Bug 809832

*** Bug 810025 has been marked as a duplicate of this bug. ***

*** Bug 809836 has been marked as a duplicate of this bug. ***

*** Bug 810021 has been marked as a duplicate of this bug. ***

*** Bug 809837 has been marked as a duplicate of this bug. ***

*** Bug 810029 has been marked as a duplicate of this bug. ***

*** Bug 810030 has been marked as a duplicate of this bug. ***

*** Bug 809838 has been marked as a duplicate of this bug. ***

*** Bug 810031 has been marked as a duplicate of this bug. ***

*** Bug 810032 has been marked as a duplicate of this bug. ***

*** Bug 810027 has been marked as a duplicate of this bug. ***

Created attachment 575243 [details]
tuned_audit.log

Running of "tuned-adm profile {something}" triggered yet some SElinux events.

Attached (tuned_audit.log) is grep from audit.log from running it / allowing it until SElinux was happy so you get idea what everything is triggered.

tuned-adm list | grep -e "^-" | cut -c 3-|xargs -n 1 tuned-adm profile
grep -E "sysctl|df|ls|tuned|script.sh|mount" /var/log/audit/audit.log | audit2allow -M mypol 
semodule -i mypol.pp

Some of these issues are fixed in the latest policy. I am fixing labeling for scripts located in the /usr/lib/tuned.

But what does /usr/lib/tuned/balanced/script.sh do?

Hi,
this question is probably best to be answered by Jaroslav Škarvada (jskarvad).

Issues were found as part of the PM test day.
https://fedoraproject.org/w/index.php?title=Test_Day:2012-04-04_Power_Management

Best regards
Michal Ambroz

Yes, this is a question for Jaroslav.

(In reply to comment #12)
> Some of these issues are fixed in the latest policy. I am fixing labeling for
> scripts located in the /usr/lib/tuned.
> 
> But what does /usr/lib/tuned/balanced/script.sh do?
>
Functionality is similar to our previous ktune tool from old tuned.

Currently system profiles are stored under the following tree:
 /usr/lib/tuned/PROFILE_NAME/

Some profiles has script.sh, e.g. for balanced profile there is:
 /usr/lib/tuned/balanced/script.sh

Currently the script.sh from balanced profile do:
Writes temporal files under /run/tuned/
RW /sys/devices/system/cpu/$cpu/cpufreq/scaling_governor
RW /sys/module/snd_ac97_codec/parameters/power_save
RW /sys/module/snd_hda_intel/parameters/power_save
RW /sys/class/drm/card0/device/power_profile
RW /sys/class/drm/card0/device/power_method

Other profiles also do:
RW /sys/block/*/queue/scheduler
Remounts no boot and no root partitions with parameters 'barrier', 'nobarrier',
'commit=*', 'noatime' 
RW /sys/block/*/queue/read_ahead_kb
RW to /sys/bus/pci/devices/*/power_level
Executes iwpriv
Executes /usr/libexec/tuned/pmqos-static.py
RW /sys/bus/usb/devices/*/power/autosuspend
RW /sys/class/scsi_host/*/link_power_management_policy
R /sys/class/scsi_host/*/ahci_port_cmd
RW /sys/devices/system/cpu/sched_mc_power_savings
Executes hdparm
Executes hciconfig
Executes sync
Modifies /etc/rsyslog.conf
RW /sys/kernel/mm/redhat_transparent_hugepage/enabled

We maintain dbase of tunings and periodically update it / add new tunings.

User profiles (administrators provided) are stored under:
/etc/tuned/PROFILE_NAME

This profiles can be written / modified by administrators. They can also
execute scripts - mostly files under:
/etc/tuned/PROFILE_NAME/
by default script.sh, but can have arbitrary name.

Tuned process also needs to listen on D-Bus system bus.
It also sends signals to itself.

tuned-adm needs to send signals to tuned process.

*** Bug 820464 has been marked as a duplicate of this bug. ***

Added more fixes to selinux-policy-3.10.0-126.fc17

selinux-policy-3.10.0-128.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-128.fc17

Package selinux-policy-3.10.0-128.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-128.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-8720/selinux-policy-3.10.0-128.fc17
then log in and leave karma (feedback).

selinux-policy-3.10.0-128.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

I have just recently started getting this error. It has occurred 12 times in the last week and a half. Currently running 3.6.10-2.fc17.x86_64

Forgot to add policy: selinux-policy-3.10.0-161.fc17.

Please attach the actual AVC.

Not sure if this is it or TMI:

type=AVC msg=audit(1356115325.166:719): avc:  denied  { getattr } for  pid=5470 comm="df" path="/sys/kernel/config" dev="configfs" ino=11317 scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 tcontext=system_u:object_r:configfs_t:s0 tclass=dir


type=SYSCALL msg=audit(1356115325.166:719): arch=x86_64 syscall=stat success=no exit=EACCES a0=150e350 a1=7fff7123ad60 a2=7fff7123ad60 a3=334ae83d90 items=0 ppid=5468 pid=5470 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm=df exe=/usr/bin/df subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 key=(null)

Not related to this bug, although I do see this as fixed on F18.

Added to F17.

# sesearch -A -s logwatch_t -t configfs_t
Found 1 semantic av rules:
   allow logwatch_t filesystem_type : filesystem getattr