Bug 1245364

Summary:	/dev/lirc0 has incorrect permissions after clean install of f22
Product:	[Fedora] Fedora	Reporter:	dwgoldfarb
Component:	lirc	Assignee:	Alec Leamas <leamas.alec>
Status:	CLOSED NEXTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	low	Docs Contact:
Priority:	unspecified
Version:	22	CC:	bnocera, fedora, jarodwilson, leamas.alec, raveit65.sun, redhat-bugzilla
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	0.9.3-5.fc23	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-09-19 18:55:27 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description dwgoldfarb 2015-07-21 21:18:58 UTC

Description of problem:

I did a clean install of f22 workstation from a LiveUSB stick.  After adding the lirc/lirc-core/lirc-libs packages and attempting to use a Remote control, I found the following error in /var/log/messages:


Jul 21 14:26:50 theatre lircd: lircd-0.9.2a[1115]: default_init(): Permission denied
Jul 21 14:26:50 theatre lircd-0.9.2a[1115]: Error: could not open /dev/lirc0


"lircd" is now running under user "lirc" which is a change from f20 (last release I am familiar with) where it ran as user "root"


ps -ef | grep lircd
lirc      1113     1  0 16:38 ?        00:00:00 /usr/sbin/lircd --nodaemon



But the /dev/lirc0 device is readable only by root:

ls -ls /dev/lirc0
0 crw-------. 1 root root 248, 0 Jul 21 16:37 /dev/lirc0



I see that a udev rule comes in lirc-core, but is not installed by default:

/usr/share/lirc/contrib/60-lirc.rules contains:

KERNEL=="lirc[0-9]*", SUBSYSTEM=="lirc", GROUP="lirc", MODE="0660"


This rule would change the permission to:

0 crw-rw----. 1 root lirc 248, 0 Jul 21 16:37 /dev/lirc0

which should work (I haven't tried it).  The rule I use is:

KERNEL=="lirc*", SUBSYSTEM=="lirc", OWNER="lirc"

Which changes the owner of the device to lirc so that it can be read/written by the lircd process.




Version-Release number of selected component (if applicable): lirc 0.9.2a


How reproducible:


Steps to Reproduce:
As root:

1.  fresh install of f22
1.5: setenforce Permissive
2.  dnf install lirc
3.  install a conf file in /etc/lirc/lircd.conf.d  that corresponds to the remote
3.  systemctl enable lircd
4.  systemctl start lircd

As a normal user: 

5:  /usr/bin/irw

Actual results:

The "Permission denied" messages above

Expected results:

irw connects to the lircd daemon and receives remote control info.


Additional info:

Install I used was on an IntelNUC with built in IR receiver.  You don't necessarily need a working remote control to reproduce as the error is seen as irw starts up.

Comment 1 Alec Leamas 2015-07-30 16:03:39 UTC

I have released previews of 0.9.3 at https://copr.fedoraproject.org/coprs/leamas/lirc-0.9.3preview including this patch. Unless requested, I don't plan to make new 0.9.2 release just for this issue.

Comment 2 Michael Chapman 2015-08-22 08:56:43 UTC

(In reply to Alec Leamas from comment #1)
> I have released previews of 0.9.3 at
> https://copr.fedoraproject.org/coprs/leamas/lirc-0.9.3preview including this
> patch. Unless requested, I don't plan to make new 0.9.2 release just for
> this issue.

Thanks for the preview release.

Note that if you do end up adding this udev rule to a 0.9.2 package, the OWNER of the device node will also have to be set to "lirc", not just GROUP. 0.9.2 calls setuid() but leaves its groups alone; it looks like a call to setgid() is introduced in 0.9.3.

I bring this up because I will soon be raising a bug report against selinux-policy-targeted to make these setuid() and setgid() calls actually succeed. With the current policy on F22 they are denied, which means if SELinux is enforcing lircd is unable to drop privileges and it keeps running as root.

Comment 3 Alec Leamas 2015-08-23 11:49:56 UTC

Thanks for bringing this up!

I don't think setting the owner is necessary. 0.9.3 also sets the groups and gid, see https://sourceforge.net/p/lirc/git/ci/58374e7b290997925b4b
and
https://sourceforge.net/p/lirc/git/ci/58374e7

Comment 4 Fedora Update System 2015-09-06 03:50:45 UTC

lirc-0.9.3-2.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-15207

Comment 5 Fedora Update System 2015-09-06 19:11:30 UTC

lirc-0.9.3-3.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-15228

Comment 6 Fedora Update System 2015-09-06 21:56:45 UTC

lirc-0.9.3-2.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update lirc'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-15207

Comment 7 Fedora Update System 2015-09-07 12:39:37 UTC

lirc-0.9.3-4.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-15270

Comment 8 Fedora Update System 2015-09-07 18:20:11 UTC

lirc-0.9.3-4.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update lirc'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-15270

Comment 9 Fedora Update System 2015-09-07 18:21:02 UTC

lirc-0.9.3-3.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update lirc'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-15228

Comment 10 Fedora Update System 2015-09-09 14:24:27 UTC

lirc-0.9.3-5.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-15465

Comment 11 Fedora Update System 2015-09-10 05:51:25 UTC

lirc-0.9.3-5.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update lirc'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-15465

Comment 12 Alec Leamas 2015-09-17 08:14:46 UTC

@Michael (on a sidenote): Before you file any selinux bugs, perhaps you could have a look at http://ur1.ca/nt3x8 where I try to cope with the obvious selinux problems?

TBH, I havn't really used the selinux stuff until now, so I probably make all kinds of errors.

Comment 13 Fedora Update System 2015-09-19 18:55:19 UTC

lirc-0.9.3-5.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 14 Trevor Cordes 2016-03-15 09:54:57 UTC

Hi!  Just upgraded to Fedora 22.  Just hit this bug.  Can workaround with a manual chmod, of course.  But any chance we can get the fix pushed for F22 also (as it was the original bug-filed version).  I'm not planning on F23'ing any time soon.  Thanks!