Bug 1282003 - SELinux is preventing /usr/sbin/apcaccess from 'read' accesses on the file unix.
SELinux is preventing /usr/sbin/apcaccess from 'read' accesses on the file unix.
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
23
x86_64 Unspecified
medium Severity low
: ---
: ---
Assigned To: Vit Mojzis
Fedora Extras Quality Assurance
abrt_hash:94aa760ab4a85398113fa0c4fc7...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-11-13 23:59 EST by Robert Hancock
Modified: 2016-02-07 00:23 EST (History)
7 users (show)

See Also:
Fixed In Version: selinux-policy-3.13.1-158.4.fc23
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-02-07 00:23:58 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Robert Hancock 2015-11-13 23:59:39 EST
Description of problem:
SELinux is preventing /usr/sbin/apcaccess from 'read' accesses on the file unix.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that apcaccess should be allowed read access on the unix file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep apcaccess /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:apcupsd_t:s0
Target Context                system_u:object_r:proc_net_t:s0
Target Objects                unix [ file ]
Source                        apcaccess
Source Path                   /usr/sbin/apcaccess
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           apcupsd-3.14.13-3.fc23.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-154.fc23.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.2.6-300.fc23.x86_64 #1 SMP Tue
                              Nov 10 19:32:21 UTC 2015 x86_64 x86_64
Alert Count                   1
First Seen                    2015-11-13 22:58:54 CST
Last Seen                     2015-11-13 22:58:54 CST
Local ID                      6f8bcf89-6044-4c77-b999-4ceecfa70070

Raw Audit Messages
type=AVC msg=audit(1447477134.719:519): avc:  denied  { read } for  pid=2931 comm="apcaccess" name="unix" dev="proc" ino=4026532047 scontext=system_u:system_r:apcupsd_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file permissive=0


type=SYSCALL msg=audit(1447477134.719:519): arch=x86_64 syscall=access success=no exit=EACCES a0=7ffdc21166f0 a1=4 a2=7ffdc21166fe a3=3500 items=0 ppid=2929 pid=2931 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=apcaccess exe=/usr/sbin/apcaccess subj=system_u:system_r:apcupsd_t:s0 key=(null)

Hash: apcaccess,apcupsd_t,proc_net_t,file,read

Version-Release number of selected component:
selinux-policy-3.13.1-154.fc23.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.6-300.fc23.x86_64
type:           libreport
Comment 1 Vit Mojzis 2015-12-17 10:42:38 EST
Could you please try if you get any other AVC? (I was unable to reproduce the issue - the reported AVC doesn't show up without ups connected)?
Reproducing the issue with SELinux in permissive mode will show us all the permission apcaccess needs. Plese try the following>

#setenforce 0
<reproduce the issue>
#ausearch -m avc -ts recent
#setenforce 1
Comment 2 Robert Hancock 2015-12-28 17:52:16 EST
The problem doesn't seem reproducible on command, I think this only happened once. Not sure why - maybe some kind of timing-related issue?
Comment 3 Daniel Walsh 2016-01-02 07:34:22 EST
This will only happen when the service is started via the init system, running it directly would result in the program running as unconfined_t, so it would be allowed.

This access should be just allowed.
Comment 4 Miroslav Grepl 2016-01-21 08:00:07 EST
Yes, it makes sense to allow it.
Comment 5 Lukas Vrabec 2016-01-25 10:17:45 EST
commit b54d2c98b12a9ac90c0970e4ed98ce258fbee434
Author: Lukas Vrabec <lvrabec@redhat.com>
Date:   Mon Jan 25 16:16:32 2016 +0100

    Allow apcupsd to read kernel network state. BZ(1282003)
Comment 6 Fedora Update System 2016-02-03 07:01:56 EST
selinux-policy-3.13.1-158.4.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-2aa7777f21
Comment 7 Fedora Update System 2016-02-03 17:59:58 EST
selinux-policy-3.13.1-158.4.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-2aa7777f21
Comment 8 Fedora Update System 2016-02-07 00:23:30 EST
selinux-policy-3.13.1-158.4.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.