Bug 1562382 - SELinux is preventing tlp from 'write' accesses on the Datei lock_tlp.
Summary: SELinux is preventing tlp from 'write' accesses on the Datei lock_tlp.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 28
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:0fe6c4e97436995837796a159e9...
: 1609576 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-03-30 12:55 UTC by Heiko Adams
Modified: 2018-11-07 13:23 UTC (History)
20 users (show)

Fixed In Version: selinux-policy-3.14.1-36.fc28
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-07-29 03:24:23 UTC
Type: ---


Attachments (Terms of Use)

Description Heiko Adams 2018-03-30 12:55:08 UTC
Description of problem:
SELinux is preventing tlp from 'write' accesses on the Datei lock_tlp.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that tlp should be allowed write access on the lock_tlp file by default.
Then sie sollten dies als Fehler melden.
Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen.
Do
allow this access for now by executing:
# ausearch -c 'tlp' --raw | audit2allow -M my-tlp
# semodule -X 300 -i my-tlp.pp

Additional Information:
Source Context                system_u:system_r:tlp_t:s0
Target Context                system_u:object_r:var_run_t:s0
Target Objects                lock_tlp [ file ]
Source                        tlp
Source Path                   tlp
Port                          <Unbekannt>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.14.1-18.fc28.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.16.0-0.rc6.git0.2.fc28.x86_64 #1
                              SMP Mon Mar 19 17:05:43 UTC 2018 x86_64 x86_64
Alert Count                   4
First Seen                    2018-03-30 12:21:11 CEST
Last Seen                     2018-03-30 13:58:43 CEST
Local ID                      e9990398-625a-456d-a9db-325a19a9c678

Raw Audit Messages
type=AVC msg=audit(1522411123.593:270): avc:  denied  { write } for  pid=5476 comm="tlp" name="lock_tlp" dev="tmpfs" ino=32986 scontext=system_u:system_r:tlp_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0


Hash: tlp,tlp_t,var_run_t,file,write

Version-Release number of selected component:
selinux-policy-3.14.1-18.fc28.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.9.4
hashmarkername: setroubleshoot
kernel:         4.16.0-0.rc6.git0.2.fc28.x86_64
type:           libreport

Potential duplicate: bug 1510249

Comment 1 Lukas Vrabec 2018-04-08 18:52:51 UTC
Hi, 

Please update selinux-policy package, it should fix our issue. 

THanks,
Lukas.

Comment 2 Flo H. 2018-05-24 02:53:37 UTC
Description of problem:
Happens upon login to Gnome

Version-Release number of selected component:
selinux-policy-3.14.1-24.fc28.noarch

Additional info:
reporter:       libreport-2.9.5
hashmarkername: setroubleshoot
kernel:         4.16.9-300.fc28.x86_64
type:           libreport

Comment 3 saif1988 2018-06-12 16:28:14 UTC
Description of problem:
On Fedora 28 KDE login, battery management app tlp not allowed to write 

Version-Release number of selected component:
selinux-policy-3.14.1-32.fc28.noarch

Additional info:
reporter:       libreport-2.9.5
hashmarkername: setroubleshoot
kernel:         4.16.14-300.fc28.x86_64
type:           libreport

Comment 4 Frank Büttner 2018-06-16 19:49:31 UTC
Description of problem:
Boot the system.

Version-Release number of selected component:
selinux-policy-3.14.1-32.fc28.noarch

Additional info:
reporter:       libreport-2.9.5
hashmarkername: setroubleshoot
kernel:         4.17.0
type:           libreport

Comment 5 Frank Büttner 2018-06-18 18:17:28 UTC
selinux-policy-3.14.1-32.fc28.noarch will have the same problem, so in which version will it fixed?

Comment 6 seb 2018-07-01 12:32:51 UTC
Not solved in selinux-policy-3.14.1-32.fc28.noarch

Comment 7 Martijn Kruiten 2018-07-17 11:19:42 UTC
Description of problem:
restorecon -Rv /var/tlp does not help

Version-Release number of selected component:
selinux-policy-3.14.1-32.fc28.noarch

Additional info:
reporter:       libreport-2.9.5
hashmarkername: setroubleshoot
kernel:         4.17.5-200.fc28.x86_64
type:           libreport

Comment 8 mihael.sedmak 2018-07-25 10:31:26 UTC
Description of problem:
Normal operations.
WOrking in Chrome, IntelliJ IDEA.

