Bug 1434286

Summary:	SELinux is preventing /usr/libexec/geoclue from 'sendto' accesses on the unix_dgram_socket /run/systemd/journal/socket.
Product:	Red Hat Enterprise Linux 7	Reporter:	Matěj Cepl <mcepl>
Component:	selinux-policy	Assignee:	Lukas Vrabec <lvrabec>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.4	CC:	lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde
Target Milestone:	rc
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:	abrt_hash:2ce90a3d30b191e3a443f7e83667aa87df6bcfac462797b6f0b74e9ed0e1197f
Fixed In Version:	selinux-policy-3.13.1-136.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-01 15:24:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Matěj Cepl 2017-03-21 08:14:48 UTC

Description of problem:
Happened while upgrading freshly installed 7.3 system to the latest nightly (2017-03-21) of 7.4 development.

Looks suspiciously like a duplicate of the Fedora bug 1370925.
SELinux is preventing /usr/libexec/geoclue from 'sendto' accesses on the unix_dgram_socket /run/systemd/journal/socket.

Happend with yum upgrade to the latest RHEL-7.4 Nightly (2017-03-21). Looks suspiciously like a duplicate of the Fedora bug 1370925.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that geoclue should be allowed sendto access on the socket unix_dgram_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'geoclue' --raw | audit2allow -M my-geoclue
# semodule -i my-geoclue.pp

Additional Information:
Source Context                system_u:system_r:geoclue_t:s0
Target Context                system_u:system_r:kernel_t:s0
Target Objects                /run/systemd/journal/socket [ unix_dgram_socket ]
Source                        geoclue
Source Path                   /usr/libexec/geoclue
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           geoclue2-2.4.5-1.el7.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-130.el7.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.10.0-514.10.2.el7.x86_64 #1 SMP
                              Mon Feb 20 02:37:52 EST 2017 x86_64 x86_64
Alert Count                   1
First Seen                    2017-03-21 09:06:42 CET
Last Seen                     2017-03-21 09:06:42 CET
Local ID                      5a92ffdf-b899-4090-afb4-af2d60ca303a

Raw Audit Messages
type=AVC msg=audit(1490083602.582:746): avc:  denied  { sendto } for  pid=15777 comm="geoclue" path="/run/systemd/journal/socket" scontext=system_u:system_r:geoclue_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=unix_dgram_socket


type=SYSCALL msg=audit(1490083602.582:746): arch=x86_64 syscall=sendmsg success=no exit=EACCES a0=8 a1=7fff621d5250 a2=4000 a3=7fff621d4d20 items=0 ppid=1 pid=15777 auid=4294967295 uid=993 gid=991 euid=993 suid=993 fsuid=993 egid=991 sgid=991 fsgid=991 tty=(none) ses=4294967295 comm=geoclue exe=/usr/libexec/geoclue subj=system_u:system_r:geoclue_t:s0 key=(null)

Hash: geoclue,geoclue_t,kernel_t,unix_dgram_socket,sendto

Version-Release number of selected component:
selinux-policy-3.13.1-130.el7.noarch

Additional info:
reporter:       libreport-2.1.11.1
hashmarkername: setroubleshoot
kernel:         3.10.0-514.10.2.el7.x86_64
reproducible:   Not sure how to reproduce the problem
type:           libreport

Comment 10 errata-xmlrpc 2017-08-01 15:24:23 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1861