Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
a user mapped to user_t can't lower/raise audio volume
Version-Release number of selected component (if applicable):
metacity-2.28.0-20.el6
gnome-media-2.29.91-6.el6
selinux-policy-3.7.19-93.el6
How reproducible:
always
Steps to Reproduce:
1. map a user to user_t
2. login as the user
3. press a key mapped to XF86AudioLowerVolume / XF86AudioRaiseVolume
4. see AVC denial
Summary:
SELinux is preventing /usr/bin/metacity "connectto" access on
/tmp/pulse-SyvR3tdk08Ao/native.
Detailed Description:
SELinux denied access requested by metacity. It is not expected that this access
is required by metacity and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.
Additional Information:
Source Context user_u:user_r:user_t:s0
Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
023
Target Objects /tmp/pulse-SyvR3tdk08Ao/native [
unix_stream_socket ]
Source gconfd-2
Source Path /usr/libexec/gconfd-2
Port <Unknown>
Host <Unknown>
Source RPM Packages metacity-2.28.0-20.el6
Target RPM Packages
Policy RPM selinux-policy-3.7.19-93.el6
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Plugin Name catchall
Host Name xxx
Platform Linux xxx
2.6.32-131.4.1.el6.i686 #1 SMP Fri Jun 10 10:53:52
EDT 2011 i686 i686
Alert Count 37
First Seen Thu Jun 16 22:37:53 2011
Last Seen Thu Jun 16 22:41:17 2011
Local ID 9059efba-ee9b-4d0f-af4e-5f5d4948854c
Line Numbers 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17,
18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29,
30, 31, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45,
46, 47, 48, 49, 53, 54, 55, 56, 57, 58, 59, 60,
61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72,
77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88
Raw Audit Messages
type=AVC msg=audit(1308256877.977:203): avc: denied { connectto } for pid=11887 comm="metacity" path="/tmp/pulse-SyvR3tdk08Ao/native" scontext=user_u:user_r:user_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=SYSCALL msg=audit(1308256877.977:203): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfd8fbe0 a2=39a1400 a3=92c7040 items=0 ppid=11771 pid=11887 auid=600 uid=600 gid=600 euid=600 suid=600 fsuid=600 egid=600 sgid=600 fsgid=600 tty=(none) ses=22 comm="metacity" exe="/usr/bin/metacity" subj=user_u:user_r:user_t:s0 key=(null)
You would need to clean out the /tmp directory if you are running with confined users. This is one of the reasons I always run with a tmpfs /tmp/
rm -rf /tmp/pulse-*
Logout
log back in,