Bug 1314433 - SELinux is preventing gnome-shell from using the 'signull' accesses on a process.
Summary: SELinux is preventing gnome-shell from using the 'signull' accesses on a proc...
Keywords:
Status: CLOSED EOL
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 24
Hardware: x86_64
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:0c8f99db189740acdc7f54555c4...
: 1315623 1368777 1368861 1381651 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-03-03 15:19 UTC by Joachim Frieben
Modified: 2018-01-25 00:51 UTC (History)
23 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-08-08 13:05:43 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
Gnome Shell (or possibly OS) cannot tell that the battery is fully charged and AC is connected (71.59 KB, image/jpeg)
2016-08-01 21:25 UTC, notadrop
no flags Details

Description Joachim Frieben 2016-03-03 15:19:48 UTC
Description of problem:
SELinux is preventing gnome-shell from using the 'signull' accesses on a process.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that gnome-shell should be allowed signull access on processes labeled unconfined_dbusd_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep gnome-shell /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context                unconfined_u:unconfined_r:unconfined_dbusd_t:s0-s0
                              :c0.c1023
Target Objects                Unknown [ process ]
Source                        gnome-shell
Source Path                   gnome-shell
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-175.fc24.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.5.0-0.rc6.git0.1.fc24.x86_64 #1
                              SMP Mon Feb 29 19:21:53 UTC 2016 x86_64 x86_64
Alert Count                   2
First Seen                    2016-03-03 09:30:48 CET
Last Seen                     2016-03-03 09:30:48 CET
Local ID                      fdcd88f1-d008-44b2-8eb9-4c141f80a95a

Raw Audit Messages
type=AVC msg=audit(1456993848.217:298): avc:  denied  { signull } for  pid=1310 comm="ibus-daemon" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_dbusd_t:s0-s0:c0.c1023 tclass=process permissive=0


Hash: gnome-shell,xdm_t,unconfined_dbusd_t,process,signull

Version-Release number of selected component:
selinux-policy-3.13.1-175.fc24.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.5.0-0.rc6.git0.1.fc24.x86_64
type:           libreport

Comment 1 Lukas Vrabec 2016-03-09 12:15:03 UTC
*** Bug 1315623 has been marked as a duplicate of this bug. ***

Comment 2 notadrop 2016-08-01 21:11:34 UTC
Description of problem:
* I booted Fedora and logged in to a Gnome 3 session (via GDM) after installing the package "powertop.x86_64." 
* This isn't the first time that having powertop installed has led to SELinux violations/error mesages on login.
* Therefore, I am inclined to believe that powertop has caused this bug, but I cannot be 100% certain...
* In the past (within the last two weeks, on Fedora 24) uninstalling powertop caused these SELinux violations to go away, so the presence of the installed package "powertop.x86_64" and these SELinux violations seem to be strongly correlated.
* This particular time, I am getting a different SELinux violation/error than before.
* Going from memory: the previous error message mentioned "mounton" and "uetoothd" and not gnome-shell.
* My guess as to why I am getting a *different* SELinux violation than before: this may be due to the latest updates to selinux and selinux policies, which I installed earlier today (about a half hour ago.) 
* After installing these latest updates ('sudo dnf upgrade') I installed powertop again to see if they'd fixed the SELinux violations that powertop *appears* to be causing.
* I am somewhat active on the Redhat Bugzilla. If you need further information, please feel free to ask me for it.

Version-Release number of selected component:
selinux-policy-3.13.1-191.5.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.6.4-301.fc24.x86_64
type:           libreport

Comment 3 notadrop 2016-08-01 21:25:58 UTC
Created attachment 1186540 [details]
Gnome Shell (or possibly OS) cannot tell that the battery is fully charged and AC is connected

Please see comment number three.

Comment 4 notadrop 2016-08-01 21:27:36 UTC
For clarity's sake, I should've mentioned that I did enable powertop after installing it (and before I rebooted and saw the SELinux error message) by running: 

'sudo systemctl enable powertop'

I have just rebooted again, and I did not get an error message from the SELinux Troubleshooter. However, either Gnome Shell (or the system itself?) aren't able to detect how much charge my battery has left. I am not sure if the lack of an SELinux error, and the battery/power issues are related.

