Bug 2103747

Summary: SELinux denied { create } for comm="rfkill" NetworkManager_dispatcher_tlp_t
Product: [Fedora] Fedora Reporter: javiertury
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: 36CC: dwalsh, grepl.miroslav, lvrabec, mmalik, omosnace, pkoncity, vmojzis, zpytela
Target Milestone: ---Keywords: Triaged
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: selinux-policy-36.13-3.fc36 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-08-05 01:34:44 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description javiertury 2022-07-04 17:24:28 UTC
Description of problem:

While using tlp (a laptop power manager), there are some AVC denials related to rfkill and NetworkManager. After creating a custom module to allow the first kind of denial audited, a new kind denial appears. Find below a summarized list of all the denials that I've encountered until I could make it work.

Version-Release number of selected component (if applicable):
selinux-policy 36.10-1.fc36

How reproducible:
Configure tlp to disable wifi when docked and trigger it

Steps to Reproduce:
1. Install and enable tlp. Configure tlp to disable wifi when docked
2. Restart laptop
3. Let the laptop be undocked and then dock it

Actual results:
SELinux denial

Expected results:
Not a SELinux denial

Additional info:

Summarized list of denials

type=AVC msg=audit(1656950482.906:1075): avc:  denied  { create } for  pid=1767819 comm="rfkill" scontext=system_u:system_r:NetworkManager_dispatcher_tlp_t:s0 tcontext=system_u:system_r:NetworkManager_dispatcher_tlp_t:s0 tclass=unix_dgram_socket permissive=0
type=AVC msg=audit(1656952146.555:372): avc:  denied  { connect } for  pid=6472 comm="rfkill" scontext=system_u:system_r:NetworkManager_dispatcher_tlp_t:s0 tcontext=system_u:system_r:NetworkManager_dispatcher_tlp_t:s0 tclass=unix_dgram_socket permissive=0
type=AVC msg=audit(1656952802.285:359): avc:  denied  { read } for  pid=6016 comm="rfkill" name="log" dev="devtmpfs" ino=182 scontext=system_u:system_r:NetworkManager_dispatcher_tlp_t:s0 tcontext=system_u:object_r:devlog_t:s0 tclass=lnk_file permissive=0
type=AVC msg=audit(1656953134.811:351): avc:  denied  { write } for  pid=4559 comm="rfkill" name="dev-log" dev="tmpfs" ino=51 scontext=system_u:system_r:NetworkManager_dispatcher_tlp_t:s0 tcontext=system_u:object_r:devlog_t:s0 tclass=sock_file permissive=0
type=AVC msg=audit(1656953414.523:361): avc:  denied  { sendto } for  pid=4692 comm="rfkill" path="/run/systemd/journal/dev-log" scontext=system_u:system_r:NetworkManager_dispatcher_tlp_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=unix_dgram_socket permissive=0

audit2allow suggests the following fix

require {
        type NetworkManager_dispatcher_tlp_t;
        type devlog_t;
        type kernel_t;
        class unix_dgram_socket { connect create sendto };
        class lnk_file read;
        class sock_file write;
}

#============= NetworkManager_dispatcher_tlp_t ==============
allow NetworkManager_dispatcher_tlp_t devlog_t:lnk_file read;
allow NetworkManager_dispatcher_tlp_t devlog_t:sock_file write;
allow NetworkManager_dispatcher_tlp_t kernel_t:unix_dgram_socket sendto;
allow NetworkManager_dispatcher_tlp_t self:unix_dgram_socket { connect create };

Comment 1 Zdenek Pytela 2022-07-07 10:35:55 UTC
Thank you for the troubleshooting.

Comment 2 Fedora Update System 2022-08-03 07:59:53 UTC
FEDORA-2022-139ec288ca has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2022-139ec288ca

Comment 3 Fedora Update System 2022-08-04 02:41:58 UTC
FEDORA-2022-139ec288ca has been pushed to the Fedora 36 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2022-139ec288ca`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-139ec288ca

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Fedora Update System 2022-08-05 01:34:44 UTC
FEDORA-2022-139ec288ca has been pushed to the Fedora 36 stable repository.
If problem still persists, please make note of it in this bug report.