Bug 454287
| Summary: | polkitd can't be launched because of SELinux | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Bastien Nocera <bnocera> |
| Component: | PolicyKit | Assignee: | David Zeuthen <davidz> |
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | rawhide | CC: | dwalsh, mclasen |
| Target Milestone: | --- | Keywords: | Reopened |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2008-07-25 22:48:47 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Fixed in rawhide policy. Please update your policy. This is also a problem in F9, unfortunately. It should be fixed there also in the latest policy. |
Trying to launch gnome-lirc-properties: [...] File "/usr/lib/python2.5/site-packages/dbus/bus.py", line 281, in start_service_by_name 'su', (bus_name, flags))) File "/usr/lib/python2.5/site-packages/dbus/connection.py", line 607, in call_blocking message, timeout) dbus.exceptions.DBusException: org.freedesktop.DBus.Error.Spawn.ChildExited: Launch helper exited with unknown return code 1 Using PolicyKit-0.8-3.fc10.i386 and selinux-policy-targeted-3.3.1-55.fc9.noarch Summary: SELinux is preventing polkitd (polkit_t) "setgid" to <Unknown> (polkit_t). Detailed Description: SELinux denied access requested by polkitd. It is not expected that this access is required by polkitd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:polkit_t:s0-s0:c0.c1023 Target Context system_u:system_r:polkit_t:s0-s0:c0.c1023 Target Objects None [ capability ] Source polkitd Source Path /usr/libexec/polkitd Port <Unknown> Host snoogens.fab.redhat.com Source RPM Packages PolicyKit-0.8-3.fc10 Target RPM Packages Policy RPM selinux-policy-3.3.1-55.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name snoogens.fab.redhat.com Platform Linux snoogens.fab.redhat.com 2.6.25-14.fc9.i686 #1 SMP Thu May 1 06:28:41 EDT 2008 i686 i686 Alert Count 14 First Seen Fri Jul 4 17:38:38 2008 Last Seen Mon Jul 7 17:48:18 2008 Local ID 2d54b420-bfcc-49ef-a302-5855e2cf3f6a Line Numbers Raw Audit Messages host=snoogens.fab.redhat.com type=AVC msg=audit(1215442098.49:33): avc: denied { setgid } for pid=13361 comm="polkitd" capability=6 scontext=system_u:system_r:polkit_t:s0-s0:c0.c1023 tcontext=system_u:system_r:polkit_t:s0-s0:c0.c1023 tclass=capability host=snoogens.fab.redhat.com type=SYSCALL msg=audit(1215442098.49:33): arch=40000003 syscall=206 success=no exit=-1 a0=1 a1=84805f0 a2=35bff4 a3=1 items=0 ppid=13360 pid=13361 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="polkitd" exe="/usr/libexec/polkitd" subj=system_u:system_r:polkit_t:s0-s0:c0.c1023 key=(null)