Bug 1178117 - SELinux is preventing /usr/sbin/console-kit-dae from write access on the directory /var/lib/dbus
Summary: SELinux is preventing /usr/sbin/console-kit-dae from write access on the dire...
Keywords:
Status: CLOSED INSUFFICIENT_DATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 21
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-01-02 12:08 UTC by JC
Modified: 2015-01-05 13:54 UTC (History)
8 users (show)

Fixed In Version:
Clone Of: 1123926
Environment:
Last Closed: 2015-01-05 13:54:20 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description JC 2015-01-02 12:08:16 UTC
It looks as if SELinux is truncating the name of the console-kit-daemon.

From SELinux

SELinux is preventing console-kit-dae from write access on the directory /var/lib/dbus.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that console-kit-dae should be allowed write access on the dbus directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep console-kit-dae /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:consolekit_t:s0
Target Context                system_u:object_r:system_dbusd_var_lib_t:s0
Target Objects                /var/lib/dbus [ dir ]
Source                        console-kit-dae
Source Path                   console-kit-dae
Port                          <Unknown>
Host                          mevallair.evil
Source RPM Packages           
Target RPM Packages           
Policy RPM                    <Unknown>
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     mevallair.evil
Platform                      Linux mevallair.evil 3.17.4-301.fc21.x86_64 #1 SMP
                              Thu Nov 27 19:09:10 UTC 2014 x86_64 x86_64
Alert Count                   1
First Seen                    2015-01-01 13:42:46 EST
Last Seen                     2015-01-01 13:42:46 EST
Local ID                      5bf3c735-b6c1-47b5-b287-620754af578e

Raw Audit Messages
type=AVC msg=audit(1420137766.133:1053): avc:  denied  { write } for  pid=2586 comm="console-kit-dae" name="dbus" dev="dm-0" ino=20709539 scontext=system_u:system_r:consolekit_t:s0 tcontext=system_u:object_r:system_dbusd_var_lib_t:s0 tclass=dir permissive=0

Hash: console-kit-dae,consolekit_t,system_dbusd_var_lib_t,dir,write

Output of grep console-kit-dae /var/log/audit/audit.log
type=SERVICE_START msg=audit(1420131749.406:460): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="console-kit-daemon" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=AVC msg=audit(1420131749.448:461): avc:  denied  { write } for  pid=2586 comm="console-kit-dae" name="dbus" dev="dm-0" ino=20709539 scontext=system_u:system_r:consolekit_t:s0 tcontext=system_u:object_r:system_dbusd_var_lib_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1420133034.885:925): avc:  denied  { write } for  pid=2586 comm="console-kit-dae" name="dbus" dev="dm-0" ino=20709539 scontext=system_u:system_r:consolekit_t:s0 tcontext=system_u:object_r:system_dbusd_var_lib_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1420133104.083:938): avc:  denied  { write } for  pid=2586 comm="console-kit-dae" name="dbus" dev="dm-0" ino=20709539 scontext=system_u:system_r:consolekit_t:s0 tcontext=system_u:object_r:system_dbusd_var_lib_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1420134808.929:981): avc:  denied  { write } for  pid=2586 comm="console-kit-dae" name="dbus" dev="dm-0" ino=20709539 scontext=system_u:system_r:consolekit_t:s0 tcontext=system_u:object_r:system_dbusd_var_lib_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1420137766.133:1053): avc:  denied  { write } for  pid=2586 comm="console-kit-dae" name="dbus" dev="dm-0" ino=20709539 scontext=system_u:system_r:consolekit_t:s0 tcontext=system_u:object_r:system_dbusd_var_lib_t:s0 tclass=dir permissive=0

Comment 1 Daniel Walsh 2015-01-03 13:13:52 UTC
I have no idea why consolekit would attempt to write content in to the /var/lib/dbus directory?

Comment 2 JC 2015-01-05 05:06:18 UTC
I should have captured a lot more information before reporting this. I seem to have corrected it with a wipe and reinstall of Fed21.


Note You need to log in before you can comment on or make changes to this bug.