Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: d-link dwh-222 plugged in, connection set up in KDE Network Manager. No connection. SElinux reports error. lsusb Bus 001 Device 017: ID 2001:7e3d D-Link Corp. Mobile Connect You should report this as a bug. You can generate a local policy module to allow this access. Allow this access for now by executing: # ausearch -c 'ModemManager' --raw | audit2allow -M my-ModemManager # semodule -X 300 -i my-ModemManager.pp Version-Release number of selected component (if applicable): NetworkManager-1.38.6-1.fc36.x86_64 ModemManager-glib-1.18.8-1.fc36.x86_64 ModemManager-1.18.8-1.fc36.x86_64 modem-manager-gui-mm-ModemManager-0.0.20-7.fc36.x86_64 modem-manager-gui-cm-NetworkManager-0.0.20-7.fc36.x86_64 modem-manager-gui-0.0.20-7.fc36.x86_64 How reproducible: always Steps to Reproduce: 1. plug in modem 2. try to connect and fail 3. selinux error Actual results: no connection Expected results: connect to lte mobile broadband Additional info: SELinux is preventing ModemManager from write access on the directory qmi. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that ModemManager should be allowed write access on the qmi directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'ModemManager' --raw | audit2allow -M my-ModemManager # semodule -X 300 -i my-ModemManager.pp Additional Information: Source Context system_u:system_r:modemmanager_t:s0 Target Context system_u:object_r:sysfs_t:s0 Target Objects qmi [ dir ] Source ModemManager Source Path ModemManager Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-36.16-1.fc36.noarch Local Policy RPM selinux-policy-targeted-36.16-1.fc36.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux idea1 6.0.9-200.fc36.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Nov 16 17:50:45 UTC 2022 x86_64 x86_64 Alert Count 9 First Seen 2022-08-16 15:56:55 CEST Last Seen 2022-11-22 22:10:24 CET Local ID 409850f4-1ad1-4cfd-83fa-f5d869cd3d5b Raw Audit Messages type=AVC msg=audit(1669151424.642:467): avc: denied { write } for pid=1516 comm="ModemManager" name="qmi" dev="sysfs" ino=65361 scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=0 Hash: ModemManager,modemmanager_t,sysfs_t,dir,write
Petr, Will you be able to gather all denials with full auditing enabled? 0) Run # setenforce 0 1) Open the /etc/audit/rules.d/audit.rules file in an editor. 2) Remove the following line if it exists: -a task,never 3) Add the following line to the end of the file: -w /etc/shadow -p w 4) Restart the audit daemon: # service auditd restart 5) Re-run your scenario. 6) Collect AVC denials: # ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today 7) Run # setenforce 1
I tried to follow your procedure. I do not have sim in the modem now. Hope it does not matter. Let me know if you need anything else. # cat /etc/audit/rules.d/audit.rules ## This set of rules is to suppress the performance effects of the ## audit system. The result is that you only get hardwired events. -D ## This suppresses syscall auditing for all tasks started ## with this rule in effect. Remove it if you need syscall ## auditing. #-a task,never -w /etc/shadow -p w # service auditd restart Stopping logging: Redirecting start to /bin/systemctl start auditd.service # ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today ---- type=AVC msg=audit(01/18/2023 09:37:59.454:315) : avc: denied { search } for pid=5435 comm=snapd name=/ dev="binfmt_misc" ino=1 scontext=system_u:system_r:snappy_t:s0 tcontext=system_u:object_r:binfmt_misc_fs_t:s0 tclass=dir permissive=1 ---- type=USER_AVC msg=audit(01/18/2023 09:37:59.502:317) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='avc: denied { status } for auid=unset uid=root gid=root cmdline="" function="method_get_unit_file_state" scontext=system_u:system_r:snappy_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=system permissive=1 exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' ---- type=AVC msg=audit(01/18/2023 20:33:48.924:810) : avc: denied { execmem } for pid=1302 comm=ModemManager scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:system_r:modemmanager_t:s0 tclass=process permissive=0 ---- type=AVC msg=audit(01/18/2023 20:33:58.834:813) : avc: denied { add_name } for pid=1302 comm=ModemManager name=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=0 ---- type=AVC msg=audit(01/18/2023 20:37:32.853:850) : avc: denied { add_name } for pid=1302 comm=ModemManager name=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=1 ---- type=AVC msg=audit(01/18/2023 20:37:32.853:851) : avc: denied { create } for pid=1302 comm=ModemManager name=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=1 ---- type=AVC msg=audit(01/18/2023 20:38:53.846:868) : avc: denied { add_name } for pid=1302 comm=ModemManager name=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=1 ---- type=AVC msg=audit(01/18/2023 20:38:53.846:869) : avc: denied { create } for pid=1302 comm=ModemManager name=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=1 ---- type=AVC msg=audit(01/18/2023 20:43:12.857:884) : avc: denied { add_name } for pid=1302 comm=ModemManager name=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=1 ---- type=AVC msg=audit(01/18/2023 20:43:12.857:885) : avc: denied { create } for pid=1302 comm=ModemManager name=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=1
Thank you. The denials are different this time, so maybe the sim plays a role? Or there are different modes? Also interesting that changes in auditing did not effect in showing additional data, so we can't see the syscalls and full path. Or is it the records are older than audit changes?