Version-Release number of selected component:
selinux-policy-3.14.1-32.fc28.noarch

Additional info:
reporter:       libreport-2.9.5
hashmarkername: setroubleshoot
kernel:         4.17.7-200.fc28.x86_64
type:           libreport

Comment 9 Arsalan Rezazadeh 2018-07-25 12:51:47 UTC
Description of problem:
each time it's notified with Selinux

Version-Release number of selected component:
selinux-policy-3.14.1-32.fc28.noarch

Additional info:
reporter:       libreport-2.9.5
hashmarkername: setroubleshoot
kernel:         4.17.7-200.fc28.x86_64
type:           libreport

Comment 10 Fedora Update System 2018-07-25 22:30:27 UTC
selinux-policy-3.14.1-36.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-1050fb248b

Comment 11 Fedora Update System 2018-07-26 16:32:34 UTC
selinux-policy-3.14.1-36.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-1050fb248b

Comment 12 Fedora Update System 2018-07-29 03:24:23 UTC
selinux-policy-3.14.1-36.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.

Comment 13 Arsalan Rezazadeh 2018-07-29 18:41:55 UTC
*** Bug 1609576 has been marked as a duplicate of this bug. ***

Comment 14 John Gardner 2018-08-02 16:48:52 UTC
Description of problem:
Running on Dell XPS 9560, I didn't really do actually anything.  I booted up as usual, plugged in a USB HD, ejected the HD and then the SELinux alert appear a good few minutes after this... Long enough for me to assume that the HD removal was not linked.

Version-Release number of selected component:
selinux-policy-3.14.1-36.fc28.noarch

Additional info:
reporter:       libreport-2.9.5
hashmarkername: setroubleshoot
kernel:         4.17.9-200.fc28.x86_64
type:           libreport

Comment 15 Erik Bird 2018-08-07 14:10:21 UTC
Description of problem:
Not sure.

Version-Release number of selected component:
selinux-policy-3.14.1-37.fc28.noarch

Additional info:
reporter:       libreport-2.9.5
hashmarkername: setroubleshoot
kernel:         4.17.11-200.fc28.x86_64
type:           libreport

Comment 16 Arsalan Rezazadeh 2018-08-15 17:08:43 UTC
same problem here with hp 640 g1

Comment 17 Luca Botti 2018-08-22 12:48:17 UTC
Description of problem:
just enabled tlp

Version-Release number of selected component:
selinux-policy-3.14.1-40.fc28.noarch

Additional info:
reporter:       libreport-2.9.5
hashmarkername: setroubleshoot
kernel:         4.17.14-202.fc28.x86_64
type:           libreport

Comment 18 David Johnston 2018-08-28 12:05:39 UTC
Description of problem:
TLP appears to be creating its lock file with an incorrect contexts

scontext=system_u:system_r:tlp_t:s0
tcontext=system_u:object_r:var_lib_t:s0



Additional info:
reporter:       libreport-2.9.5
hashmarkername: setroubleshoot
kernel:         4.16.16-200.fc27.x86_64
type:           libreport

Comment 19 ep 2018-09-01 22:20:32 UTC
Description of problem:
tlp service starts up

Version-Release number of selected component:
selinux-policy-3.14.1-40.fc28.noarch

Additional info:
reporter:       libreport-2.9.5
hashmarkername: setroubleshoot
kernel:         4.17.19-200.fc28.x86_64
type:           libreport

Comment 20 Timur Kristóf 2018-11-07 13:23:25 UTC
Description of problem:
Not sure what causes it but it seems to be fair to allow tlp to access its own file. At least lock_tlp sounds like it does belong to tlp.

Version-Release number of selected component:
selinux-policy-3.14.1-47.fc28.noarch

Additional info:
reporter:       libreport-2.9.5
hashmarkername: setroubleshoot
kernel:         4.18.16-200.fc28.x86_64
type:           libreport


Note You need to log in before you can comment on or make changes to this bug.