Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: Start Forticlientsslvpn plugin This plugin is a new plugin in NetworkManager in F23. You can configure it, but as soon as you start it selinux complains about editing the config file. 3a7a0e22-f543-46e6-b84a-c298978c75cd is the VPN config UUID according to 'nmcli c' The Forticlientsslvpn plugin for NetworkManager is new in Fedora23 It should be allowed to create configs. 3a7a0e22-f543-46e6-b84a-c298978c75cd is it's own definition according to 'nmcli c' SELinux is preventing nm-fortisslvpn- from 'create' accesses on the file 3a7a0e22-f543-46e6-b84a-c298978c75cd.config.V9C05X. ***** Plugin catchall_labels (83.8 confidence) suggests ******************* If you want to allow nm-fortisslvpn- to have create access on the 3a7a0e22-f543-46e6-b84a-c298978c75cd.config.V9C05X file Then you need to change the label on 3a7a0e22-f543-46e6-b84a-c298978c75cd.config.V9C05X Do # semanage fcontext -a -t FILE_TYPE '3a7a0e22-f543-46e6-b84a-c298978c75cd.config.V9C05X' where FILE_TYPE is one of the following: NetworkManager_etc_rw_t, NetworkManager_log_t, NetworkManager_tmp_t, NetworkManager_var_lib_t, NetworkManager_var_run_t, hostname_etc_t, named_cache_t, net_conf_t, pppd_var_run_t, systemd_passwd_var_run_t. Then execute: restorecon -v '3a7a0e22-f543-46e6-b84a-c298978c75cd.config.V9C05X' ***** Plugin catchall (17.1 confidence) suggests ************************** If you believe that nm-fortisslvpn- should be allowed create access on the 3a7a0e22-f543-46e6-b84a-c298978c75cd.config.V9C05X file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep nm-fortisslvpn- /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:NetworkManager_t:s0 Target Context system_u:object_r:var_lib_t:s0 Target Objects 3a7a0e22-f543-46e6-b84a-c298978c75cd.config.V9C05X [ file ] Source nm-fortisslvpn- Source Path nm-fortisslvpn- Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-147.fc23.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.2.3-300.fc23.x86_64 #1 SMP Mon Oct 5 15:42:54 UTC 2015 x86_64 x86_64 Alert Count 2 First Seen 2015-10-07 09:05:13 SAST Last Seen 2015-10-09 11:19:09 SAST Local ID a3d0ce28-3372-4c4f-949f-d946af57c828 Raw Audit Messages type=AVC msg=audit(1444382349.413:573): avc: denied { create } for pid=3624 comm="nm-fortisslvpn-" name="3a7a0e22-f543-46e6-b84a-c298978c75cd.config.V9C05X" scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=file permissive=0 Hash: nm-fortisslvpn-,NetworkManager_t,var_lib_t,file,create Version-Release number of selected component: selinux-policy-3.13.1-147.fc23.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.2.3-300.fc23.x86_64 type: libreport
Also needs: read,write,open,rename In addition 'openfortivpn' needs getattr.
Fixed. commit 6e2d5db1e034cca0496d2e676ea6a811ece0aef1 Author: Lukas Vrabec <lvrabec> Date: Fri Oct 9 12:21:14 2015 +0200 Allow networkmanager to create networkmanager_var_lib_t files. BZ(1270201)
selinux-policy-3.13.1-150.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-f4305656a5
selinux-policy-3.13.1-150.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with $ su -c 'dnf --enablerepo=updates-testing update selinux-policy' You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-f4305656a5
I still got: Oct 12 08:01:08 sieve-deschouwer-co-za audit[10349]: AVC avc: denied { read write } for pid=10349 comm="openfortivpn" name="ptmx" dev="devtmpfs" ino=1122 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:ptmx_t:s0 tclass=chr_file permissive=0 I added that policy, but I still get: NetworkManager[1429]: ERROR: forkpty: Permission denied but no AVC log.
selinux-policy-3.13.1-150.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
error still exist forkpty: Permission denied selinux-ploicy: 158.11.fc23
This is still a problem in Fedora 24 Beta. selinux-policy-3.13.1-185.fc24 However, now we have slightly different info: it fails on {ioctl} for path="socket:[pid]". When I enabled *that*, it works. I can now add the correct rule using semodule, and I can then run fortisslvpn without first turning off SELinux. I don't know if the path change is better selinux reporting or a change to NetworkManager, but at least this works. I'm adding a F24 sealert.
Created attachment 1159790 [details] sealert for fortisslvpn on f24 More information on SELinux policy violations by fortisslvpn
Berend, Please open BZ for this issue.
BZ=new bugzilla?
yes
created #1337916