Bug 1275006 - SELinux is preventing acpid from 'create' accesses on the netlink_generic_socket Unknown.
SELinux is preventing acpid from 'create' accesses on the netlink_generic_soc...
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
22
x86_64 Unspecified
medium Severity medium
: ---
: ---
Assigned To: Vit Mojzis
Fedora Extras Quality Assurance
abrt_hash:5a46cae105d5aaa6ed19234a07d...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-10-24 15:45 EDT by Justin W. Flory
Modified: 2016-05-10 13:57 EDT (History)
13 users (show)

See Also:
Fixed In Version: selinux-policy-3.13.1-128.22.fc22 selinux-policy-3.13.1-128.28.fc22
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-05-10 13:57:45 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Justin W. Flory 2015-10-24 15:45:29 EDT
Description of problem:
I was running kernel regression tests on my system - I was away from keyboard during tests and saw this error when I returned.
SELinux is preventing acpid from 'create' accesses on the netlink_generic_socket Unknown.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that acpid should be allowed create access on the Unknown netlink_generic_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep acpid /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:apmd_t:s0
Target Context                system_u:system_r:apmd_t:s0
Target Objects                Unknown [ netlink_generic_socket ]
Source                        acpid
Source Path                   acpid
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-128.16.fc22.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.2.3-200.fc22.x86_64 #1 SMP Thu
                              Oct 8 03:23:55 UTC 2015 x86_64 x86_64
Alert Count                   2
First Seen                    2015-10-23 20:44:51 EDT
Last Seen                     2015-10-24 15:34:57 EDT
Local ID                      20f15fff-2714-45ea-bfcd-1db07e6492d3

Raw Audit Messages
type=AVC msg=audit(1445715297.920:525): avc:  denied  { create } for  pid=1705 comm="acpid" scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:apmd_t:s0 tclass=netlink_generic_socket permissive=0


Hash: acpid,apmd_t,apmd_t,netlink_generic_socket,create

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.2.3-200.fc22.x86_64
type:           libreport
Comment 1 Justin W. Flory 2015-10-24 16:37:32 EDT
Description of problem:
I was running kernel regression tests and left my keyboard - when I returned, I saw these errors.

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.2.3-200.fc22.x86_64
type:           libreport
Comment 2 Ting-Wei Lan 2015-11-03 02:27:53 EST
Description of problem:
I log in to GNOME session from GDM.

Version-Release number of selected component:
selinux-policy-3.13.1-128.18.fc22.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.3-200.fc22.x86_64
type:           libreport
Comment 3 nealzimm 2015-11-07 09:41:38 EST
Description of problem:
Added battery backup, now on startup the selinux generates an alert

Version-Release number of selected component:
selinux-policy-3.13.1-128.18.fc22.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.5-201.fc22.x86_64
type:           libreport
Comment 4 spochybo 2015-11-15 06:16:30 EST
Description of problem:
My power managment cannot be started, and I cannot alter the startup and shutdown services. It says it cannot contact KDED. It is happening since last update on 14th Nov 2015. Also, I cannot control volume with multimedia keys.

Version-Release number of selected component:
selinux-policy-3.13.1-128.18.fc22.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.5-201.fc22.x86_64
type:           libreport
Comment 5 nealzimm 2015-11-15 09:37:34 EST
Description of problem:
It happens infrequently on startup.

Version-Release number of selected component:
selinux-policy-3.13.1-128.18.fc22.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.5-201.fc22.x86_64
type:           libreport
Comment 6 Justin W. Flory 2015-11-15 12:16:18 EST
Description of problem:
I was tagging music in MusicBrainz Picard, which is adding metadata tags to my music in /home/user/Music/.

Version-Release number of selected component:
selinux-policy-3.13.1-128.19.fc22.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.5-201.fc22.x86_64
type:           libreport
Comment 7 Vit Mojzis 2015-11-26 08:25:36 EST
https://github.com/fedora-selinux/selinux-policy/pull/73

commit 74bf8205ecb31af47ff51754a3f16c11c09c9b1a
Author: Miroslav Grepl <mgrepl@redhat.com>
Date:   Thu Oct 1 16:08:40 2015 +0200

Allow acpid to attempt to connect to the Linux kernel via generic netlink socket.
Comment 8 Joel Uckelman 2015-11-27 05:20:36 EST
Description of problem:
This denail happend on booting.

Version-Release number of selected component:
selinux-policy-3.13.1-128.18.fc22.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.5-201.fc22.x86_64
type:           libreport
Comment 9 Fedora Update System 2015-12-09 08:56:18 EST
selinux-policy-3.13.1-128.22.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-8083abc683
Comment 10 Fedora Update System 2015-12-09 18:22:55 EST
selinux-policy-3.13.1-128.22.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'dnf --enablerepo=updates-testing update selinux-policy'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-8083abc683
Comment 11 Frank Büttner 2015-12-13 05:19:01 EST
Description of problem:
Run bareos backup software

Version-Release number of selected component:
selinux-policy-3.13.1-128.21.fc22.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.6-201.fc22.x86_64
type:           libreport
Comment 12 Lukas Vrabec 2015-12-14 06:10:45 EST
Frank, 
Please check comment 10. 

Thank you.
Comment 13 Frank Büttner 2015-12-14 10:02:03 EST
The last version of testing is:
selinux-policy   3.13.1-128.22.fc22 
selinux-policy-3.13.1-128.21.fc22.noarch was installed  at comment 11.
So I have try  3.13.1-128.22.fc22 an will report the result after next bacula/bareos run at the weekend.
But as far I can see, selinux-policy-3.13.1-128.21.fc22 don't fix it.
Comment 14 Frank Büttner 2015-12-20 12:57:32 EST
With 3.13.1-128.22.fc22 it don't happens again.
Comment 15 nealzimm 2016-01-10 13:10:13 EST
Description of problem:
Started the Virtual Machine Manager

Version-Release number of selected component:
selinux-policy-3.13.1-128.21.fc22.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.8-200.fc22.x86_64
type:           libreport
Comment 16 Fedora Update System 2016-01-18 08:20:51 EST
selinux-policy-3.13.1-128.25.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2016-825869e1a4
Comment 17 morgan read 2016-01-18 12:40:48 EST
Description of problem:
something happened when I wasn't looking

Version-Release number of selected component:
selinux-policy-3.13.1-128.21.fc22.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.8-200.fc22.x86_64
type:           libreport
Comment 18 Fedora Update System 2016-01-19 22:53:59 EST
selinux-policy-3.13.1-128.25.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-825869e1a4
Comment 19 Fedora Update System 2016-02-15 12:47:54 EST
selinux-policy-3.13.1-128.27.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2016-ce419c9cab
Comment 20 Fedora Update System 2016-02-17 01:26:45 EST
selinux-policy-3.13.1-128.27.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-ce419c9cab
Comment 21 Fedora Update System 2016-02-18 07:28:56 EST
selinux-policy-3.13.1-128.28.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2016-ce419c9cab
Comment 22 Fedora Update System 2016-02-21 13:29:37 EST
selinux-policy-3.13.1-128.28.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-ce419c9cab
Comment 23 Fedora Update System 2016-05-10 13:56:22 EDT
selinux-policy-3.13.1-128.28.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.