I've attached an image: see the above comment, which should have said "please see comment four."

Comment 5 notadrop 2016-08-01 22:00:30 UTC
I've just rebooted another time. This time, the machine's fully charged battery and connected AC adapter are being detected.

SELinux Troubleshooter notified me about the following problems upon logging into a Gnome 3 session:



SELinux is preventing (uetoothd) from mounton access on the directory /etc.

*****  Plugin catchall_labels (83.8 confidence) suggests   *******************

If you want to allow (uetoothd) to have mounton access on the etc directory
Then you need to change the label on /etc
Do
# semanage fcontext -a -t FILE_TYPE '/etc'
where FILE_TYPE is one of the following: admin_home_t, anon_inodefs_t, audit_spool_t, auditd_log_t, autofs_t, automount_tmp_t, bacula_store_t, binfmt_misc_fs_t, boot_t, capifs_t, cephfs_t, cgroup_t, cifs_t, container_image_t, debugfs_t, default_t, device_t, devpts_t, dnssec_t, dosfs_t, ecryptfs_t, efivarfs_t, fusefs_t, home_root_t, hugetlbfs_t, ifconfig_var_run_t, init_var_run_t, initrc_tmp_t, iso9660_t, kdbusfs_t, mail_spool_t, mnt_t, mqueue_spool_t, named_conf_t, news_spool_t, nfs_t, nfsd_fs_t, onload_fs_t, openshift_tmp_t, openshift_var_lib_t, oracleasmfs_t, proc_t, proc_xen_t, pstore_t, public_content_rw_t, public_content_t, ramfs_t, random_seed_t, removable_t, root_t, rpc_pipefs_t, security_t, spufs_t, src_t, svirt_sandbox_file_t, sysctl_fs_t, sysctl_t, sysfs_t, sysv_t, tmp_t, tmpfs_t, usbfs_t, user_home_dir_t, user_home_t, user_tmp_t, usr_t, var_lib_nfs_t, var_lib_t, var_lock_t, var_log_t, var_run_t, var_t, virt_image_t, virt_var_lib_t, vmblock_t, vxfs_t, xend_var_lib_t, xend_var_run_t, xenfs_t, xenstored_var_lib_t.
Then execute:
restorecon -v '/etc'


*****  Plugin catchall (17.1 confidence) suggests   **************************

If you believe that (uetoothd) should be allowed mounton access on the etc directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c '(uetoothd)' --raw | audit2allow -M my-uetoothd
# semodule -X 300 -i my-uetoothd.pp

Additional Information:
Source Context                system_u:system_r:init_t:s0
Target Context                system_u:object_r:etc_t:s0
Target Objects                /etc [ dir ]
Source                        (uetoothd)
Source Path                   (uetoothd)
Port                          <Unknown>
Host                          vishnu
Source RPM Packages           
Target RPM Packages           filesystem-3.2-37.fc24.x86_64
Policy RPM                    selinux-policy-3.13.1-191.8.fc24.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     vishnu
Platform                      Linux vishnu 4.6.4-301.fc24.x86_64 #1 SMP Tue Jul
                              12 11:50:00 UTC 2016 x86_64 x86_64
Alert Count                   36
First Seen                    2016-07-20 00:19:27 MDT
Last Seen                     2016-08-01 15:56:57 MDT
Local ID                      b8381d75-0b93-4365-a11f-912f364c00cd

Raw Audit Messages
type=AVC msg=audit(1470088617.983:205): avc:  denied  { mounton } for  pid=1589 comm="(uetoothd)" path="/etc" dev="dm-0" ino=1703937 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0


Hash: (uetoothd),init_t,etc_t,dir,mounton

Comment 6 walter.cisco 2016-08-21 11:35:12 UTC
*** Bug 1368777 has been marked as a duplicate of this bug. ***

Comment 7 Damon Hill 2016-08-22 00:35:06 UTC
*** Bug 1368861 has been marked as a duplicate of this bug. ***

Comment 8 A. Lloyd Flanagan 2016-08-22 17:39:49 UTC
Description of problem:
Sorry, this just showed up. No idea how to cause.

