Bug 1939238 - SELinux denies "send_msg" for scontext=system_u:system_r:bluetooth_t:s0 tcontext=system_u:system_r:fwupd_t:s0 tclass=dbus
Summary: SELinux denies "send_msg" for scontext=system_u:system_r:bluetooth_t:s0 tcont...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 34
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-03-15 19:23 UTC by Adam Williamson
Modified: 2021-03-29 00:17 UTC (History)
10 users (show)

Fixed In Version: selinux-policy-3.14.7-28.fc34
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-03-29 00:17:06 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Adam Williamson 2021-03-15 19:23:47 UTC
On my up-to-date with updates-testing F34 system, with selinux-policy-3.14.7-25.fc34.noarch , I'm seeing several of these USER_AVCs in the journal after a clean boot:

Mar 15 12:13:53 xps13k.happyassassin.net audit[1083]: USER_AVC pid=1083 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for  scontext=system_u:system_r:bluetooth_t:s0 tcontext=system_u:system_r:fwupd_t:s0 tclass=dbus permissive=0
Mar 15 12:13:53 xps13k.happyassassin.net audit[1083]: USER_AVC pid=1083 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for  scontext=system_u:system_r:bluetooth_t:s0 tcontext=system_u:system_r:fwupd_t:s0 tclass=dbus permissive=0
Mar 15 12:13:54 xps13k.happyassassin.net audit[1083]: USER_AVC pid=1083 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for  scontext=system_u:system_r:bluetooth_t:s0 tcontext=system_u:system_r:fwupd_t:s0 tclass=dbus permissive=0
Mar 15 12:13:54 xps13k.happyassassin.net audit[1083]: USER_AVC pid=1083 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for  scontext=system_u:system_r:bluetooth_t:s0 tcontext=system_u:system_r:fwupd_t:s0 tclass=dbus permissive=0

Comment 1 Joshua Noeske 2021-03-20 15:42:57 UTC
I can confirm this on F33 with selinux-policy-3.14.6-35.fc33.noarch and kernel 5.11.7. For me, it seems to cause that I cannot enable/disable Bluetooth via the GNOME control center anymore.

Comment 2 Zdenek Pytela 2021-03-22 19:01:52 UTC
I've submitted a Fedora PR to address the issue:
https://github.com/fedora-selinux/selinux-policy/pull/655

Comment 3 Zdenek Pytela 2021-03-25 21:27:31 UTC
Will be backported to f33, too:
https://github.com/fedora-selinux/selinux-policy-contrib/pull/392

Comment 4 Fedora Update System 2021-03-26 14:55:22 UTC
FEDORA-2021-15b81d905c has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2021-15b81d905c

Comment 5 Fedora Update System 2021-03-27 02:01:14 UTC
FEDORA-2021-15b81d905c has been pushed to the Fedora 34 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-15b81d905c`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-15b81d905c

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2021-03-29 00:17:06 UTC
FEDORA-2021-15b81d905c has been pushed to the Fedora 34 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.