Bug 585076
| Summary: | Compiz composition manager fail to start when SELinux is in enforcing mode (staff_u + confined usrs / domains) | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Carl G. <carlg> | ||||||
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | low | ||||||||
| Version: | 13 | CC: | dwalsh, mgrepl | ||||||
| Target Milestone: | --- | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | selinux-policy-3.7.19-6.fc13 | Doc Type: | Bug Fix | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2010-04-28 03:07:35 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
semodule -B -D Doesn't change anything. Or maybe that's because Apr 23 01:10:49 BubbleWork dbus: Can't send to audit system: USER_AVC avc: received policyload notice (seqno=6)#012: exe="?" sauid=81 hostname=? addr=? terminal=? ? Created attachment 408496 [details]
Audit2allow && Audit2why output
I don't think that my attached file is going to be useful since auditd doesn't seems to work right now, or it work .. sometimes. semodule -B -D i restarted auditd audit.log is empty (after cleaning the logs) If auditd is not working the avc messages should go to /var/log/messages If you put the machine into permissive mode it works? Yes, it does work into permissive mode like you can see at the beginning of the attached video.
Okay, turned off auditd and that's what i got :
Apr 23 10:16:25 BubbleWork kernel: audit_printk_skb: 6 callbacks suppressed
Apr 23 10:16:25 BubbleWork kernel: type=1400 audit(1272032185.144:14679): avc: denied { rlimitinh } for pid=16337 comm="desktop-effects" scontext=staff_u:staff_r:staff_mono_t:s0 tcontext=staff_u:staff_r:staff_t:s0 tclass=process
Apr 23 10:16:25 BubbleWork kernel: type=1400 audit(1272032185.144:14679): avc: denied { siginh } for pid=16337 comm="desktop-effects" scontext=staff_u:staff_r:staff_mono_t:s0 tcontext=staff_u:staff_r:staff_t:s0 tclass=process
Apr 23 10:16:25 BubbleWork kernel: type=1400 audit(1272032185.144:14679): avc: denied { noatsecure } for pid=16337 comm="desktop-effects" scontext=staff_u:staff_r:staff_mono_t:s0 tcontext=staff_u:staff_r:staff_t:s0 tclass=process
Apr 23 10:16:25 BubbleWork kernel: type=1300 audit(1272032185.144:14679): arch=c000003e syscall=59 success=yes exit=0 a0=15a50d0 a1=1513050 a2=1536800 a3=3138a84640 items=0 ppid=1 pid=16337 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=4 comm="desktop-effects" exe="/usr/bin/desktop-effects" subj=staff_u:staff_r:staff_t:s0 key=(null)
Apr 23 10:16:25 BubbleWork kernel: type=1400 audit(1272032185.213:14680): avc: denied { read write } for pid=16337 comm="desktop-effects" name="card0" dev=devtmpfs ino=6134 scontext=staff_u:staff_r:staff_t:s0 tcontext=system_u:object_r:dri_device_t:s0 tclass=chr_file
Apr 23 10:16:25 BubbleWork kernel: type=1300 audit(1272032185.213:14680): arch=c000003e syscall=2 success=no exit=-13 a0=1e3e8e0 a1=2 a2=7ff7dcc8d2e8 a3=fffffffffffffdf7 items=0 ppid=1 pid=16337 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=4 comm="desktop-effects" exe="/usr/bin/desktop-effects" subj=staff_u:staff_r:staff_t:s0 key=(null)
In F12 we had a boolean user_direct_dri, which was removed. I am adding it back. Fixed in selinux-policy-3.7.19-5.fc13.noarch selinux-policy-3.7.19-6.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/selinux-policy-3.7.19-6.fc13 selinux-policy-3.7.19-6.fc13 has been pushed to the Fedora 13 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/selinux-policy-3.7.19-6.fc13 selinux-policy-3.7.19-6.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report. |
Created attachment 408492 [details] Steps to reproduce / result Description of problem: Compiz composition manager will fail to start when SELinux is in enforcing mdoe Version-Release number of selected component (if applicable): How reproducible: Always Steps to Reproduce: Please take a look @ the video. Actual results: Compiz fail to start, or will report : Desktop effects require hardware 3D support. Expected results: Compiz should work ? Additional info: selinux-policy-3.7.19-2.fc13.noarch