Bug 2063483
| Summary: | SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Ian Laurie <nixuser> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 36 | CC: | abhisek.mukherjee, bzf, ceasar07, dwalsh, grepl.miroslav, loki.the.mischievous, lvrabec, mmalik, omosnace, pkoncity, rpittau, vmojzis, zpytela |
| Target Milestone: | --- | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | abrt_hash:ab521dfca63004711099900a72b7fedfec64d4221a8ec5d60e6f585d869e08d4;VARIANT_ID=cinnamon; | ||
| Fixed In Version: | selinux-policy-36.9-1.fc36 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-05-28 01:14:48 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Following SELinux denials appears 3 times in enforcing mode:
----
type=PROCTITLE msg=audit(03/16/2022 11:43:58.454:603) : proctitle=/usr/bin/python3 /usr/libexec/blueman-mechanism
type=SYSCALL msg=audit(03/16/2022 11:43:58.454:603) : arch=x86_64 syscall=write success=no exit=EACCES(Permission denied) a0=0x9 a1=0x7ffce19481c0 a2=0x1000 a3=0x1000 items=0 ppid=1 pid=1952 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=blueman-mechani exe=/usr/bin/python3.10 subj=system_u:system_r:blueman_t:s0 key=(null)
type=AVC msg=audit(03/16/2022 11:43:58.454:603) : avc: denied { write } for pid=1952 comm=blueman-mechani path=/memfd:libffi (deleted) dev="tmpfs" ino=20 scontext=system_u:system_r:blueman_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=0
----
# rpm -qa selinux\* blueman\* | sort
blueman-2.2.4-1.fc36.x86_64
selinux-policy-36.2-1.fc37.noarch
selinux-policy-targeted-36.2-1.fc37.noarch
#
Following SELinux denials appeared in permissive mode:
----
type=PROCTITLE msg=audit(03/16/2022 11:49:19.370:611) : proctitle=/usr/bin/python3 /usr/libexec/blueman-mechanism
type=SYSCALL msg=audit(03/16/2022 11:49:19.370:611) : arch=x86_64 syscall=write success=yes exit=4096 a0=0x9 a1=0x7ffdefa7e920 a2=0x1000 a3=0x1000 items=0 ppid=1 pid=2018 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=blueman-mechani exe=/usr/bin/python3.10 subj=system_u:system_r:blueman_t:s0 key=(null)
type=AVC msg=audit(03/16/2022 11:49:19.370:611) : avc: denied { write } for pid=2018 comm=blueman-mechani path=/memfd:libffi (deleted) dev="tmpfs" ino=21 scontext=system_u:system_r:blueman_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=1
----
type=PROCTITLE msg=audit(03/16/2022 11:49:19.372:612) : proctitle=/usr/bin/python3 /usr/libexec/blueman-mechanism
type=MMAP msg=audit(03/16/2022 11:49:19.372:612) : fd=9 flags=MAP_SHARED
type=SYSCALL msg=audit(03/16/2022 11:49:19.372:612) : arch=x86_64 syscall=mmap success=yes exit=139770795438080 a0=0x0 a1=0x1000 a2=PROT_READ|PROT_EXEC a3=MAP_SHARED items=0 ppid=1 pid=2018 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=blueman-mechani exe=/usr/bin/python3.10 subj=system_u:system_r:blueman_t:s0 key=(null)
type=AVC msg=audit(03/16/2022 11:49:19.372:612) : avc: denied { read execute } for pid=2018 comm=blueman-mechani path=/memfd:libffi (deleted) dev="tmpfs" ino=21 scontext=system_u:system_r:blueman_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=1
type=AVC msg=audit(03/16/2022 11:49:19.372:612) : avc: denied { map } for pid=2018 comm=blueman-mechani path=/memfd:libffi (deleted) dev="tmpfs" ino=21 scontext=system_u:system_r:blueman_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=1
----
The "could not allocate closure" message (visible in previous comment) does not appear in permissive mode.
Similar problem has been detected: Fresh login into Fedora Cinnamon hashmarkername: setroubleshoot kernel: 5.17.0-0.rc7.116.fc36.x86_64 package: selinux-policy-targeted-36.3-1.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). type: libreport SELinux is preventing blueman-mechani from write access on the file /memfd:libffi (deleted).
