Bug 407591
| Summary: | pulseaudio-0.9.8-4.fc9 broke audio .... | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Tom London <selinux> |
| Component: | pulseaudio | Assignee: | Lennart Poettering <lpoetter> |
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | rawhide | CC: | dwalsh, pierre-bugzilla |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2007-12-06 16:15:37 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Tom London
2007-12-02 00:25:33 UTC
I can make things work 'a bit better' (i.e., pavucontrol not crashing, etc.), by manually chmod-ing a bunch of /dev/ files. I 'chmod 666' all the files with major of 14, and all the files in /dev/snd. I can 'play sound' from System->Preferences->Hardware->Sound (from the Sounds tab), but rhythmbox crashes with <<<SNIP>>> Could not find the frame base for "IA__gtk_main_do_event". Could not find the frame base for "gdk_event_dispatch". Could not find the frame base for "g_main_context_iterate". Cannot access memory at address 0x0 Could not find the frame base for "start_thread". Could not find the frame base for "IA__g_spawn_sync". OK.... Now I'm confused. With the above changes, 'paplay foo.wav' plays music. So it appears the fixing the access bits on the /dev files makes pulseaudio work. But, rhythmbox dies horribly (as does banshee)..... Rhythmbox problem.... https://bugzilla.redhat.com/show_bug.cgi?id=407661 More confusion: it works with SELinux in permissive mode, but not in enforcing mode.
I believe I have tracked this down to an issue with
/usr/libexec/ck-get-x11-display-device and SELinux.
Here are the AVCs:
type=AVC msg=audit(1196779565.801:132): avc: denied { search } for pid=2614
comm="ck-get-x11-disp" name="2587" dev=proc ino=9642
scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
tcontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 tclass=dir
type=AVC msg=audit(1196779565.801:132): avc: denied { read } for pid=2614
comm="ck-get-x11-disp" name="stat" dev=proc ino=9861
scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
tcontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 tclass=file
type=SYSCALL msg=audit(1196779565.801:132): arch=40000003 syscall=5 success=yes
exit=4 a0=8d27418 a1=8000 a2=0 a3=8000 items=0 ppid=2585 pid=2614
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) comm="ck-get-x11-disp" exe="/usr/libexec/ck-get-x11-display-device"
subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1196779565.802:133): avc: denied { getattr } for pid=2614
comm="ck-get-x11-disp" path="/proc/2587/stat" dev=proc ino=9861
scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
tcontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 tclass=file
type=SYSCALL msg=audit(1196779565.802:133): arch=40000003 syscall=197
success=yes exit=0 a0=4 a1=bff4cfc8 a2=bdcff4 a3=8d27418 items=0 ppid=2585
pid=2614 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) comm="ck-get-x11-disp" exe="/usr/libexec/ck-get-x11-display-device"
subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
Adding the following policy rules appears to make this work again:
module localpulse2 1.0;
require {
type xdm_xserver_t;
type xdm_t;
class dir search;
class file { read getattr };
}
#============= xdm_t ==============
allow xdm_t xdm_xserver_t:dir search;
allow xdm_t xdm_xserver_t:file { read getattr };
Not sure if this is the proper fix...... Daniel?
Yes I found the same problem. Should be fixed in selinux-policy-3.2.2-1.fc9 I can confirm: selinux-policy-3.2.2-1.fc9 fixes this for me. Hows this?
DESCRIPTION
matchpathcon Queries the system and prints the default security
context associated with the filepath.
Note: Identical paths can have different security contexts,
depending on the file type. (regular file, directory, link file,
char file ...)
matchpathcon will check the system default context using the
file type if the file exists. If the file does not exist, it
will get the context of a regular file.
|