Version-Release number of selected component:
selinux-policy-3.13.1-191.10.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.6.6-300.fc24.x86_64
type:           libreport

Comment 9 John Vansteenkiste 2016-09-01 16:37:00 UTC
Description of problem:
Hello,

Sorry for my spell it, because I speak french. I send you report for information. I am beginner in Linux system (Fedora).
I hope that it help you !

John Vansteenkiste
johnvansteenkiste78

Version-Release number of selected component:
selinux-policy-3.13.1-191.13.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.6.7-300.fc24.x86_64
type:           libreport

Comment 10 Riki Syahputra 2016-09-13 00:59:52 UTC
Description of problem:
everytime i start fedora, a popup show tells me this error


Version-Release number of selected component:
selinux-policy-3.13.1-191.13.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 11 Frank Büttner 2016-09-17 18:28:59 UTC
The problem will still occurs of selinux-policy-3.13.1-191.14.fc24.noarch

Comment 12 Lukas Vrabec 2016-09-18 16:42:20 UTC
This is fixed in the latest selinux-policy rpm package.

Comment 13 Joachim Frieben 2016-10-03 15:41:12 UTC
SELinux is preventing gnome-shell from using the signull access on a process.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that gnome-shell should be allowed signull access on processes labeled unconfined_dbusd_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'gnome-shell' --raw | audit2allow -M my-gnomeshell
# semodule -X 300 -i my-gnomeshell.pp

Additional Information:
Source Context                system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context                unconfined_u:unconfined_r:unconfined_dbusd_t:s0-s0
                              :c0.c1023
Target Objects                Unknown [ process ]
Source                        gnome-shell
Source Path                   gnome-shell
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-191.17.fc24.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.7.5-200.fc24.x86_64 #1 SMP Mon Sep
                              26 21:25:47 UTC 2016 x86_64 x86_64
Alert Count                   2
First Seen                    2016-10-03 17:30:38 CEST
Last Seen                     2016-10-03 17:30:38 CEST
Local ID                      3aa3f7a2-342e-4323-8439-296a40cf295f

Raw Audit Messages
type=AVC msg=audit(1475508638.387:170): avc:  denied  { signull } for  pid=1132 comm="ibus-daemon" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_dbusd_t:s0-s0:c0.c1023 tclass=process permissive=0


Hash: gnome-shell,xdm_t,unconfined_dbusd_t,process,signull

Comment 14 enrico ugazio 2016-10-04 16:09:53 UTC
*** Bug 1381651 has been marked as a duplicate of this bug. ***

Comment 15 enrico ugazio 2016-10-05 04:20:13 UTC
Description of problem:
open hotmail and notice in bing

Version-Release number of selected component:
selinux-policy-3.13.1-191.16.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.5-200.fc24.x86_64
type:           libreport

Comment 16 boris 2016-12-02 23:31:19 UTC
Description of problem:
don't now


Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.8.10-200.fc24.x86_64
type:           libreport

Comment 17 Fedora End Of Life 2017-07-25 20:16:54 UTC
This message is a reminder that Fedora 24 is nearing its end of life.
Approximately 2 (two) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 24. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '24'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version'
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not
able to fix it before Fedora 24 is end of life. If you would still like
to see this bug fixed and are able to reproduce it against a later version
of Fedora, you are encouraged  change the 'version' to a later Fedora
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

Comment 18 Fedora End Of Life 2017-08-08 13:05:43 UTC
Fedora 24 changed to end-of-life (EOL) status on 2017-08-08. Fedora 24 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.

Comment 19 iamgoldeneagle 2018-01-25 00:51:52 UTC
Description of problem:
I do not know exactly how the problem occured.  

On Jan 24 2018, While working on the computer settings in an effort to resolve an issue with the screen's pixel refreshment rate. I ran the troubleshooting program and the reported bug was found. 

This computer is running Fedora 24. Due to the old computer components and need for more RAM, I am unable to upgrade to Fedora 25 or 26.

Version-Release number of selected component:
selinux-policy-3.13.1-191.24.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.11.12-100.fc24.x86_64
type:           libreport


Note You need to log in before you can comment on or make changes to this bug.