Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: Trying to connect to bluetooth network SELinux is preventing bluetoothd from 'connect' accesses on the сокет Unknown. ***** Plugin catchall (100. confidence) suggests ************************** If if you believe that bluetoothd should be allowed connect access on the Unknown socket by default. Then рекомендуется создать отчет об ошибке. Чтобы разрешить доступ, можно создать локальный модуль политики. Do allow this access for now by executing: # ausearch -c 'bluetoothd' --raw | audit2allow -M my-bluetoothd # semodule -X 300 -i my-bluetoothd.pp Additional Information: Source Context system_u:system_r:init_t:s0 Target Context system_u:system_r:init_t:s0 Target Objects Unknown [ socket ] Source bluetoothd Source Path bluetoothd Port <Неизвестно> Host (removed) Source RPM Packages Target RPM Packages Policy RPM <Неизвестно> Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.14.0-0.rc1.git3.1.fc28.x86_64 #1 SMP Thu Sep 21 15:10:18 UTC 2017 x86_64 x86_64 Alert Count 2 First Seen 2017-09-24 21:12:22 +07 Last Seen 2017-09-24 21:12:26 +07 Local ID 0e2ed1ae-b88e-4100-83eb-5cbea2092af8 Raw Audit Messages type=AVC msg=audit(1506262346.206:264): avc: denied { connect } for pid=735 comm="bluetoothd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=0 Hash: bluetoothd,init_t,init_t,socket,connect Additional info: component: selinux-policy reporter: libreport-2.9.2 hashmarkername: setroubleshoot kernel: 4.14.0-0.rc1.git3.1.fc28.x86_64 type: libreport
type=AVC msg=audit(1506257629.105:111): avc: denied { open } for pid=1109 comm="bluetoothd" path="/var/lib/bluetooth/10:4A:7D:24:27:FE/settings" dev="dm-1" ino=2491322 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:bluetooth_var_lib_t:s0 tclass=file permissive=1 type=AVC msg=audit(1506257629.106:112): avc: denied { getopt } for pid=1109 comm="bluetoothd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257629.106:113): avc: denied { read } for pid=1109 comm="bluetoothd" name="10:4A:7D:24:27:FE" dev="dm-1" ino=2493011 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:bluetooth_var_lib_t:s0 tclass=dir permissive=1 type=AVC msg=audit(1506257629.149:115): avc: denied { read } for pid=1109 comm="bluetoothd" path="socket:[23460]" dev="sockfs" ino=23460 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257629.149:116): avc: denied { write } for pid=1109 comm="bluetoothd" path="socket:[23460]" dev="sockfs" ino=23460 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257629.640:138): avc: denied { write } for pid=1109 comm="bluetoothd" path="socket:[23460]" dev="sockfs" ino=23460 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257629.643:139): avc: denied { read } for pid=1109 comm="bluetoothd" path="socket:[23460]" dev="sockfs" ino=23460 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=SELINUX_ERR msg=audit(1506257739.575:97): op=security_bounded_transition seresult=denied oldcontext=system_u:system_r:init_t:s0 newcontext=system_u:system_r:bluetooth_t:s0 type=AVC msg=audit(1506257739.577:98): avc: denied { map } for pid=1129 comm="bluetoothd" path="/usr/libexec/bluetooth/bluetoothd" dev="dm-1" ino=2821629 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:bluetooth_exec_t:s0 tclass=file permissive=1 type=AVC msg=audit(1506257739.584:99): avc: denied { create } for pid=1129 comm="bluetoothd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257739.584:100): avc: denied { bind } for pid=1129 comm="bluetoothd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257739.585:101): avc: denied { write } for pid=1129 comm="bluetoothd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257739.625:102): avc: denied { getattr } for pid=1129 comm="bluetoothd" path="socket:[29784]" dev="sockfs" ino=29784 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257739.626:103): avc: denied { listen } for pid=1129 comm="bluetoothd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257739.628:105): avc: denied { module_request } for pid=1129 comm="bluetoothd" kmod="bt-proto-4" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=1 type=AVC msg=audit(1506257739.639:111): avc: denied { read } for pid=1129 comm="bluetoothd" path="socket:[29784]" dev="sockfs" ino=29784 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257739.639:112): avc: denied { setopt } for pid=1129 comm="bluetoothd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257739.642:113): avc: denied { getattr } for pid=1129 comm="bluetoothd" path="/var/lib/bluetooth/10:4A:7D:24:27:FE/settings" dev="dm-1" ino=2491322 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:bluetooth_var_lib_t:s0 tclass=file permissive=1 type=AVC msg=audit(1506257739.642:114): avc: denied { read } for pid=1129 comm="bluetoothd" name="settings" dev="dm-1" ino=2491322 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:bluetooth_var_lib_t:s0 tclass=file permissive=1 type=AVC msg=audit(1506257739.643:115): avc: denied { open } for pid=1129 comm="bluetoothd" path="/var/lib/bluetooth/10:4A:7D:24:27:FE/settings" dev="dm-1" ino=2491322 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:bluetooth_var_lib_t:s0 tclass=file permissive=1 type=AVC msg=audit(1506257739.643:116): avc: denied { getopt } for pid=1129 comm="bluetoothd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257739.643:117): avc: denied { read } for pid=1129 comm="bluetoothd" name="10:4A:7D:24:27:FE" dev="dm-1" ino=2493011 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:bluetooth_var_lib_t:s0 tclass=dir permissive=1 type=AVC msg=audit(1506257739.936:135): avc: denied { write } for pid=1129 comm="bluetoothd" path="socket:[29784]" dev="sockfs" ino=29784 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257739.938:136): avc: denied { read } for pid=1129 comm="bluetoothd" path="socket:[29784]" dev="sockfs" ino=29784 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257757.685:279): avc: denied { create } for pid=1129 comm="bluetoothd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257757.685:280): avc: denied { bind } for pid=1129 comm="bluetoothd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257757.685:281): avc: denied { getopt } for pid=1129 comm="bluetoothd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257757.685:282): avc: denied { setopt } for pid=1129 comm="bluetoothd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257757.685:283): avc: denied { getattr } for pid=1129 comm="bluetoothd" path="socket:[36506]" dev="sockfs" ino=36506 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257757.685:284): avc: denied { listen } for pid=1129 comm="bluetoothd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257757.686:285): avc: denied { write } for pid=1129 comm="bluetoothd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1 type=AVC msg=audit(1506257757.686:286): avc: denied { module_request } for pid=1129 comm="bluetoothd" kmod="bt-proto-3" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=1 type=AVC msg=audit(1506257757.700:287): avc: denied { read } for pid=1129 comm="bluetoothd" path="socket:[29784]" dev="sockfs" ino=29784 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=socket permissive=1
require { type bluetooth_var_lib_t; type init_t; type bluetooth_exec_t; class file { getattr map open read }; class socket { bind create getattr getopt listen read setopt write }; class dir read; } #============= init_t ============== #!!!! This avc is allowed in the current policy allow init_t bluetooth_exec_t:file map; #!!!! This avc is allowed in the current policy allow init_t bluetooth_var_lib_t:dir read; #!!!! This avc is allowed in the current policy allow init_t bluetooth_var_lib_t:file { getattr open read }; #!!!! This avc is allowed in the current policy allow init_t self:socket { bind create getattr getopt listen read setopt write }; kernel_request_load_module(init_t)
Are these BZ created automatically ? I hit the same issue but I created a temporary policy for that.
*** This bug has been marked as a duplicate of bug 1496249 ***