***** Plugin catchall (100. confidence) suggests **************************
If you believe that blueman-mechani should be allowed write access on the memfd:libffi (deleted) file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'blueman-mechani' --raw | audit2allow -M my-bluemanmechani
# semodule -X 300 -i my-bluemanmechani.pp
Additional Information:
Source Context system_u:system_r:blueman_t:s0
Target Context system_u:object_r:tmpfs_t:s0
Target Objects /memfd:libffi (deleted) [ file ]
Source blueman-mechani
Source Path blueman-mechani
Port <Unknown>
Host (removed)
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-36.3-1.fc36.noarch
Local Policy RPM selinux-policy-targeted-36.3-1.fc36.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name (removed)
Platform Linux Karma-X 5.17.0-0.rc7.116.fc36.x86_64 #1 SMP
PREEMPT Mon Mar 7 23:10:19 UTC 2022 x86_64 x86_64
Alert Count 15
First Seen 2022-03-17 12:02:07 IST
Last Seen 2022-03-17 21:15:16 IST
Local ID c34fae49-f33e-4115-8487-91c32976cda9
Raw Audit Messages
type=AVC msg=audit(1647531916.71:256): avc: denied { write } for pid=1982 comm="blueman-mechani" path=2F6D656D66643A6C6962666669202864656C6574656429 dev="tmpfs" ino=10243 scontext=system_u:system_r:blueman_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=0
Hash: blueman-mechani,blueman_t,tmpfs_t,file,write
Similar problem has been detected: Default installation SE Linux prompt. hashmarkername: setroubleshoot kernel: 5.17.0-0.rc7.116.fc36.x86_64 package: selinux-policy-targeted-36.3-1.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). type: libreport Similar problem has been detected: on startup hashmarkername: setroubleshoot kernel: 5.17.0-0.rc7.116.fc36.x86_64 package: selinux-policy-targeted-36.5-1.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). type: libreport *** Bug 2068874 has been marked as a duplicate of this bug. *** Similar problem has been detected: Every time Fedora starts hashmarkername: setroubleshoot kernel: 5.17.1-300.fc36.x86_64 package: selinux-policy-targeted-36.5-1.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). type: libreport Similar problem has been detected: Booted Fedora and logged into Cinnamon. hashmarkername: setroubleshoot kernel: 5.17.1-300.fc36.x86_64 package: selinux-policy-targeted-36.5-1.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). type: libreport Similar problem has been detected: starting Fedora 36 beta hashmarkername: setroubleshoot kernel: 5.17.1-300.fc36.x86_64 package: selinux-policy-targeted-36.5-1.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). type: libreport Similar problem has been detected: I just booted for the first tiime after installation and the first alert i got was this. hashmarkername: setroubleshoot kernel: 5.17.0-0.rc7.116.fc36.x86_64 package: selinux-policy-targeted-36.5-1.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). type: libreport Similar problem has been detected: On login hashmarkername: setroubleshoot kernel: 5.17.2-300.fc36.x86_64 package: selinux-policy-targeted-36.6-1.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). type: libreport Similar problem has been detected: Just logged into my Cinnamon desktop; denial notification appeared immediately. hashmarkername: setroubleshoot kernel: 5.17.3-302.fc36.x86_64 package: selinux-policy-targeted-36.6-1.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). type: libreport Similar problem has been detected: Problem suddenly appeared after upgrading from Fedora 35 to Fedora 36. I don't know what the consequences are besides getting an selinux alert. Bluetooth headphones still work, so maybe this is a spurious message? hashmarkername: setroubleshoot kernel: 5.17.5-300.fc36.x86_64 package: selinux-policy-targeted-36.8-1.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). type: libreport *** Bug 2083978 has been marked as a duplicate of this bug. *** *** Bug 2085096 has been marked as a duplicate of this bug. *** Similar problem has been detected: Fresh install of Fedora on VirtualBox VM. Installed Cinnamon. Logged out, changed to Cinnamon. Logged in, got this error. hashmarkername: setroubleshoot kernel: 5.17.6-300.fc36.x86_64 package: selinux-policy-targeted-36.8-2.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). type: libreport Similar problem has been detected: Right after installing Fedora 36 Cinnamon Spin it was the first thing that came up, right after login into the DE. hashmarkername: setroubleshoot kernel: 5.17.5-300.fc36.x86_64 package: selinux-policy-targeted-36.7-1.