Bug 1314109 - SELinux is preventing alsactl from 'open' accesses on the file /var/lib/alsa/asound.state.
SELinux is preventing alsactl from 'open' accesses on the file /var/lib/alsa/...
Status: CLOSED NOTABUG
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
23
x86_64 Unspecified
low Severity low
: ---
: ---
Assigned To: Lukas Vrabec
Fedora Extras Quality Assurance
abrt_hash:8ba9f3fc679d97ed1fe77b0f1c3...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-03-02 18:59 EST by ejordon
Modified: 2016-03-03 04:55 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-03-03 04:55:30 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description ejordon 2016-03-02 18:59:17 EST
Description of problem:
I am attempting to get audio to work on a Chromebook Acer CB3-111 running Fedora 23 from the SSD.  I need to stop alsa # sudo killall alsactl
then erase the asound.state file from /var/lib/alsa/asound.state
and replace it with the original asound.state file that was in my Chromebook.  I have done this in the past and after a reboot sound works.  However this time, SE Linux pops up as says it is not allowing access to open asound.state and I need to file a bug report.
SELinux is preventing alsactl from 'open' accesses on the file /var/lib/alsa/asound.state.

*****  Plugin restorecon (99.5 confidence) suggests   ************************

If you want to fix the label. 
/var/lib/alsa/asound.state default label should be alsa_var_lib_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /var/lib/alsa/asound.state

*****  Plugin catchall (1.49 confidence) suggests   **************************

If you believe that alsactl should be allowed open access on the asound.state file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep alsactl /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:alsa_t:s0
Target Context                unconfined_u:object_r:user_home_t:s0
Target Objects                /var/lib/alsa/asound.state [ file ]
Source                        alsactl
Source Path                   alsactl
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-158.7.fc23.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.4.2-301.fc23.x86_64 #1 SMP Tue
                              Feb 23 19:00:38 UTC 2016 x86_64 x86_64
Alert Count                   2
First Seen                    2016-03-02 15:45:59 PST
Last Seen                     2016-03-02 15:51:10 PST
Local ID                      69bf2513-477f-4391-a19f-15d74de8b286

Raw Audit Messages
type=AVC msg=audit(1456962670.513:346): avc:  denied  { open } for  pid=654 comm="alsactl" path="/var/lib/alsa/asound.state" dev="mmcblk0p1" ino=415359 scontext=system_u:system_r:alsa_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0


Hash: alsactl,alsa_t,user_home_t,file,open

Version-Release number of selected component:
selinux-policy-3.13.1-158.7.fc23.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.4.2-301.fc23.x86_64
type:           libreport
Comment 1 Lukas Vrabec 2016-03-03 04:55:30 EST
*****  Plugin restorecon (99.5 confidence) suggests   ************************

If you want to fix the label. 
/var/lib/alsa/asound.state default label should be alsa_var_lib_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /var/lib/alsa/asound.state

This should fix your issue.

Note You need to log in before you can comment on or make changes to this bug.