Description of problem: I am not sure why upsmon uses /dev/urandom. but if it is for something reasonable it should have access or else it should be changed not to use it. I have an attached ups and run nut-driver, nut-service and nut-monitor. This should probably be paired with Bug 1116594 which is also about access to /dev/urandom. SELinux is preventing /usr/sbin/upsmon from 'open' accesses on the chr_file /dev/urandom. ***** Plugin catchall_boolean (47.5 confidence) suggests ****************** If you want to allow users to resolve user passwd entries directly from ldap rather then using a sssd server Then you must tell SELinux about this by enabling the 'authlogin_nsswitch_use_ldap' boolean. You can read 'None' man page for more details. Do setsebool -P authlogin_nsswitch_use_ldap 1 ***** Plugin catchall_boolean (47.5 confidence) suggests ****************** If you want to enable reading of urandom for all domains. Then you must tell SELinux about this by enabling the 'global_ssp' boolean. You can read 'None' man page for more details. Do setsebool -P global_ssp 1 ***** Plugin catchall (6.38 confidence) suggests ************************** If you believe that upsmon should be allowed open access on the urandom chr_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep upsmon /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:nut_upsmon_t:s0 Target Context system_u:object_r:urandom_device_t:s0 Target Objects /dev/urandom [ chr_file ] Source upsmon Source Path /usr/sbin/upsmon Port <Unknown> Host (removed) Source RPM Packages nut-2.7.2-2.fc21.i686 nut-client-2.7.2-2.fc21.i686 Target RPM Packages Policy RPM selinux-policy-3.13.1-62.fc21.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 3.16.0-0.rc3.git2.2.fc21.i686+PAE #1 SMP Wed Jul 2 15:58:01 UTC 2014 i686 i686 Alert Count 2 First Seen 2014-07-03 07:44:21 CDT Last Seen 2014-07-04 10:17:06 CDT Local ID ef56d3df-3a51-4665-ae72-35c90ff636cb Raw Audit Messages type=AVC msg=audit(1404487026.581:46): avc: denied { open } for pid=1453 comm="upsmon" path="/dev/urandom" dev="devtmpfs" ino=7600 scontext=system_u:system_r:nut_upsmon_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file permissive=1 type=SYSCALL msg=audit(1404487026.581:46): arch=i386 syscall=open success=yes exit=EINTR a0=b757591c a1=900 a2=b7219ec0 a3=bfa1fc24 items=0 ppid=1441 pid=1453 auid=4294967295 uid=57 gid=57 euid=57 suid=57 fsuid=57 egid=57 sgid=57 fsgid=57 tty=(none) ses=4294967295 comm=upsmon exe=/usr/sbin/upsmon subj=system_u:system_r:nut_upsmon_t:s0 key=(null) Hash: upsmon,nut_upsmon_t,urandom_device_t,chr_file,open Version-Release number of selected component: selinux-policy-3.13.1-62.fc21.noarch Additional info: reporter: libreport-2.2.2 hashmarkername: setroubleshoot kernel: 3.16.0-0.rc3.git2.2.fc21.i686+PAE type: libreport
That is strange, since this is definitely allowed?
*** Bug 1116594 has been marked as a duplicate of this bug. ***
I have been doing some relabeles to make sure labelling is up to date and I didn't go back very far in my logs when I filed the recent series of bugs, but maybe there was a period were something wasn't labelled properly or policy was different. If you want I can see if the upsmon AVCs are still happening?
I checked and on one machine I haven't seen this in over a day and a half, but on anther I got one with the last day. type=AVC msg=audit(1404757874.930:43): avc: denied { getattr } for pid=1311 comm="upsmon" path="/dev/urandom" dev="devtmpfs" ino=1048 scontext=system_u:system_r:nut_upsmon_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file permissive=1 Could this have been fixed within the last few days?
Well it is not allowd. I added it. commit 72f56829dfc4c7e51e42902caf1a038dcdc2d20a Author: Miroslav Grepl <mgrepl> Date: Wed Jul 9 14:17:47 2014 +0200 Allow all nut domains to read /dev/(u)?random.
The following is also needed to allow fifo in /var/run/nut for upssched timers allow nut_upsmon_t nut_var_run_t:sock_file { write create unlink setattr };
a97f16fc364449706b86fec9a919a5d42f9ed455 fixes this in git.
https://github.com/selinux-policy/selinux-policy/commit/5be2c944e525cae9e911fd7fe2f29e7bd39fc4e2 commit 5be2c944e525cae9e911fd7fe2f29e7bd39fc4e2 Author: Dan Walsh <dwalsh> Date: Mon Jul 14 09:18:18 2014 -0400 Allow nut_upsmon_t to create sock_file in /run dir