Description of problem: SELinux is preventing /usr/sbin/upsmon from 'read' accesses on the chr_file random. ***** Plugin catchall_boolean (89.3 confidence) suggests ****************** If you want to allow users to resolve user passwd entries directly from ldap rather then using a sssd server Then you must tell SELinux about this by enabling the 'authlogin_nsswitch_use_ldap' boolean. You can read 'None' man page for more details. Do setsebool -P authlogin_nsswitch_use_ldap 1 ***** Plugin catchall (11.6 confidence) suggests ************************** If you believe that upsmon should be allowed read access on the random chr_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep upsmon /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:nut_upsmon_t:s0 Target Context system_u:object_r:random_device_t:s0 Target Objects random [ chr_file ] Source upsmon Source Path /usr/sbin/upsmon Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM <Unknown> Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.18.3-201.fc21.x86_64 #1 SMP Mon Jan 19 15:59:31 UTC 2015 x86_64 x86_64 Alert Count 541 First Seen 2014-06-18 20:20:20 EEST Last Seen 2015-01-26 23:16:33 EET Local ID 1dc293db-5080-4a78-a46c-9de6706f79c0 Raw Audit Messages type=AVC msg=audit(1422306993.669:124): avc: denied { read } for pid=1717 comm="upsmon" name="random" dev="devtmpfs" ino=1032 scontext=system_u:system_r:nut_upsmon_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file permissive=0 type=SYSCALL msg=audit(1422306993.669:124): arch=x86_64 syscall=open success=no exit=EACCES a0=7fb6eca72299 a1=900 a2=6b5 a3=11f items=0 ppid=1715 pid=1717 auid=4294967295 uid=57 gid=57 euid=57 suid=57 fsuid=57 egid=57 sgid=57 fsgid=57 tty=(none) ses=4294967295 comm=upsmon exe=/usr/sbin/upsmon subj=system_u:system_r:nut_upsmon_t:s0 key=(null) Hash: upsmon,nut_upsmon_t,random_device_t,chr_file,read Additional info: reporter: libreport-2.3.0 hashmarkername: setroubleshoot kernel: 3.18.3-201.fc21.x86_64 type: libreport
commit ca4fb28741fdf9b47418bef9953f73e19fa064f3 Author: Lukas Vrabec <lvrabec> Date: Wed Jan 28 16:01:15 2015 +0100 Allow nut_upsmon_t to read random_device_t. BZ(1186072)
Is it in http://pkgs.fedoraproject.org/cgit/selinux-policy.git/ or someplace else? Because I cannot find that commit.
It's here: https://github.com/selinux-policy/selinux-policy/commit/ca4fb28741fdf9b47418bef9953f73e19fa064f3 Package will be available soon.
Thank you very much!
I installed the packages (3.13.1-105.2) from koji, rebooted the machine, but I'm still seeing these: Feb 2 22:21:38 localhost sedispatch: AVC Message for setroubleshoot, dropping message Feb 2 22:21:38 localhost sedispatch: AVC Message for setroubleshoot, dropping message Feb 2 22:21:38 localhost sedispatch: AVC Message for setroubleshoot, dropping message Feb 2 22:21:38 localhost sedispatch: AVC Message for setroubleshoot, dropping message Feb 2 22:21:38 localhost sedispatch: AVC Message for setroubleshoot, dropping message Feb 2 22:21:38 localhost sedispatch: AVC Message for setroubleshoot, dropping message Feb 2 22:21:38 localhost sedispatch: AVC Message for setroubleshoot, dropping message Feb 2 22:21:38 localhost sedispatch: AVC Message for setroubleshoot, dropping message Feb 2 22:21:38 localhost setroubleshoot: Plugin Exception restorecon_source Feb 2 22:21:38 localhost setroubleshoot: SELinux is preventing /usr/sbin/upsmon from read access on the chr_file urandom. For complete SELinux messages. run sealert -l 9c298592-7379-45e4-855e-a73dda984104 Feb 2 22:21:38 localhost python: SELinux is preventing /usr/sbin/upsmon from read access on the chr_file urandom. ***** Plugin catchall_boolean (47.5 confidence) suggests ****************** If you want to allow users to resolve user passwd entries directly from ldap rather then using a sssd server Then you must tell SELinux about this by enabling the 'authlogin_nsswitch_use_ldap' boolean. You can read 'None' man page for more details. Do setsebool -P authlogin_nsswitch_use_ldap 1 ***** Plugin catchall_boolean (47.5 confidence) suggests ****************** If you want to enable reading of urandom for all domains. Then you must tell SELinux about this by enabling the 'global_ssp' boolean. You can read 'None' man page for more details. Do setsebool -P global_ssp 1 ***** Plugin catchall (6.38 confidence) suggests ************************** If you believe that upsmon should be allowed read access on the urandom chr_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep upsmon /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Do I need to relabel the system or something? One interesting side-effect, after installing the update, my dropbox tray icon is visible again. It used to be a horizontal, black line, see https://alexpl.fedorapeople.org/screenshots/gnome_message_tray.png
HI, I need to see AVC related to this issue. Could you attach /var/log/audit.log file? Thank you!
Created attachment 987537 [details] /var/log/audit/audit.log While "SELinux is preventing /usr/sbin/upsmon from read access on the chr_file urandom" happens every time the system starts, SELinux Troubleshooter pops up only at nights. Is there a setting for this behavior, or is it a bug as well?
OK, upsmon also needs read urandom device. I'll add fix ASAP.
commit 6ed17a9861381497615030b03dfe15f18e9afa02 Author: Lukas Vrabec <lvrabec> Date: Tue Feb 3 15:37:25 2015 +0100 Allow upsmon_t to read urandom device.
selinux-policy-3.13.1-105.3.fc21 has been submitted as an update for Fedora 21. https://admin.fedoraproject.org/updates/selinux-policy-3.13.1-105.3.fc21
All is well now, thanks again! P.S.: Do I need to file another report for this, or is it WIP upstream? Feb 5 16:18:50 localhost kernel: SELinux: Permission audit_read in class capability2 not defined in policy. Feb 5 16:18:50 localhost kernel: SELinux: the above unknown classes and permissions will be allowed
Package selinux-policy-3.13.1-105.3.fc21: * should fix your issue, * was pushed to the Fedora 21 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.13.1-105.3.fc21' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2015-1768/selinux-policy-3.13.1-105.3.fc21 then log in and leave karma (feedback).
selinux-policy-3.13.1-105.3.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.