Description of problem: Version-Release number of selected component (if applicable): pads-1.2-27.fc31.x86_64 selinux-policy-3.14.4-31.fc31.noarch selinux-policy-targeted-3.14.4-31.fc31.noarch How reproducible: * always Steps to Reproduce: 1. get a Fedora 30 or 31 machine 2. start the pads service 3. search for SELinux denials Actual results (enforcing mode): ---- type=PROCTITLE msg=audit(09/30/2019 08:38:44.072:324) : proctitle=/usr/bin/pads -D -c /etc/pads.conf type=SYSCALL msg=audit(09/30/2019 08:38:44.072:324) : arch=x86_64 syscall=socket success=no exit=EACCES(Permission denied) a0=bluetooth a1=SOCK_RAW a2=icmp a3=0x7f6879115ac0 items=0 ppid=1 pid=1678 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=pads exe=/usr/bin/pads subj=system_u:system_r:pads_t:s0 key=(null) type=AVC msg=audit(09/30/2019 08:38:44.072:324) : avc: denied { create } for pid=1678 comm=pads scontext=system_u:system_r:pads_t:s0 tcontext=system_u:system_r:pads_t:s0 tclass=bluetooth_socket permissive=0 ---- Expected results: * no SELinux denials Additional info:
Actual results (permissive mode): ---- type=PROCTITLE msg=audit(09/30/2019 08:53:54.366:331) : proctitle=/usr/bin/pads -D -c /etc/pads.conf type=SYSCALL msg=audit(09/30/2019 08:53:54.366:331) : arch=x86_64 syscall=socket success=yes exit=3 a0=bluetooth a1=SOCK_RAW a2=icmp a3=0x7f5c7c0baac0 items=0 ppid=1 pid=1712 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=pads exe=/usr/bin/pads subj=system_u:system_r:pads_t:s0 key=(null) type=AVC msg=audit(09/30/2019 08:53:54.366:331) : avc: denied { module_request } for pid=1712 comm=pads kmod="net-pf-31" scontext=system_u:system_r:pads_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=1 type=AVC msg=audit(09/30/2019 08:53:54.366:331) : avc: denied { create } for pid=1712 comm=pads scontext=system_u:system_r:pads_t:s0 tcontext=system_u:system_r:pads_t:s0 tclass=bluetooth_socket permissive=1 ---- type=PROCTITLE msg=audit(09/30/2019 08:53:54.478:332) : proctitle=/usr/bin/pads -D -c /etc/pads.conf type=SYSCALL msg=audit(09/30/2019 08:53:54.478:332) : arch=x86_64 syscall=ioctl success=yes exit=0 a0=0x3 a1=0x800448d2 a2=0x55ec11d5c960 a3=0x7f5c7c0baac0 items=0 ppid=1 pid=1712 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=pads exe=/usr/bin/pads subj=system_u:system_r:pads_t:s0 key=(null) type=AVC msg=audit(09/30/2019 08:53:54.478:332) : avc: denied { ioctl } for pid=1712 comm=pads path=socket:[28621] dev="sockfs" ino=28621 ioctlcmd=0x48d2 scontext=system_u:system_r:pads_t:s0 tcontext=system_u:system_r:pads_t:s0 tclass=bluetooth_socket permissive=1 ---- type=PROCTITLE msg=audit(09/30/2019 08:53:54.479:333) : proctitle=/usr/bin/pads -D -c /etc/pads.conf type=SYSCALL msg=audit(09/30/2019 08:53:54.479:333) : arch=x86_64 syscall=socket success=yes exit=3 a0=netlink a1=SOCK_RAW a2=pup a3=0x7f5c7c0baac0 items=0 ppid=1 pid=1712 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=pads exe=/usr/bin/pads subj=system_u:system_r:pads_t:s0 key=(null) type=AVC msg=audit(09/30/2019 08:53:54.479:333) : avc: denied { create } for pid=1712 comm=pads scontext=system_u:system_r:pads_t:s0 tcontext=system_u:system_r:pads_t:s0 tclass=netlink_netfilter_socket permissive=1 ---- type=PROCTITLE msg=audit(09/30/2019 08:53:54.517:335) : proctitle=/usr/bin/pads -D -c /etc/pads.conf type=MMAP msg=audit(09/30/2019 08:53:54.517:335) : fd=3 flags=MAP_SHARED type=SYSCALL msg=audit(09/30/2019 08:53:54.517:335) : arch=x86_64 syscall=mmap success=yes exit=140035191222272 a0=0x0 a1=0x200000 a2=PROT_READ|PROT_WRITE a3=MAP_SHARED items=0 ppid=1 pid=1712 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=pads exe=/usr/bin/pads subj=system_u:system_r:pads_t:s0 key=(null) type=AVC msg=audit(09/30/2019 08:53:54.517:335) : avc: denied { map } for pid=1712 comm=pads path=socket:[28654] dev="sockfs" ino=28654 scontext=system_u:system_r:pads_t:s0 tcontext=system_u:system_r:pads_t:s0 tclass=packet_socket permissive=1 ---- The service runs successfully in permissive mode.
It will be fixed in SELinux policy package. PR: https://github.com/fedora-selinux/selinux-policy-contrib/commit/5953a31ccb667787b55800c89f0a658a086a5236
Pull request is here: https://github.com/fedora-selinux/selinux-policy-contrib/pull/150
commit fbe776b5f601131649e3f54049ec6abb82a87e40 (HEAD -> rawhide, origin/rawhide, origin/HEAD) Author: Richard Filo <rfilo> Date: Thu Oct 3 17:39:48 2019 +0200 Update allow rules set for pads_t domain Allow pads_t domain map packet sockets labled pads_t Allow pads_t domain create netlink netfilter sockets and bluetooth sockets labled pads_t Fixes:https://bugzilla.redhat.com/show_bug.cgi?id=1757043 Signed-off-by: Richard Filo<rfilo>
FEDORA-2019-7ef1fde499 has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2019-7ef1fde499
selinux-policy-3.14.4-38.fc31 has been pushed to the Fedora 31 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-7ef1fde499
FEDORA-2019-7d65c50fd6 has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2019-7d65c50fd6
selinux-policy-3.14.4-39.fc31 has been pushed to the Fedora 31 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-7d65c50fd6
selinux-policy-3.14.4-39.fc31 has been pushed to the Fedora 31 stable repository. If problems still persist, please make note of it in this bug report.