Bug 541217
| Summary: | SELinux is preventing /usr/sbin/modem-manager "sys_admin" access. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | ishan <slishan> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 12 | CC: | dcbw, dwalsh, mgrepl, mike |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i386 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:722b6382e0e8a4bc3cce9c98f14c3347347c4d33e42b114ab28258ab7840dc43 | ||
| Fixed In Version: | selinux-policy-3.6.32-120.fc12 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-12-07 22:46:48 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
ishan
2009-11-25 09:33:19 UTC
You can add these rules for now using # grep avc /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Fixed in selinux-policy-3.6.32-50.fc12.noarch What is sys_admin? Seems a bit coarse as a context. sys_admin is the catchall capability. Not really an SELinux thing.
* Allow configuration of the secure attention key
* Allow administration of the random device
* Allow examination and configuration of disk quotas
* Allow configuring the kernel's syslog (printk behaviour)
* Allow setting the domainname
* Allow setting the hostname
* Allow calling bdflush()
* Allow mount() and umount(), setting up new smb connection
* Allow some autofs root ioctls
* Allow nfsservctl
* Allow VM86_REQUEST_IRQ
* Allow to read/write pci config on alpha
* Allow irix_prctl on mips (setstacksize)
* Allow flushing all cache on m68k (sys_cacheflush)
* Allow removing semaphores (Used instead of CAP_CHOWN to "chown" IPC message queues, semaphores and shared memory)
* Allow locking/unlocking of shared memory segment
* Allow turning swap on/off
* Allow forged pids on socket credentials passing
* Allow setting readahead and flushing buffers on block devices
* Allow setting geometry in floppy driver
* Allow turning DMA on/off in xd driver
* Allow administration of md devices (mostly the above, but some extra ioctls)
* Allow tuning the ide driver
* Allow access to the nvram device
* Allow administration of apm_bios, serial and bttv (TV) device
* Allow manufacturer commands in isdn CAPI support driver
* Allow reading non-standardized portions of pci configuration space
* Allow DDI debug ioctl on sbpcd driver
* Allow setting up serial ports
* Allow sending raw qic-117 commands
* Allow enabling/disabling tagged queuing on SCSI controllers and sending arbitrary SCSI commands
* Allow setting encryption key on loopback filesystem
* Allow setting zone reclaim policy
selinux-policy-3.6.32-52.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-52.fc12 selinux-policy-3.6.32-52.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-12549 selinux-policy-3.6.32-55.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-55.fc12 selinux-policy-3.6.32-55.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-12650 selinux-policy-3.6.32-55.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report. selinux-policy-3.6.32-120.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-120.fc12 selinux-policy-3.6.32-120.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report. |