Bug 708587

Summary: SELinux is preventing /usr/sbin/NetworkManager from 'read' accesses on the file NetworkManager.pid.
Product: [Fedora] Fedora Reporter: vingt <ving.t>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 15CC: dominick.grift, dwalsh, mgrepl
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:d71561832efcb7d982800cc0f81deddf24dff6464c320b6b99284a0df002df36
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-10-07 14:19:09 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description vingt 2011-05-28 07:20:49 UTC
SELinux is preventing /usr/sbin/NetworkManager from 'read' accesses on the file NetworkManager.pid.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that NetworkManager should be allowed read access on the NetworkManager.pid file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep NetworkManager /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:NetworkManager_t:s0
Target Context                unconfined_u:object_r:var_run_t:s0
Target Objects                NetworkManager.pid [ file ]
Source                        NetworkManager
Source Path                   /usr/sbin/NetworkManager
Port                          <未知>
Host                          (removed)
Source RPM Packages           NetworkManager-0.8.999-3.git20110526.fc15
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.16-24.fc15
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.38.6-27.fc15.i686 #1 SMP
                              Sun May 15 17:57:13 UTC 2011 i686 i686
Alert Count                   1
First Seen                    2011年05月28日 星期六 15时11分50秒
Last Seen                     2011年05月28日 星期六 15时11分50秒
Local ID                      2b1fd48b-2e04-4d6d-9d1d-65cb150e60b6

Raw Audit Messages
type=AVC msg=audit(1306566710.761:128): avc:  denied  { read } for  pid=8065 comm="NetworkManager" name="NetworkManager.pid" dev=tmpfs ino=110020 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file


type=SYSCALL msg=audit(1306566710.761:128): arch=i386 syscall=open success=no exit=EACCES a0=8c598b8 a1=8000 a2=0 a3=8c596e8 items=0 ppid=1 pid=8065 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=NetworkManager exe=/usr/sbin/NetworkManager subj=system_u:system_r:NetworkManager_t:s0 key=(null)

Hash: NetworkManager,NetworkManager_t,var_run_t,file,read

audit2allow

#============= NetworkManager_t ==============
allow NetworkManager_t var_run_t:file read;

audit2allow -R

#============= NetworkManager_t ==============
allow NetworkManager_t var_run_t:file read;

Comment 1 Dominick Grift 2011-05-28 09:41:30 UTC
Looks like NetworkManager was run manually by unconfined_t, there does not seem to be a domain transition for unconfined_t to NetworkManager_t currently, and so the pid file was created with the generic pid file type. A second instance started by the system was not able to read the instance started by unconfined_t it seems. Either that or the pid file created by the unconfined_t instance was not removed.

This looks like a misconfiguration issue to me.

Comment 2 Miroslav Grepl 2011-05-29 20:17:41 UTC
Did you start NM by hand?

It looks so. 

Please reopen the bug if the problem still exists.

Comment 3 Dominick Grift 2011-05-30 08:45:24 UTC
Try:  restorecon -R -v /var, just in case you have some mislabelled symlinks as well (/var/run and /var/lock)

Comment 4 vingt 2011-06-02 15:36:33 UTC
actually,I have a problem like this:
http://www.surfer07.be/fedora/
so I follow the step in order to solve my problem.but,when I go to step 2.2 and  use the command "nm-connection-editor"
the SElinux show the bug above..

sorry about my bad English..

Comment 5 Dominick Grift 2011-06-02 15:48:42 UTC
[quote]After that restart Network Manager.
# sudo NetworkManager
Now you should be back online. [/quote]

That is not the encouraged way to start network manager. Instead use service NetworkManager start or systemctl start NetworkManager.service.