Hide Forgot
Description of problem: Sep 01 09:23:28 localhost.localdomain usbguard-notifier[2310]: Check if usbguard-daemon is running in the background Sep 01 09:23:28 localhost.localdomain usbguard-notifier[2310]: IPC connection failure!IPC connect: service=usbguard: Operation not permitted Sep 01 09:23:28 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310 Sep 01 09:23:27 localhost.localdomain usbguard-notifier[2310]: Check if usbguard-daemon is running in the background Sep 01 09:23:27 localhost.localdomain usbguard-notifier[2310]: IPC connection failure!IPC connect: service=usbguard: Operation not permitted Sep 01 09:23:27 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310 Version-Release number of selected component (if applicable): usbguard-dbus-1.0.0-2.el8.x86_64 usbguard-selinux-1.0.0-2.el8.noarch usbguard-1.0.0-2.el8.x86_64 usbguard-notifier-1.0.0-2.el8.x86_64 How reproducible: * always Steps to Reproduce: 1. get a RHEL-8.5 machine 2. install usbguard* packages 3. start both usbguard and usbguard-dbus services 4. look into the journal # ps -efZ | grep usbguard unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 gdm 2310 2241 0 09:10 ? 00:00:00 /usr/bin/usbguard-notifier -w unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 5322 5302 0 09:17 ? 00:00:00 /usr/bin/usbguard-notifier -w system_u:system_r:usbguard_t:s0 root 7228 1 0 09:22 ? 00:00:00 /usr/sbin/usbguard-dbus --system system_u:system_r:usbguard_t:s0 root 7238 1 0 09:22 ? 00:00:00 /usr/sbin/usbguard-daemon -f -s -c /etc/usbguard/usbguard-daemon.conf unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 8973 5804 0 09:27 pts/0 00:00:00 grep --color=auto usbguard # Additional info: SELinux state does not have any effect.
These messages appear every second.
All 3 usbguard* services are running, but usbguard-notifier still complains: # service usbguard status Redirecting to /bin/systemctl status usbguard.service ● usbguard.service - USBGuard daemon Loaded: loaded (/usr/lib/systemd/system/usbguard.service; enabled; vendor preset: disabled) Active: active (running) since Wed 2021-09-01 09:22:15 CEST; 10min ago Docs: man:usbguard-daemon(8) Process: 7236 ExecStart=/usr/sbin/usbguard-daemon -f -s -c /etc/usbguard/usbguard-daemon.conf (code=exited, status=0/SUCCESS) Main PID: 7238 (usbguard-daemon) Tasks: 3 (limit: 11391) Memory: 10.4M CGroup: /system.slice/usbguard.service └─7238 /usr/sbin/usbguard-daemon -f -s -c /etc/usbguard/usbguard-daemon.conf Sep 01 09:32:45 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310 Sep 01 09:32:46 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310 Sep 01 09:32:47 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310 Sep 01 09:32:48 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310 Sep 01 09:32:49 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310 Sep 01 09:32:50 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310 Sep 01 09:32:51 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310 Sep 01 09:32:52 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310 Sep 01 09:32:53 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310 Sep 01 09:32:54 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310 # service usbguard-dbus status Redirecting to /bin/systemctl status usbguard-dbus.service ● usbguard-dbus.service - USBGuard D-Bus Service Loaded: loaded (/usr/lib/systemd/system/usbguard-dbus.service; enabled; vendor preset: disabled) Active: active (running) since Wed 2021-09-01 09:22:15 CEST; 10min ago Docs: man:usbguard-dbus(8) Main PID: 7228 (usbguard-dbus) Tasks: 4 (limit: 11391) Memory: 1.8M CGroup: /system.slice/usbguard-dbus.service └─7228 /usr/sbin/usbguard-dbus --system Sep 01 09:22:15 localhost.localdomain systemd[1]: Starting USBGuard D-Bus Service... Sep 01 09:22:15 localhost.localdomain systemd[1]: Started USBGuard D-Bus Service. # systemctl --user status usbguard-notifier ● usbguard-notifier.service - USBGuard Notifier Loaded: loaded (/usr/lib/systemd/user/usbguard-notifier.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2021-09-01 09:17:11 CEST; 15min ago Main PID: 5322 (usbguard-notifi) Tasks: 2 (limit: 11391) Memory: 2.1M CGroup: /user.slice/user-0.slice/user/usbguard-notifier.service └─5322 /usr/bin/usbguard-notifier -w Sep 01 09:17:11 localhost.localdomain systemd[5302]: Started USBGuard Notifier. Sep 01 09:17:11 localhost.localdomain usbguard-notifier[5322]: Connection has been established Sep 01 09:22:15 localhost.localdomain usbguard-notifier[5322]: IPC connection failure!IPC connect: service=usbguard: Connection reset by peer Sep 01 09:22:15 localhost.localdomain usbguard-notifier[5322]: Check if usbguard-daemon is running in the background Sep 01 09:22:16 localhost.localdomain usbguard-notifier[5322]: Connection has been established #
# grep -Ri ipc /etc/usbguard/ /etc/usbguard/usbguard-daemon.conf:# IPC interface. /etc/usbguard/usbguard-daemon.conf:# IPC interface. Usually, we set the option to /etc/usbguard/usbguard-daemon.conf:#!!! the daemon will accept IPC connections from !!! /etc/usbguard/usbguard-daemon.conf:# Users allowed to use the IPC interface. /etc/usbguard/usbguard-daemon.conf:# accept IPC connections from. /etc/usbguard/usbguard-daemon.conf:# IPCAllowedUsers=username1 username2 ... /etc/usbguard/usbguard-daemon.conf:IPCAllowedUsers=root /etc/usbguard/usbguard-daemon.conf:# Groups allowed to use the IPC interface. /etc/usbguard/usbguard-daemon.conf:# accept IPC connections from. /etc/usbguard/usbguard-daemon.conf:# IPCAllowedGroups=groupname1 groupname2 ... /etc/usbguard/usbguard-daemon.conf:IPCAllowedGroups=wheel /etc/usbguard/usbguard-daemon.conf:# IPC access control definition files path. /etc/usbguard/usbguard-daemon.conf:# This way each file defines who is able to connect to the IPC /etc/usbguard/usbguard-daemon.conf:IPCAccessControlFiles=/etc/usbguard/IPCAccessControl.d/ #
# journalctl -u usbguard -S today | grep 'IPC connection denied' | wc -l 2212 # journalctl -S today | grep usbguard-notifier | grep 'IPC connection failure' | wc -l 2214 #
Because we ship the usbguard and gdm packages by default, I believe that usbguard configuration should be modified to avoid spamming of the journal.
Reproducible in 1MT on RHEL-8.4 too.
A longer reproducer: 0) get a clean RHEL-8.5 machine 1) yum -y groupinstall "Server with GUI" 2) yum -y install usbguard\* 3) systemctl set-default graphical 4) systemctl enable usbguard 5) systemctl enable usbguard-dbus 6) reboot 7) journalctl -S today -u usbguard | grep 'IPC connection denied'
happy 2*10^6 ! ●●●█〓〓██████████▅▄▄▄▄▄▄▄▃▃▃▃▄ ▄██ 〓 █CONGRATULATION█ 〓 ██▄ ▄▅█████████████████████████▅▄▃ █████████████████████████████◤ ◥⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲◤ Sorry for spam!
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (usbguard bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:1779