Description of problem: Attempted to run 'rolectl list instances' The issue appears to be an incorrectly-handled SELinux denial which crashes roled and fails to return an error to the rolectl client, which waits forever. Version-Release number of selected component: rolekit-0.0.3-1.fc21 Additional info: reporter: libreport-2.2.3 cmdline: /usr/bin/python -Es /usr/sbin/roled --nofork --nopid dso_list: dbus-python-1.2.0-6.fc21.x86_64 executable: /usr/sbin/roled kernel: 3.16.1-300.fc21.x86_64 runlevel: N 3 type: Python uid: 0 Truncated backtrace: connection.py:584:call_async:ValueError: Unable to guess signature from an empty dict Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/dbus/connection.py", line 607, in msg_reply_handler *message.get_args_list())) File "/usr/lib/python2.7/site-packages/dbus/proxies.py", line 416, in _introspect_error_handler self._introspect_execute_queue() File "/usr/lib/python2.7/site-packages/dbus/proxies.py", line 387, in _introspect_execute_queue proxy_method(*args, **keywords) File "/usr/lib/python2.7/site-packages/dbus/proxies.py", line 137, in __call__ **keywords) File "/usr/lib/python2.7/site-packages/dbus/connection.py", line 584, in call_async message.append(signature=signature, *args) ValueError: Unable to guess signature from an empty dict Local variables in innermost frame: bus_name: dbus.UTF8String(':1.5') byte_arrays: False self: <dbus._dbus.SystemBus (system) at 0x7f7b99aa9590> args: (('system-bus-name', {'name': ':1.29'}), 'org.fedoraproject.rolekit1.all', {}, 1, '') require_main_loop: True object_path: '/org/freedesktop/PolicyKit1/Authority' signature: None reply_handler: <function reply_cb at 0x7f7b9749b2a8> error_handler: <function error_handler at 0x7f7b9749b1b8> dbus_interface: 'org.freedesktop.PolicyKit1.Authority' timeout: 2147483.647 kwargs: {} e: ValueError('Unable to guess signature from an empty dict',) message: <dbus.lowlevel.MethodCallMessage path: /org/freedesktop/PolicyKit1/Authority, iface: org.freedesktop.PolicyKit1.Authority, member: CheckAuthorization dest: :1.5> get_args_opts: {'byte_arrays': False, 'utf8_strings': False} method: 'CheckAuthorization'
Created attachment 931652 [details] File: backtrace
Created attachment 931653 [details] File: environ
I say that it's related to SELinux because it doesn't hang in permissive mode. There are two bugs here: one in SELinux to properly allow the behavior and another in cockpit itself to properly handle permission denied errors. audit2why: type=USER_AVC msg=audit(1409164980.789:721): pid=608 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.30 spid=748 tpid=22117 scontext=system_u:system_r:policykit_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access.
After further investigation, this appears to be crashing in dbus-python, not rolekit. Reassigning the component.
This package has changed ownership in the Fedora Package Database. Reassigning to the new owner of this component.
Patches welcomed to fix this issue as it's at the bottom of my todo list (may never happen).
I agree with upstream and have no intention to support the unsupported patch and the rolekit package! https://bugs.freedesktop.org/show_bug.cgi?id=26903#c14
rolekit-0.4.0-5.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-40a4d314f3
rolekit-0.4.0-5.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with $ su -c 'dnf --enablerepo=updates-testing update rolekit' You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-40a4d314f3
rolekit-0.4.0.1-1.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-40a4d314f3
rolekit-0.4.0.1-1.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with $ su -c 'dnf --enablerepo=updates-testing update rolekit' You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-40a4d314f3
rolekit-0.4.0.1-2.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-40a4d314f3
rolekit-0.4.0.1-2.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with $ su -c 'dnf --enablerepo=updates-testing update rolekit' You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-40a4d314f3
rolekit-0.4.0.1-2.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.