Bug 1121865 - SELinux is preventing /usr/bin/nmcli from 'write' accesses on the sock_file .
Summary: SELinux is preventing /usr/bin/nmcli from 'write' accesses on the sock_file .
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 20
Hardware: x86_64
OS: Unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
Whiteboard: abrt_hash:3875b397fe172bf161548ba2d93...
Depends On:
TreeView+ depends on / blocked
Reported: 2014-07-22 05:34 UTC by William Brown
Modified: 2014-08-21 09:46 UTC (History)
4 users (show)

Fixed In Version: selinux-policy-3.12.1-180.fc20
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2014-08-21 09:46:36 UTC

Attachments (Terms of Use)

Description William Brown 2014-07-22 05:34:45 UTC
Description of problem:
Using nmcli on fedora 20. It is likely that there are more actions than just this which could trigger denials. May be worth running some tests on editing and creating interfaces etc. It will become possibly easier with nmtui on F21 and El7
SELinux is preventing /usr/bin/nmcli from 'write' accesses on the sock_file .

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that nmcli should be allowed write access on the  sock_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
allow this access for now by executing:
# grep nmcli /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                staff_u:sysadm_r:sysadm_t:s0
Target Context                system_u:object_r:NetworkManager_var_run_t:s0
Target Objects                 [ sock_file ]
Source                        nmcli
Source Path                   /usr/bin/nmcli
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           NetworkManager-
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-177.fc20.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 3.15.6-200.fc20.x86_64 #1 SMP Fri
                              Jul 18 02:36:27 UTC 2014 x86_64 x86_64
Alert Count                   14
First Seen                    2014-07-21 14:51:38 CST
Last Seen                     2014-07-22 12:44:25 CST
Local ID                      1ce61077-6b0b-4c16-b82e-0c8da05c3183

Raw Audit Messages
type=AVC msg=audit(1405998865.811:574): avc:  denied  { write } for  pid=23596 comm="nmcli" name="private" dev="tmpfs" ino=30729 scontext=staff_u:sysadm_r:sysadm_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=sock_file

type=AVC msg=audit(1405998865.811:574): avc:  denied  { connectto } for  pid=23596 comm="nmcli" path="/run/NetworkManager/private" scontext=staff_u:sysadm_r:sysadm_t:s0 tcontext=system_u:system_r:NetworkManager_t:s0 tclass=unix_stream_socket

type=SYSCALL msg=audit(1405998865.811:574): arch=x86_64 syscall=connect success=yes exit=0 a0=4 a1=7fff008542f0 a2=21 a3=7fff008540a0 items=0 ppid=11256 pid=23596 auid=1176360 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm=nmcli exe=/usr/bin/nmcli subj=staff_u:sysadm_r:sysadm_t:s0 key=(null)

Hash: nmcli,sysadm_t,NetworkManager_var_run_t,sock_file,write

Additional info:
reporter:       libreport-2.2.2
hashmarkername: setroubleshoot
kernel:         3.15.6-200.fc20.x86_64
type:           libreport

Comment 1 Daniel Walsh 2014-08-06 22:44:44 UTC
a965568eab09fad7e654f93197c47aa6ffe7e694 fixes this in git.

Comment 2 Lukas Vrabec 2014-08-12 08:38:41 UTC
commit f590f2bbe1cf042d5b60513ab9a195f7e0d20e80
Author: Dan Walsh <dwalsh@redhat.com>
Date:   Wed Aug 6 18:44:03 2014 -0400

    sysadm_t should be allowed to communicate with networkmanager


Comment 3 Fedora Update System 2014-08-13 12:09:14 UTC
selinux-policy-3.12.1-180.fc20 has been submitted as an update for Fedora 20.

Comment 4 Fedora Update System 2014-08-16 00:30:35 UTC
Package selinux-policy-3.12.1-180.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-180.fc20'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).

Comment 5 Fedora Update System 2014-08-21 09:46:36 UTC
selinux-policy-3.12.1-180.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.