Bug 1134558

+++ This bug was initially created as a clone of Bug #1134553 +++

Description of problem:
Attempted to run 'rolectl list instances'

The issue appears to be an incorrectly-handled SELinux denial which crashes roled and fails to return an error to the rolectl client, which waits forever.

Version-Release number of selected component:
rolekit-0.0.3-1.fc21

Additional info:
reporter:       libreport-2.2.3
cmdline:        /usr/bin/python -Es /usr/sbin/roled --nofork --nopid
dso_list:       dbus-python-1.2.0-6.fc21.x86_64
executable:     /usr/sbin/roled
kernel:         3.16.1-300.fc21.x86_64
runlevel:       N 3
type:           Python
uid:            0

Truncated backtrace:
connection.py:584:call_async:ValueError: Unable to guess signature from an empty dict

Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/dbus/connection.py", line 607, in msg_reply_handler
    *message.get_args_list()))
  File "/usr/lib/python2.7/site-packages/dbus/proxies.py", line 416, in _introspect_error_handler
    self._introspect_execute_queue()
  File "/usr/lib/python2.7/site-packages/dbus/proxies.py", line 387, in _introspect_execute_queue
    proxy_method(*args, **keywords)
  File "/usr/lib/python2.7/site-packages/dbus/proxies.py", line 137, in __call__
    **keywords)
  File "/usr/lib/python2.7/site-packages/dbus/connection.py", line 584, in call_async
    message.append(signature=signature, *args)
ValueError: Unable to guess signature from an empty dict

Local variables in innermost frame:
bus_name: dbus.UTF8String(':1.5')
byte_arrays: False
self: <dbus._dbus.SystemBus (system) at 0x7f7b99aa9590>
args: (('system-bus-name', {'name': ':1.29'}), 'org.fedoraproject.rolekit1.all', {}, 1, '')
require_main_loop: True
object_path: '/org/freedesktop/PolicyKit1/Authority'
signature: None
reply_handler: <function reply_cb at 0x7f7b9749b2a8>
error_handler: <function error_handler at 0x7f7b9749b1b8>
dbus_interface: 'org.freedesktop.PolicyKit1.Authority'
timeout: 2147483.647
kwargs: {}
e: ValueError('Unable to guess signature from an empty dict',)
message: <dbus.lowlevel.MethodCallMessage path: /org/freedesktop/PolicyKit1/Authority, iface: org.freedesktop.PolicyKit1.Authority, member: CheckAuthorization dest: :1.5>
get_args_opts: {'byte_arrays': False, 'utf8_strings': False}
method: 'CheckAuthorization'

--- Additional comment from Stephen Gallagher on 2014-08-27 14:47:17 EDT ---



--- Additional comment from Stephen Gallagher on 2014-08-27 14:47:18 EDT ---



--- Additional comment from Stephen Gallagher on 2014-08-27 15:00:23 EDT ---

I say that it's related to SELinux because it doesn't hang in permissive mode.

There are two bugs here: one in SELinux to properly allow the behavior and another in cockpit itself to properly handle permission denied errors.

audit2why:

type=USER_AVC msg=audit(1409164980.789:721): pid=608 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.30 spid=748 tpid=22117 scontext=system_u:system_r:policykit_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.