Description of problem: SELinux is preventing ibus-x11 from 'connectto' accesses on the unix_stream_socket @/tmp/dbus-xWGLPDBLvH. ***** Plugin catchall (100. confidence) suggests ************************** If cree que de manera predeterminada, ibus-x11 debería permitir acceso connectto sobre dbus-xWGLPDBLvH unix_stream_socket. Then debería reportar esto como un error. Puede generar un módulo de política local para permitir este acceso. Do permita el acceso momentáneamente executando: # grep ibus-x11 /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context unconfined_u:unconfined_r:unconfined_dbusd_t:s0-s0 :c0.c1023 Target Objects @/tmp/dbus-xWGLPDBLvH [ unix_stream_socket ] Source ibus-x11 Source Path ibus-x11 Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-105.13.fc21.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.19.5-200.fc21.x86_64 #1 SMP Mon Apr 20 19:51:56 UTC 2015 x86_64 x86_64 Alert Count 1 First Seen 2015-05-14 07:15:48 VET Last Seen 2015-05-14 07:15:48 VET Local ID ccc56742-9c3d-49c9-9139-491799581956 Raw Audit Messages type=AVC msg=audit(1431603948.614:424): avc: denied { connectto } for pid=1640 comm="ibus-x11" path=002F746D702F646275732D7857474C5044424C7648 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_dbusd_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=0 Hash: ibus-x11,xdm_t,unconfined_dbusd_t,unix_stream_socket,connectto Version-Release number of selected component: selinux-policy-3.13.1-105.13.fc21.noarch Additional info: reporter: libreport-2.5.1 hashmarkername: setroubleshoot kernel: 4.0.4-301.fc22.x86_64 type: libreport Potential duplicate: bug 1054407
commit 2e37bec53a953c5aa0220609debf6086ab32d108 Author: Miroslav Grepl <mgrepl> Date: Tue Jun 2 17:09:29 2015 +0200 Allow ibus-x11 running as xdm_t to connect uder session buses. We already allow to connect to userdomains over unix_stream_socket. BZ(1054407)
selinux-policy-3.13.1-128.1.fc22 has been submitted as an update for Fedora 22. https://admin.fedoraproject.org/updates/selinux-policy-3.13.1-128.1.fc22
Package selinux-policy-3.13.1-128.1.fc22: * should fix your issue, * was pushed to the Fedora 22 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.13.1-128.1.fc22' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2015-9714/selinux-policy-3.13.1-128.1.fc22 then log in and leave karma (feedback).
selinux-policy-3.13.1-128.1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Description of problem: Just booted FC22. The FC22 has been upgraded from clean install of FC21 using fedup. Version-Release number of selected component: selinux-policy-3.13.1-105.13.fc21.noarch Additional info: reporter: libreport-2.5.1 hashmarkername: setroubleshoot kernel: 4.0.4-202.fc21.x86_64 type: libreport
The issue persists. rpm -q selinux-policy selinux-policy-3.13.1-122.fc22.noarch Should you need additional information please let me know.
$ audit2allow -i avc #============= xdm_t ============== #!!!! This avc is allowed in the current policy allow xdm_t unconfined_dbusd_t:unix_stream_socket connectto; lvrabec:~ $ rpm -q selinux-policy selinux-policy-3.13.1-128.8.fc22.noarch
You're right, I overlooked the target version.