Bug 292961

Summary: SELinux errors for NetworkManager and wpa_supplicant while trying to connect to wireless network
Product: [Fedora] Fedora Reporter: David Hislop <dhislop>
Component: selinux-policy-targetedAssignee: Daniel Walsh <dwalsh>
Status: CLOSED CURRENTRELEASE QA Contact: Ben Levenson <benl>
Severity: medium Docs Contact:
Priority: medium    
Version: 7   
Target Milestone: ---   
Target Release: ---   
Hardware: i686   
OS: Linux   
Whiteboard:
Fixed In Version: Current Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-01-30 19:06:09 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description David Hislop 2007-09-17 09:54:30 UTC
Description of problem:
I get the following SELinux errors for NetworkManager and wpa_supplicant while
trying to connect to a wireless network with WPA2.
SELinux is preventing /usr/sbin/NetworkManager (NetworkManager_t) "unlink"
 to eth1 (var_run_t).
SELinux is preventing /usr/sbin/wpa_supplicant (NetworkManager_t) "write" to
 eth1 (var_run_t)

Stopped them occurring with:
grep NetworkManager /var/log/audit/audit.log | audit2allow -v -M \
mynetworkmanager
grep wpa_supplicant /var/log/audit/audit.log | audit2allow -v -M mywpasupplicant
semodule -i mynetworkmanager.pp
semodule -i mywpasupplicant.pp

The attempt failed (that's a different problem :-( ) and another SELinux error:
SELinux is preventing /usr/sbin/wpa_supplicant (NetworkManager_t) "rmdir" to
 wpa_supplicant (var_run_t)

Fixed this with:
grep wpa_supplicant /var/log/audit/audit.log | audit2allow -v -M mywpasupplicant2
semodule -i mywpasupplicant2.pp

Do these need to be added to the standard distro or is it a problem peculiar to
my environment?

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 1 Daniel Walsh 2007-09-18 17:17:27 UTC
This has been fixed with the latest policy selinux-policy-2.6.4-42

You might need to relabel /var/run

restorecon -R -v /var/run

Comment 2 David Hislop 2007-09-18 22:31:17 UTC
Thanks for your help.

From where do I get selinux-policy-2.6.4-42? I can find only up to selinux-
policy-2.6.4-35 in ..../updates/testing/7/i386.

After installing it and running restorecon, will I need to reverse the changes 
I made with semodule, or will the update remove them?


Comment 3 Daniel Walsh 2007-09-22 11:56:29 UTC
Should be out there now.  It was just released.

It will add those rules, but not remove yours

You can execute 
semodule -r mynetworkmanager
semodule -r mywpasupplicant

to remove  your rules.

Comment 4 David Hislop 2007-09-23 04:17:14 UTC
Thanks, I've just received the update.

Comment 5 Daniel Walsh 2008-01-30 19:06:09 UTC
Bulk closing a old selinux policy bugs that were in the modified state.  If the
bug is still not fixed.  Please reopen.