Bug 1275006
| Summary: | SELinux is preventing acpid from 'create' accesses on the netlink_generic_socket Unknown. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Justin W. Flory (Fedora) <foss> |
| Component: | selinux-policy | Assignee: | Vit Mojzis <vmojzis> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 22 | CC: | bugzilla, Claude.Frantz, dominick.grift, dwalsh, indolent66, joe, lantw44, lvrabec, mgrepl, mstuff, plautrba, spochybo, uckelman |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:5a46cae105d5aaa6ed19234a07ded3b1dd95de97bc3f14f89b6a353896cf1c48;VARIANT_ID=workstation; | ||
| Fixed In Version: | selinux-policy-3.13.1-128.22.fc22 selinux-policy-3.13.1-128.28.fc22 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-05-10 17:57:45 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Description of problem: I was running kernel regression tests and left my keyboard - when I returned, I saw these errors. Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.2.3-200.fc22.x86_64 type: libreport Description of problem: I log in to GNOME session from GDM. Version-Release number of selected component: selinux-policy-3.13.1-128.18.fc22.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.3-200.fc22.x86_64 type: libreport Description of problem: Added battery backup, now on startup the selinux generates an alert Version-Release number of selected component: selinux-policy-3.13.1-128.18.fc22.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.5-201.fc22.x86_64 type: libreport Description of problem: My power managment cannot be started, and I cannot alter the startup and shutdown services. It says it cannot contact KDED. It is happening since last update on 14th Nov 2015. Also, I cannot control volume with multimedia keys. Version-Release number of selected component: selinux-policy-3.13.1-128.18.fc22.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.5-201.fc22.x86_64 type: libreport Description of problem: It happens infrequently on startup. Version-Release number of selected component: selinux-policy-3.13.1-128.18.fc22.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.5-201.fc22.x86_64 type: libreport Description of problem: I was tagging music in MusicBrainz Picard, which is adding metadata tags to my music in /home/user/Music/. Version-Release number of selected component: selinux-policy-3.13.1-128.19.fc22.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.5-201.fc22.x86_64 type: libreport https://github.com/fedora-selinux/selinux-policy/pull/73 commit 74bf8205ecb31af47ff51754a3f16c11c09c9b1a Author: Miroslav Grepl <mgrepl> Date: Thu Oct 1 16:08:40 2015 +0200 Allow acpid to attempt to connect to the Linux kernel via generic netlink socket. Description of problem: This denail happend on booting. Version-Release number of selected component: selinux-policy-3.13.1-128.18.fc22.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.5-201.fc22.x86_64 type: libreport selinux-policy-3.13.1-128.22.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-8083abc683 selinux-policy-3.13.1-128.22.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with $ su -c 'dnf --enablerepo=updates-testing update selinux-policy' You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-8083abc683 Description of problem: Run bareos backup software Version-Release number of selected component: selinux-policy-3.13.1-128.21.fc22.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.6-201.fc22.x86_64 type: libreport Frank, Please check comment 10. Thank you. The last version of testing is: selinux-policy 3.13.1-128.22.fc22 selinux-policy-3.13.1-128.21.fc22.noarch was installed at comment 11. So I have try 3.13.1-128.22.fc22 an will report the result after next bacula/bareos run at the weekend. But as far I can see, selinux-policy-3.13.1-128.21.fc22 don't fix it. With 3.13.1-128.22.fc22 it don't happens again. Description of problem: Started the Virtual Machine Manager Version-Release number of selected component: selinux-policy-3.13.1-128.21.fc22.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.8-200.fc22.x86_64 type: libreport selinux-policy-3.13.1-128.25.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2016-825869e1a4 Description of problem: something happened when I wasn't looking Version-Release number of selected component: selinux-policy-3.13.1-128.21.fc22.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.8-200.fc22.x86_64 type: libreport selinux-policy-3.13.1-128.25.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-825869e1a4 selinux-policy-3.13.1-128.27.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2016-ce419c9cab selinux-policy-3.13.1-128.27.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-ce419c9cab selinux-policy-3.13.1-128.28.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2016-ce419c9cab selinux-policy-3.13.1-128.28.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-ce419c9cab selinux-policy-3.13.1-128.28.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: I was running kernel regression tests on my system - I was away from keyboard during tests and saw this error when I returned. SELinux is preventing acpid from 'create' accesses on the netlink_generic_socket Unknown. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that acpid should be allowed create access on the Unknown netlink_generic_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep acpid /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:apmd_t:s0 Target Context system_u:system_r:apmd_t:s0 Target Objects Unknown [ netlink_generic_socket ] Source acpid Source Path acpid Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-128.16.fc22.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.2.3-200.fc22.x86_64 #1 SMP Thu Oct 8 03:23:55 UTC 2015 x86_64 x86_64 Alert Count 2 First Seen 2015-10-23 20:44:51 EDT Last Seen 2015-10-24 15:34:57 EDT Local ID 20f15fff-2714-45ea-bfcd-1db07e6492d3 Raw Audit Messages type=AVC msg=audit(1445715297.920:525): avc: denied { create } for pid=1705 comm="acpid" scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:apmd_t:s0 tclass=netlink_generic_socket permissive=0 Hash: acpid,apmd_t,apmd_t,netlink_generic_socket,create Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.2.3-200.fc22.x86_64 type: libreport