if not retval or not retval.rval:
    sys.stdout.write("Failed to register indication: %s\n" % retval.errorstr)
    sys.exit(2)

sys.stdout.write('indication registered\n')

# Loop forever. The listener is running in another thread
while True:
    time.sleep(90)
    pass
SELinux is preventing /usr/libexec/pegasus/cimprovagt from 'read' accesses on the file /var/log/wtmp.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that cimprovagt should be allowed read access on the wtmp file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
Target Context                system_u:object_r:wtmp_t:s0
Target Objects                /var/log/wtmp [ file ]
Source                        cimprovagt
Source Path                   /usr/libexec/pegasus/cimprovagt
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           tog-pegasus-2.12.1-10.fc20.x86_64
Target RPM Packages           initscripts-9.50-1.fc20.x86_64
Policy RPM                    selinux-policy-3.12.1-90.fc20.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.11.9-300.fc20.x86_64 #1 SMP Wed
                              Nov 20 22:23:25 UTC 2013 x86_64 x86_64
Alert Count                   198
First Seen                    2013-11-25 13:47:08 EST
Last Seen                     2013-12-05 10:38:04 EST
Local ID                      d66e3b06-483e-4c11-897c-14c7cdf53ec2

Raw Audit Messages
type=AVC msg=audit(1386257884.312:1078): avc:  denied  { read } for  pid=1935 comm="cimprovagt" name="wtmp" dev="dm-2" ino=1051159 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:wtmp_t:s0 tclass=file


type=SYSCALL msg=audit(1386257884.312:1078): arch=x86_64 syscall=open success=no exit=EACCES a0=7fa3740a7d00 a1=80000 a2=7fa37cc359aa a3=7fa37cbf70a0 items=0 ppid=1 pid=1935 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)

Hash: cimprovagt,pegasus_openlmi_account_t,wtmp_t,file,read

Additional info:
reporter:       libreport-2.1.9
hashmarkername: setroubleshoot
kernel:         3.11.9-300.fc20.x86_64
type:           libreport