Bug 1671641
| Summary: | SELinux is preventing dbus-daemon-lau from 'connectto' accesses on the unix_stream_socket /var/lib/sss/pipes/nss. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Sandro Bonazzola <sbonazzo> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 29 | CC: | dwalsh, lvrabec, mgrepl, plautrba, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:4ce084f9863055131b9a23751cbc20ba2cdcdccd3db915200af7463a99a86d94;VARIANT_ID=workstation; | ||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-02-01 10:11:36 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 963533 *** |
Description of problem: SELinux is preventing dbus-daemon-lau from 'connectto' accesses on the unix_stream_socket /var/lib/sss/pipes/nss. ***** Plugin catchall (100. confidence) suggests ************************** Se ci credi dbus-daemon-lau dovrebbe essere consentito connectto accesso al nss unix_stream_socket per impostazione predefinita. Then si dovrebbe riportare il problema come bug. E' possibile generare un modulo di politica locale per consentire questo accesso. Do consentire questo accesso per ora eseguendo: # ausearch -c 'dbus-daemon-lau'--raw | audit2allow -M my-$MODULE_NOME # semodule -X 300 -i miei-dbusdaemonlau.pp Additional Information: Source Context system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects /var/lib/sss/pipes/nss [ unix_stream_socket ] Source dbus-daemon-lau Source Path dbus-daemon-lau Port <Sconosciuto> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.14.2-47.fc29.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 4.20.5-200.fc29.x86_64 #1 SMP Mon Jan 28 19:29:17 UTC 2019 x86_64 x86_64 Alert Count 1 First Seen 2019-02-01 08:05:44 CET Last Seen 2019-02-01 08:05:44 CET Local ID fb8825b8-dc6d-4908-92ee-bd185e9a461f Raw Audit Messages type=AVC msg=audit(1549004744.279:346): avc: denied { connectto } for pid=13164 comm="dbus-daemon-lau" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1 Hash: dbus-daemon-lau,system_dbusd_t,unconfined_t,unix_stream_socket,connectto Version-Release number of selected component: selinux-policy-3.14.2-47.fc29.noarch Additional info: component: selinux-policy reporter: libreport-2.9.7 hashmarkername: setroubleshoot kernel: 4.20.5-200.fc29.x86_64 type: libreport Potential duplicate: bug 963533