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). type: libreport Similar problem has been detected: Upgrade Fedora from 35 to 36 hashmarkername: setroubleshoot kernel: 5.17.6-300.fc36.x86_64 package: selinux-policy-targeted-36.7-1.fc36.noarch reason: SELinux is preventing blueman-mechani from read, execute access on the file /memfd:libffi (deleted). type: libreport FEDORA-2022-148223ef3b has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2022-148223ef3b FEDORA-2022-148223ef3b has been pushed to the Fedora 36 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2022-148223ef3b` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-148223ef3b See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. Similar problem has been detected: Error message popl up on logiin. hashmarkername: setroubleshoot kernel: 5.17.9-300.fc36.x86_64 package: selinux-policy-targeted-36.8-2.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). type: libreport FEDORA-2022-148223ef3b has been pushed to the Fedora 36 stable repository. If problem still persists, please make note of it in this bug report. *** Bug 2096254 has been marked as a duplicate of this bug. *** Similar problem has been detected: Direkt nach der Installation. Beim ersten Start des Systems , hashmarkername: setroubleshoot kernel: 5.17.5-300.fc36.x86_64 package: selinux-policy-targeted-36.7-1.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the Datei /memfd:libffi (deleted). type: libreport Similar problem has been detected: during boot and login, this SE error occurred. I didn't do anything hashmarkername: setroubleshoot kernel: 5.17.5-300.fc36.x86_64 package: selinux-policy-targeted-36.7-1.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). type: libreport Similar problem has been detected: just turned on laptop with F36 installed hashmarkername: setroubleshoot kernel: 5.17.5-300.fc36.x86_64 package: selinux-policy-targeted-36.7-1.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). type: libreport Similar problem has been detected: just tuned on computer hashmarkername: setroubleshoot kernel: 5.17.5-300.fc36.x86_64 package: selinux-policy-targeted-36.7-1.fc36.noarch reason: SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). type: libreport (In reply to Larry Nestor from comment #28) Why are you reporting errors in a vanilla Fedora 36 installation when the fix was released a long time ago? Resolution: --- → ERRATA Fixed In Version: selinux-policy-36.9-1.fc36 Status: ON_QA → CLOSED Last Closed: 2022-05-28 01:14:48 Please stop! |
Description of problem: Just login to new install from Fedora-Cinnamon-Live-x86_64-36_Beta-1.1.iso. SELinux is preventing blueman-mechani from 'write' accesses on the file /memfd:libffi (deleted). ***** Plugin catchall (100. confidence) suggests ************************** If you believe that blueman-mechani should be allowed write access on the memfd:libffi (deleted) file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'blueman-mechani' --raw | audit2allow -M my-bluemanmechani # semodule -X 300 -i my-bluemanmechani.pp Additional Information: Source Context system_u:system_r:blueman_t:s0 Target Context system_u:object_r:tmpfs_t:s0 Target Objects /memfd:libffi (deleted) [ file ] Source blueman-mechani Source Path blueman-mechani Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-36.3-1.fc36.noarch Local Policy RPM selinux-policy-targeted-36.3-1.fc36.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 5.17.0-0.rc7.116.fc36.x86_64 #1 SMP PREEMPT Mon Mar 7 23:10:19 UTC 2022 x86_64 x86_64 Alert Count 3 First Seen 2022-03-13 13:55:51 AEDT Last Seen 2022-03-13 13:55:51 AEDT Local ID c4ee1ede-f6b1-4f81-80b8-3b8d8ccc0015 Raw Audit Messages type=AVC msg=audit(1647140151.68:372): avc: denied { write } for pid=1925 comm="blueman-mechani" path=2F6D656D66643A6C6962666669202864656C6574656429 dev="tmpfs" ino=1064 scontext=system_u:system_r:blueman_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=0 Hash: blueman-mechani,blueman_t,tmpfs_t,file,write Version-Release number of selected component: selinux-policy-targeted-36.3-1.fc36.noarch Additional info: component: selinux-policy reporter: libreport-2.17.0 hashmarkername: setroubleshoot kernel: 5.17.0-0.rc7.116.fc36.x86_64 type: libreport