Hide Forgot
Description of problem: Using nmcli on fedora 20. It is likely that there are more actions than just this which could trigger denials. May be worth running some tests on editing and creating interfaces etc. It will become possibly easier with nmtui on F21 and El7 SELinux is preventing /usr/bin/nmcli from 'write' accesses on the sock_file . ***** Plugin catchall (100. confidence) suggests ************************** If you believe that nmcli should be allowed write access on the sock_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep nmcli /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context staff_u:sysadm_r:sysadm_t:s0 Target Context system_u:object_r:NetworkManager_var_run_t:s0 Target Objects [ sock_file ] Source nmcli Source Path /usr/bin/nmcli Port <Unknown> Host (removed) Source RPM Packages NetworkManager-0.9.9.0-41.git20131003.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-177.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 3.15.6-200.fc20.x86_64 #1 SMP Fri Jul 18 02:36:27 UTC 2014 x86_64 x86_64 Alert Count 14 First Seen 2014-07-21 14:51:38 CST Last Seen 2014-07-22 12:44:25 CST Local ID 1ce61077-6b0b-4c16-b82e-0c8da05c3183 Raw Audit Messages type=AVC msg=audit(1405998865.811:574): avc: denied { write } for pid=23596 comm="nmcli" name="private" dev="tmpfs" ino=30729 scontext=staff_u:sysadm_r:sysadm_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=sock_file type=AVC msg=audit(1405998865.811:574): avc: denied { connectto } for pid=23596 comm="nmcli" path="/run/NetworkManager/private" scontext=staff_u:sysadm_r:sysadm_t:s0 tcontext=system_u:system_r:NetworkManager_t:s0 tclass=unix_stream_socket type=SYSCALL msg=audit(1405998865.811:574): arch=x86_64 syscall=connect success=yes exit=0 a0=4 a1=7fff008542f0 a2=21 a3=7fff008540a0 items=0 ppid=11256 pid=23596 auid=1176360 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm=nmcli exe=/usr/bin/nmcli subj=staff_u:sysadm_r:sysadm_t:s0 key=(null) Hash: nmcli,sysadm_t,NetworkManager_var_run_t,sock_file,write Additional info: reporter: libreport-2.2.2 hashmarkername: setroubleshoot kernel: 3.15.6-200.fc20.x86_64 type: libreport
a965568eab09fad7e654f93197c47aa6ffe7e694 fixes this in git.
commit f590f2bbe1cf042d5b60513ab9a195f7e0d20e80 Author: Dan Walsh <dwalsh@redhat.com> Date: Wed Aug 6 18:44:03 2014 -0400 sysadm_t should be allowed to communicate with networkmanager https://github.com/selinux-policy/selinux-policy/commit/f590f2bbe1cf042d5b60513ab9a195f7e0d20e80
selinux-policy-3.12.1-180.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-180.fc20
Package selinux-policy-3.12.1-180.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-180.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-9454/selinux-policy-3.12.1-180.fc20 then log in and leave karma (feedback).
selinux-policy-3.12.1-180.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.