Bug 240805

Summary:	selinux prevents apcupsd from starting
Product:	[Fedora] Fedora	Reporter:	Craig Goodyear <goodyca48>
Component:	selinux-policy	Assignee:	Daniel Walsh <dwalsh>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Ben Levenson <benl>
Severity:	high	Docs Contact:
Priority:	medium
Version:	6	CC:	dwalsh
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Current	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-08-22 14:03:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Craig Goodyear 2007-05-21 20:34:44 UTC

Description of problem:
With selinux set to enforcing, apcupsd has a fatal error when
trying to start. 

Version-Release number of selected component (if applicable):
selinux-policy-2.4.6-69.fc6
selinux-policy-targeted-2.4.6-69.fc6
apcupsd-3.12.4-5.fc6

How reproducible:
Every time.

Steps to Reproduce:
1. try to start apcupsd with selinux enforcing
  
Actual results:
apcupsd will not start

Expected results:
apcupsd should start

Additional info:
The APC UPS is connected through /dev/ttyS0 comm port.

with selinux enforcing the following is entered in
/var/log/messages:
May 21 14:46:28 itox apcupsd[3510]: apcupsd FATAL ERROR in
dumbsetup.c at line 53 Cannot open UPS port /dev/ttyS0: 
Permission denied 
May 21 14:46:28 itox apcupsd[3510]: apcupsd error shutdown completed

with selinux permissive the following is entered in
/var/log/messages:
May 21 14:50:03 itox apcupsd[3640]: apcupsd 3.12.4 (19 August 
2006) redhat startup succeeded
May 21 14:50:03 itox apcupsd[3640]: NIS server startup succeeded

Comment 1 Daniel Walsh 2007-05-22 13:35:25 UTC

Please attach the avc messages from /var/log/audit/audit.log.  

You might also want to install setroubleshoot.

Comment 2 Craig Goodyear 2007-05-22 16:17:27 UTC

Here are the avc messages generated:

May 22 11:05:20 itox kernel: audit(1179849920.498:17): avc: 
denied  { write } for  pid=16610 comm="apcupsd" name="[138631]" 
dev=pipefs ino=138631 scontext=system_u:system_r:apcupsd_t:s0
tcontext=system_u:system_r:unconfined_t:s0 tclass=fifo_file
May 22 11:05:20 itox kernel: audit(1179849920.499:18): avc: 
denied  { write } for  pid=16610 comm="apcupsd" name="[138631]" 
dev=pipefs ino=138631 scontext=system_u:system_r:apcupsd_t:s0
tcontext=system_u:system_r:unconfined_t:s0 tclass=fifo_file

Comment 3 Daniel Walsh 2007-08-14 11:14:49 UTC

Should be fixed in 	selinux-policy-2.4.6-80.fc6

Comment 4 Daniel Walsh 2007-08-22 14:03:02 UTC

Closed as all fixes are in the current release