Bug 831977

Summary: acpid is unable to launch systemd-loginctl list-sessions
Product: [Fedora] Fedora Reporter: Jaroslav Škarvada <jskarvad>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 17CC: dominick.grift, dwalsh, kevin, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-06-20 00:29:14 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 819559    

Description Jaroslav Škarvada 2012-06-14 08:33:54 UTC 
Description of problem:
As resolution of bug 819559 we need to call systemd-loginctl list-sessions to get all sessions from acpid script. This is currentlu blocked by selinux.

Version-Release number of selected component (if applicable):
selinux-policy-3.10.0-128.fc17.noarch

How reproducible:
Always

Steps to Reproduce:
1. Apply fix from bug 819559
2. Login to KDE and press HW power button
  
Actual results:
Machine power offs, AVC is logged.

Expected results:
Shutdown dialog is shown, no AVC.

Additional info:
type=USER_AVC msg=audit(1339662436.773:131): pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.login1.Manager member=ListSessions dest=org.freedesktop.login1 spid=2649 tpid=718 scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:systemd_logind_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'

# cat /var/log/audit/audit.log | audit2allow
#============= apmd_t ==============
allow apmd_t systemd_logind_t:dbus send_msg;
Comment 1 Kevin Kofler 2012-06-14 13:52:54 UTC 
<RANT>And once again we have to get a bugfix copied to the SELinux policy for it to actually work. I'm so fed up of that dumb hardcoded ruleset that keeps thinking it knows better what a program needs to do than the actual program. Now WHY is that software equivalent of nonsensical bureaucracy enabled by default in Fedora?</RANT>
Comment 2 Daniel Walsh 2012-06-14 18:55:47 UTC 
If you can tell me all of the applications that now need to talk to the systemd_logind_ daemon, I am willing to listen.

Fixed in selinux-policy-3.10.0-131.fc17
Comment 3 Fedora Update System 2012-06-19 07:58:50 UTC 
selinux-policy-3.10.0-132.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-132.fc17
Comment 4 Fedora Update System 2012-06-20 00:29:14 UTC 
selinux-policy-3.10.0-132.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2012-07-19 09:17:14 UTC 
selinux-policy-3.10.0-132.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.