Bug 1246246 - SELinux is preventing gnome-shell from 'ioctl' accesses on the chr_file /dev/nvidiactl.
Summary: SELinux is preventing gnome-shell from 'ioctl' accesses on the chr_file /dev/...
Keywords:
Status: CLOSED INSUFFICIENT_DATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 22
Hardware: x86_64
OS: Unspecified
low
low
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:0badc8ce156df9558d68e5466dc...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-07-23 19:12 UTC by autarch princeps
Modified: 2016-05-18 16:33 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-04-19 17:07:06 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description autarch princeps 2015-07-23 19:12:45 UTC
Description of problem:
SELinux is preventing gnome-shell from 'ioctl' accesses on the chr_file /dev/nvidiactl.

*****  Plugin restorecon (90.5 confidence) suggests   ************************

If sie die Kennzeichnung korrigieren möchten.
/dev/nvidiactl Standard-Kennzeichnung sollte xserver_misc_device_t sein.
Then sie können restorecon ausführen.
Do
# /sbin/restorecon -v /dev/nvidiactl

*****  Plugin device (9.50 confidence) suggests   ****************************

If you want to allow gnome-shell to have ioctl access on the nvidiactl chr_file
Then sie müssen die Kennzeichnung von /dev/nvidiactl auf einen Typ eines ähnlichen Elementes ändern
Do
# semanage fcontext -a -t SIMILAR_TYPE '/dev/nvidiactl'
# restorecon -v '/dev/nvidiactl'

*****  Plugin catchall (1.40 confidence) suggests   **************************

If sie denken, dass es gnome-shell standardmässig erlaubt sein sollte, ioctl Zugriff auf nvidiactl chr_file zu erhalten.
Then sie sollten dies als Fehler melden.
Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen.
Do
zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen:
# grep gnome-shell /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context                system_u:object_r:device_t:s0
Target Objects                /dev/nvidiactl [ chr_file ]
Source                        gnome-shell
Source Path                   gnome-shell
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-128.6.fc22.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 4.1.2-200.fc22.x86_64 #1 SMP Wed
                              Jul 15 20:12:12 UTC 2015 x86_64 x86_64
Alert Count                   6
First Seen                    2015-07-23 21:11:36 CEST
Last Seen                     2015-07-23 21:12:00 CEST
Local ID                      4b8be87c-f8f2-4d06-923a-0fc8777c2e31

Raw Audit Messages
type=AVC msg=audit(1437678720.3:598): avc:  denied  { ioctl } for  pid=1865 comm="gnome-shell" path="/dev/nvidiactl" dev="devtmpfs" ino=30014 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1


Hash: gnome-shell,xdm_t,device_t,chr_file,ioctl

Version-Release number of selected component:
selinux-policy-3.13.1-128.6.fc22.noarch

Additional info:
reporter:       libreport-2.6.1
hashmarkername: setroubleshoot
kernel:         4.1.2-200.fc22.x86_64
type:           libreport

Comment 1 Willie 2015-11-05 15:51:42 UTC
Description of problem:
I got the Selinux alert as soon as I logged in

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.2.3-200.fc22.x86_64
type:           libreport

Comment 2 Miroslav Grepl 2015-11-10 09:35:39 UTC
How is /dev/nvidiactl labeled now?

ls -Z /dev/nvidiactl

Comment 3 AvatarSmith 2016-05-18 16:33:52 UTC
Description of problem:
Using Nvidia proprietary (970 is not supported by nouveau)
NVIDIA-Linux-x86_64-358.16.run

Version-Release number of selected component:
selinux-policy-3.13.1-128.21.fc22.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.4.6-201.fc22.x86_64
type:           libreport


Note You need to log in before you can comment on or make changes to this bug.