Description of problem: After a selinux update, I ran the nvidia-settings program via primus. SELinux is preventing /usr/libexec/Xorg.bin from 'rename' accesses on the file Xorg.8.log. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that Xorg.bin should be allowed rename access on the Xorg.8.log file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep Xorg.bin /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:bumblebee_t:s0 Target Context system_u:object_r:xserver_log_t:s0 Target Objects Xorg.8.log [ file ] Source Xorg.bin Source Path /usr/libexec/Xorg.bin Port <Unknown> Host (removed) Source RPM Packages xorg-x11-server-Xorg-1.16.2-1.fc21.x86_64 Target RPM Packages Policy RPM selinux-policy-3.13.1-99.fc21.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 3.17.4-302.fc21.x86_64 #1 SMP Thu Dec 4 19:12:43 UTC 2014 x86_64 x86_64 Alert Count 1 First Seen 2014-12-06 14:08:33 CST Last Seen 2014-12-06 14:08:33 CST Local ID 4b59c8dd-1ec1-48c4-8915-bf7cba4b350c Raw Audit Messages type=AVC msg=audit(1417896513.269:465): avc: denied { rename } for pid=6056 comm="Xorg.bin" name="Xorg.8.log" dev="dm-0" ino=1441845 scontext=system_u:system_r:bumblebee_t:s0 tcontext=system_u:object_r:xserver_log_t:s0 tclass=file permissive=1 type=AVC msg=audit(1417896513.269:465): avc: denied { unlink } for pid=6056 comm="Xorg.bin" name="Xorg.8.log.old" dev="dm-0" ino=1441929 scontext=system_u:system_r:bumblebee_t:s0 tcontext=system_u:object_r:xserver_log_t:s0 tclass=file permissive=1 type=SYSCALL msg=audit(1417896513.269:465): arch=x86_64 syscall=rename success=yes exit=0 a0=d94610 a1=d94650 a2=0 a3=21 items=0 ppid=6030 pid=6056 auid=4294967295 uid=0 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=4294967295 comm=Xorg.bin exe=/usr/libexec/Xorg.bin subj=system_u:system_r:bumblebee_t:s0 key=(null) Hash: Xorg.bin,bumblebee_t,xserver_log_t,file,rename Version-Release number of selected component: selinux-policy-3.13.1-99.fc21.noarch Additional info: reporter: libreport-2.3.0 hashmarkername: setroubleshoot kernel: 3.17.4-302.fc21.x86_64 type: libreport
Description of problem: Enable bumblebee according to http://fedoraproject.org/wiki/Bumblebee $ PRIMUS_VERBOSE=2 optirun -vvv -b primus glxgears -info [ 2271.418584] [DEBUG]Reading file: /etc/bumblebee/bumblebee.conf [ 2271.418707] [INFO]Configured driver: nvidia [ 2271.419157] [DEBUG]optirun version 3.2.1 starting... [ 2271.419183] [DEBUG]Active configuration: [ 2271.419189] [DEBUG] bumblebeed config file: /etc/bumblebee/bumblebee.conf [ 2271.419195] [DEBUG] X display: :8 [ 2271.419201] [DEBUG] LD_LIBRARY_PATH: /usr/lib64/nvidia-bumblebee:/usr/lib/nvidia-bumblebee:/usr/lib64:/usr/lib [ 2271.419208] [DEBUG] Socket path: /var/run/bumblebee.socket [ 2271.419214] [DEBUG] Accel/display bridge: primus [ 2271.419221] [DEBUG] VGL Compression: proxy [ 2271.419227] [DEBUG] VGLrun extra options: [ 2271.419233] [DEBUG] Primus LD Path: /usr/lib/primus:/usr/lib64/primus [ 2271.423403] [INFO]Response: No - error: [XORG] (EE) [ 2271.423431] [ERROR]Cannot access secondary GPU - error: [XORG] (EE) [ 2271.423438] [DEBUG]Socket closed. [ 2271.423461] [ERROR]Aborting because fallback start is disabled. [ 2271.423468] [DEBUG]Killing all remaining processes. Version-Release number of selected component: selinux-policy-3.13.1-99.fc21.noarch Additional info: reporter: libreport-2.3.0 hashmarkername: setroubleshoot kernel: 3.17.4-301.fc21.x86_64 type: libreport
We will need to add labeling for Xorg.bin Marco, could you try to execute # chcon -t xserver_exec_t /usr/libexec/Xorg.bin
Miroslav, That solved the SELinux warning. optirun still won't run, but that's for another bug.
My bumblebee/primus is working, it's just the selinux warning which is the problem. I'll give this fix a try when I can. As far as bumblebee-nvidia problems, I have run into this if I attempt to reinstall it or remove it. It doesn't seem to install again properly. And I haven't had any success in getting it to work properly again save for a fresh fedora install. But I'm sure there's a way if I understood all the packages involved.
Thanks for your posts. Could you re-test it with permissive mode?
Description of problem: Appeared while troubleshooting Bumblebee: % PRIMUS_VERBOSE=2 optirun -vv -b primus glxgears -info [ 144.980707] [DEBUG]Reading file: /etc/bumblebee/bumblebee.conf [ 144.980968] [INFO]Configured driver: nvidia [ 144.981515] [DEBUG]optirun version 3.2.1 starting... [ 144.981526] [DEBUG]Active configuration: [ 144.981531] [DEBUG] bumblebeed config file: /etc/bumblebee/bumblebee.conf [ 144.981535] [DEBUG] X display: :8 [ 144.981538] [DEBUG] LD_LIBRARY_PATH: /usr/lib64/nvidia-bumblebee:/usr/lib/nvidia-bumblebee:/usr/lib64:/usr/lib [ 144.981542] [DEBUG] Socket path: /var/run/bumblebee.socket [ 144.981546] [DEBUG] Accel/display bridge: primus [ 144.981549] [DEBUG] VGL Compression: proxy [ 144.981552] [DEBUG] VGLrun extra options: [ 144.981556] [DEBUG] Primus LD Path: /usr/lib/primus:/usr/lib64/primus [ 150.804273] [INFO]Response: No - error: [XORG] (EE) [ 150.804330] [ERROR]Cannot access secondary GPU - error: [XORG] (EE) [ 150.804340] [DEBUG]Socket closed. [ 150.804380] [ERROR]Aborting because fallback start is disabled. [ 150.804395] [DEBUG]Killing all remaining processes. Version-Release number of selected component: selinux-policy-3.13.1-99.fc21.noarch Additional info: reporter: libreport-2.3.0 hashmarkername: setroubleshoot kernel: 3.17.6-300.fc21.x86_64 type: libreport
I'll have to double check, but I'm pretty sure I'm still getting the selinux warning when running primus. I've installed updates testing packages, but I need to make sure this was one of them.
*** This bug has been marked as a duplicate of bug 1176327 ***