Bug 667353

Why would mpd connect to the xserver?

(In reply to comment #1)
> Why would mpd connect to the xserver?

I agree, mpd should not have to connect to the X server but I have no idea why it does...

I noticed that running the mpd daemon under my current user (by default, it is running under "mpd" user) makes the pulseaudio output working but it's probably not safe and I'm still getting SELinux alerts.

See also: https://bugzilla.redhat.com/show_bug.cgi?id=634699

Does it not work if it runs under the mpd user?

(In reply to comment #3)
> Does it not work if it runs under the mpd user?

Indeed, I have no sound at all.
I get "mpd: output: Failed to open "My Pulse Output" [pulse]: Cannot connect to PulseAudio server: Connection refused" in /var/log/messages.

If you put the machine into permissive mode what AVC's do  you see?

In permissive mode and under the "mpd" user, I get 3 AVC.
Here is what I have in /var/log/messages:

dbus: avc:  received setenforce notice (enforcing=0)
setroubleshoot: SELinux is preventing /usr/bin/mpd from connectto access on the unix_stream_socket @/tmp/.X11-unix/X0.
setroubleshoot: SELinux is preventing /usr/bin/mpd from search access on the directory /var/run/gdm.
setroubleshoot: SELinux is preventing /usr/bin/mpd from name_connect access on the tcp_socket port 6000.
mpd: avahi: Service 'Music Player' successfully established.
mpd: output: Failed to open "My Pulse Output" [pulse]: Cannot connect to PulseAudio server: Connection refused
mpd: output: Failed to open "My Pulse Output" [pulse]: Cannot connect to PulseAudio server: Connection refused
(repeating the last line each 10 seconds)

Afaik there was and probably there is a problem with MPD running under mpd user. 

I gave people a policy workaround which allow MPD run under different user.

https://bugzilla.redhat.com/show_bug.cgi?id=604952#c8

But I am now trying to run MPD under mpd user and it works for me in permissive mode.

And it works with some policy changes in enforcing mode.

#allow mpd_t xdm_var_run_t:file read;
#allow mpd_t xdm_var_run_t:dir search;
#allow mpd_t xserver_port_t:tcp_socket name_connect;
#allow mpd_t xserver_t:unix_stream_socket connectto

These accesses are not needed.

Reporter, 
I am not sure why it doesn't work for you. Could you add output of

# ps -eZ | grep mpd

# ps -eZ | grep pulse

just for check.

I removed gnome-applet-music from my Gnome panel and two AVC seems to be gone. But I'm still getting "SELinux is preventing /usr/bin/mpd from name_connect access on the tcp_socket port 6000." and still no sound :(.

$ getenforce
Permissive

$ grep -v "^#" /etc/mpd.conf | grep -v "^$"
music_directory		"/var/lib/mpd/music"
playlist_directory		"/var/lib/mpd/playlists"
db_file			"/var/lib/mpd/mpd.db"
log_file			"syslog"
state_file			"/var/lib/mpd/mpdstate"
user "mpd"
port				"6600"
log_level			"verbose"
password                        "XX@read,add,control,admin"
default_permissions             "read"
input {
        plugin "curl"
}
audio_output {
	type		"pulse"
	name		"My Pulse Output"
}

$ sudo /etc/init.d/mpd start
Starting The Music Player Daemon: listen: binding to any address
listen: binding to socket address [::]:6600
listen: binding to socket address 0.0.0.0:6600
path: path_set_fs_charset: fs charset is: UTF-8
database: reading DB
daemon: daemonized!
No protocol specified
XOpenDisplay() failed
No protocol specified
XOpenDisplay() failed

$ sudo tail -5 /var/log/messages
Jan  6 13:54:33 XX setroubleshoot: SELinux is preventing /usr/bin/mpd from name_connect access on the tcp_socket port 6000. For complete SELinux messages. run sealert -l bcae7117-e774-4fb9-a3e3-8c8e8e08faa6
Jan  6 13:54:33 XX pulseaudio[10735]: bluetooth-util.c: Error from ListAdapters reply: org.freedesktop.DBus.Error.Spawn.ChildExited
Jan  6 13:54:33 XX pulseaudio[10735]: main.c: Unable to contact D-Bus: org.freedesktop.DBus.Error.Spawn.ExecFailed: /bin/dbus-launch terminated abnormally with the following error: No protocol specified
Jan  6 13:54:33 XX pulseaudio[10735]: main.c: Autolaunch error: X11 initialization failed.
Jan  6 13:54:34 XX mpd: avahi: Service 'Music Player' successfully established.

$ ps -eZ | grep mpd
unconfined_u:system_r:mpd_t:s0  10725 ?        00:00:00 mpd

$ ps -eZ | grep pulse
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 2391 ? 00:02:46 pulseaudio

*** Bug 634699 has been marked as a duplicate of this bug. ***

(In reply to comment #10)
> I removed gnome-applet-music from my Gnome panel and two AVC seems to be gone.
> But I'm still getting "SELinux is preventing /usr/bin/mpd from name_connect
> access on the tcp_socket port 6000." and still no sound :(.
> 

The problem is you are seeing it also in permissive mode so it looks like MPD problem at this moment.

Fixed in selinux-policy-3.9.7-21.fc14

selinux-policy-3.9.7-25.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-25.fc14

selinux-policy-3.9.7-25.fc14 has been pushed to the Fedora 14 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-25.fc14

Actually, the two AVCs which seemed to have disappeared are back :(.
So, they are not related to gnome-applet-music as I thought.
But "SELinux is preventing /usr/bin/mpd from name_connect access on the tcp_socket port 6000." is gone with selinux-policy-3.9.7-25.fc14.
Here's what I get when I start mpd in permissive mode:

$ sudo tail -5 /var/log/messages
Jan 23 15:46:06 I7 pulseaudio[5538]: main.c: Unable to contact D-Bus: org.freedesktop.DBus.Error.Spawn.ExecFailed: /bin/dbus-launch terminated abnormally with the following error: No protocol specified
Jan 23 15:46:06 I7 pulseaudio[5538]: main.c: Autolaunch error: X11 initialization failed.
Jan 23 15:46:07 I7 mpd: avahi: Service 'Music Player' successfully established.
Jan 23 15:46:08 I7 setroubleshoot: SELinux is preventing /usr/bin/mpd from search access on the directory /var/run/gdm. For complete SELinux messages. run sealert -l 74e53376-7f10-4cbb-b132-c773766a0cbf
Jan 23 15:46:08 I7 setroubleshoot: SELinux is preventing /usr/bin/mpd from name_connect access on the tcp_socket port 6000. For complete SELinux messages. run sealert -l 3f1fa222-0627-43ac-98a9-7ee11b52b5de

$ ls /bin/dbus-launch
ls: cannot access /bin/dbus-launch: No such file or directory

And I still have no sound.
So, I guess it's a pulseaudio bug.

$ yum info pulseaudio  
Installed Packages
Name        : pulseaudio
Arch        : x86_64
Version     : 0.9.21
Release     : 7.fc14

Please attach the output of 

ausearch -m avc -ts recent

Created attachment 474992 [details]
Output of "ausearch -m avc -ts recent"

I dit not dontaudit these rules. Will do it.

Anyway your problem is not SELinux.

selinux-policy-3.9.7-25.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.