Bug 216006

Summary: selinux-policy-targeted blocks 915resolution on Resume from Hibernate
Product: [Fedora] Fedora Reporter: James <james>
Component: selinux-policy-targetedAssignee: Daniel Walsh <dwalsh>
Status: CLOSED CURRENTRELEASE QA Contact: Ben Levenson <benl>
Severity: medium Docs Contact:
Priority: medium    
Version: 6CC: cweyl, katzj
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: 2.4.6-46.fc6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-04-02 16:46:56 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description James 2006-11-16 19:28:52 UTC 
Description of problem:
SELinux with Enforcing prevents 915resolution from patching the video BIOS when
resuming from hibernation. This means I lose widescreen mode on my notebook.

I have modified /etc/pm/functions-intel to read

resume_video()
{
{
	/usr/sbin/vbetool post
        /usr/sbin/915resolution 3c 1280 768 >/dev/null 2>&1
#	/usr/sbin/vbetool vbestate restore < /var/run/vbestate
} >/dev/null 2>&1
}

so that the patch is called on resume. I don't know if this is the correct place
to put it, but it works when enforcing is disabled.

Raw audit message:
avc: denied { read, write } for comm='"915resolution"' dev='tmpfs' egid='0'
euid='0' exe='"/usr/sbin/915resolution"' exit='-13' fsgid='0' fsuid='0' gid='0'
items='0' name='"mem"' pid='4778' scontext=system_u:system_r:hald_t:s0 sgid='0'
subj='system_u:system_r:hald_t:s0' suid='0' tclass='chr_file'
tcontext=system_u:object_r:memory_device_t:s0 tty='(none)' uid='0' 

Version-Release number of selected component (if applicable):
selinux-policy-targeted-2.4.3-2.fc6
915resolution-0.5.2-3.fc5

How reproducible:
Always.

Steps to Reproduce:
1. Modify /etc/pm/functions-intel (see above) to patch the VBIOS.
2. Hibernate.
3. Resume.
  
Actual results:
Adapter has forgotten patched mode (1280x768), drops down to built-in (1024x768).

Expected results:
No AVC denial.
Comment 1 Daniel Walsh 2007-02-14 15:05:09 UTC 
Fixed in selinux-policy-2.4.6-37