Bug 1470568 - SELinux is preventing geoclue from 'search' accesses on the directory 22494.
SELinux is preventing geoclue from 'search' accesses on the directory 22494.
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Lukas Vrabec
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2017-07-13 04:47 EDT by cat
Modified: 2017-11-10 12:45 EST (History)
10 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description cat 2017-07-13 04:47:40 EDT
Description of problem:
SELinux is preventing geoclue from 'search' accesses on the directory 22494.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that geoclue should be allowed search access on the 22494 directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
allow this access for now by executing:
# ausearch -c 'geoclue' --raw | audit2allow -M my-geoclue
# semodule -X 300 -i my-geoclue.pp

Additional Information:
Source Context                system_u:system_r:geoclue_t:s0
Target Context                system_u:system_r:unconfined_service_t:s0
Target Objects                22494 [ dir ]
Source                        geoclue
Source Path                   geoclue
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-259.fc26.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.11.8-300.fc26.x86_64 #1 SMP Thu
                              Jun 29 20:09:48 UTC 2017 x86_64 x86_64
Alert Count                   1
First Seen                    2017-07-13 16:46:48 +08
Last Seen                     2017-07-13 16:46:48 +08
Local ID                      a078779c-f3e6-4986-b0c5-2b0901e07d0b

Raw Audit Messages
type=AVC msg=audit(1499935608.285:510): avc:  denied  { search } for  pid=1380 comm="geoclue" name="22494" dev="proc" ino=736466 scontext=system_u:system_r:geoclue_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=dir permissive=0

Hash: geoclue,geoclue_t,unconfined_service_t,dir,search

Version-Release number of selected component:

Additional info:
component:      selinux-policy
reporter:       libreport-2.9.1
hashmarkername: setroubleshoot
kernel:         4.11.8-300.fc26.x86_64
type:           libreport

Potential duplicate: bug 1358558
Comment 2 Lukas Vrabec 2017-08-31 07:37:31 EDT
Hi Could you attach output of: 

# ps -efZ | grep unconfined_service_t 

Comment 3 cat 2017-09-03 03:15:18 EDT
No output beside grep itself.
Comment 4 Daniel Walsh 2017-09-03 05:58:28 EDT
Must have been temporarily running, I have no problem allowing or dontauditing this app search thing /proc for all domains.

Note You need to log in before you can comment on or make changes to this bug.