I collected the info Jan 18. Made the audit.rules changes as well yesterday. I will try with a sim. Also I have upgraded fedora meantime. Now I am on F37 and kernel 6.1. I tried again - Jan 19 17:20. ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today ---- type=PROCTITLE msg=audit(01/19/2023 09:05:23.413:304) : proctitle=/usr/libexec/snapd/snapd type=PATH msg=audit(01/19/2023 09:05:23.413:304) : item=0 name=/proc/sys/fs/binfmt_misc/WSLInterop nametype=UN KNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(01/19/2023 09:05:23.413:304) : cwd=/ type=SYSCALL msg=audit(01/19/2023 09:05:23.413:304) : arch=x86_64 syscall=newfstatat success=no exit=ENOENT(No such file or directory) a0=AT_FDCWD a1=0xc00003e3f0 a2=0xc000039078 a3=0x0 items=1 ppid=1 pid=4634 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sna pd exe=/usr/libexec/snapd/snapd subj=system_u:system_r:snappy_t:s0 key=(null) type=AVC msg=audit(01/19/2023 09:05:23.413:304) : avc: denied { search } for pid=4634 comm=snapd name=/ dev ="binfmt_misc" ino=1 scontext=system_u:system_r:snappy_t:s0 tcontext=system_u:object_r:binfmt_misc_fs_t:s0 tcl ass=dir permissive=1 ---- type=USER_AVC msg=audit(01/19/2023 09:05:23.465:306) : pid=1 uid=root auid=unset ses=unset subj=system_u:syste m_r:init_t:s0 msg='avc: denied { status } for auid=unset uid=root gid=root cmdline="" function="method_get_u nit_file_state" scontext=system_u:system_r:snappy_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=system perm issive=1 exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' [root@idea1 ~]# ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today ---- type=PROCTITLE msg=audit(01/19/2023 09:05:23.413:304) : proctitle=/usr/libexec/snapd/snapd type=PATH msg=audit(01/19/2023 09:05:23.413:304) : item=0 name=/proc/sys/fs/binfmt_misc/WSLInterop nametype=UN KNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(01/19/2023 09:05:23.413:304) : cwd=/ type=SYSCALL msg=audit(01/19/2023 09:05:23.413:304) : arch=x86_64 syscall=newfstatat success=no exit=ENOENT(No such file or directory) a0=AT_FDCWD a1=0xc00003e3f0 a2=0xc000039078 a3=0x0 items=1 ppid=1 pid=4634 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sna pd exe=/usr/libexec/snapd/snapd subj=system_u:system_r:snappy_t:s0 key=(null) type=AVC msg=audit(01/19/2023 09:05:23.413:304) : avc: denied { search } for pid=4634 comm=snapd name=/ dev ="binfmt_misc" ino=1 scontext=system_u:system_r:snappy_t:s0 tcontext=system_u:object_r:binfmt_misc_fs_t:s0 tcl ass=dir permissive=1 ---- type=USER_AVC msg=audit(01/19/2023 09:05:23.465:306) : pid=1 uid=root auid=unset ses=unset subj=system_u:syste m_r:init_t:s0 msg='avc: denied { status } for auid=unset uid=root gid=root cmdline="" function="method_get_u nit_file_state" scontext=system_u:system_r:snappy_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=system perm issive=1 exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' ---- type=PROCTITLE msg=audit(01/19/2023 17:27:09.008:761) : proctitle=/usr/sbin/ModemManager type=SYSCALL msg=audit(01/19/2023 17:27:09.008:761) : arch=x86_64 syscall=mmap success=yes exit=14071603066060 8 a0=0x0 a1=0x10000 a2=PROT_READ|PROT_WRITE|PROT_EXEC a3=MAP_PRIVATE|MAP_ANONYMOUS items=0 ppid=1 pid=1351 aui d=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset c omm=ModemManager exe=/usr/sbin/ModemManager subj=system_u:system_r:modemmanager_t:s0 key=(null) type=AVC msg=audit(01/19/2023 17:27:09.008:761) : avc: denied { execmem } for pid=1351 comm=ModemManager sc ontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:system_r:modemmanager_t:s0 tclass=process permiss ive=1 ---- type=PROCTITLE msg=audit(01/19/2023 17:27:19.770:764) : proctitle=/usr/sbin/ModemManager type=SYSCALL msg=audit(01/19/2023 17:27:19.770:764) : arch=x86_64 syscall=mmap success=yes exit=14071603059507 2 a0=0x0 a1=0x10000 a2=PROT_READ|PROT_WRITE|PROT_EXEC a3=MAP_PRIVATE|MAP_ANONYMOUS items=0 ppid=1 pid=1351 aui d=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset c omm=ModemManager exe=/usr/sbin/ModemManager subj=system_u:system_r:modemmanager_t:s0 key=(null) type=AVC msg=audit(01/19/2023 17:27:19.770:764) : avc: denied { execmem } for pid=1351 comm=ModemManager sc ontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:system_r:modemmanager_t:s0 tclass=process permiss ive=1 ---- type=PROCTITLE msg=audit(01/19/2023 17:27:19.815:765) : proctitle=/usr/sbin/ModemManager type=PATH msg=audit(01/19/2023 17:27:19.815:765) : item=1 name=/sys/class/net/wwp4s0f3u2i4/qmi/pass_through in ode=70908 dev=00:16 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysfs_t:s0 nametype=NOR MAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(01/19/2023 17:27:19.815:765) : item=0 name=/sys/class/net/wwp4s0f3u2i4/qmi/ inode=70904 de v=00:16 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysfs_t:s0 nametype=PARENT cap_fp=no ne cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(01/19/2023 17:27:19.815:765) : cwd=/ type=SYSCALL msg=audit(01/19/2023 17:27:19.815:765) : arch=x86_64 syscall=openat success=yes exit=12 a0=AT_FDC WD a1=0x55c71e0f4290 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=2 ppid=1 pid=1351 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=ModemManager exe=/usr /sbin/ModemManager subj=system_u:system_r:modemmanager_t:s0 key=(null) type=AVC msg=audit(01/19/2023 17:27:19.815:765) : avc: denied { create } for pid=1351 comm=ModemManager nam e=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=1 type=AVC msg=audit(01/19/2023 17:27:19.815:765) : avc: denied { add_name } for pid=1351 comm=ModemManager n ame=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=1 ---- type=PROCTITLE msg=audit(01/19/2023 17:28:21.332:774) : proctitle=/usr/sbin/ModemManager type=SYSCALL msg=audit(01/19/2023 17:28:21.332:774) : arch=x86_64 syscall=mmap success=yes exit=14071603066060 8 a0=0x0 a1=0x10000 a2=PROT_READ|PROT_WRITE|PROT_EXEC a3=MAP_PRIVATE|MAP_ANONYMOUS items=0 ppid=1 pid=1351 aui d=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset c omm=ModemManager exe=/usr/sbin/ModemManager subj=system_u:system_r:modemmanager_t:s0 key=(null) type=AVC msg=audit(01/19/2023 17:28:21.332:774) : avc: denied { execmem } for pid=1351 comm=ModemManager sc ontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:system_r:modemmanager_t:s0 tclass=process permiss ive=1 ---- type=PROCTITLE msg=audit(01/19/2023 17:28:30.824:777) : proctitle=/usr/sbin/ModemManager type=PATH msg=audit(01/19/2023 17:28:30.824:777) : item=1 name=/sys/class/net/wwp4s0f3u2i4/qmi/pass_through in ode=72201 dev=00:16 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysfs_t:s0 nametype=NOR MAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(01/19/2023 17:28:30.824:777) : item=0 name=/sys/class/net/wwp4s0f3u2i4/qmi/ inode=72197 de v=00:16 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysfs_t:s0 nametype=PARENT cap_fp=no ne cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(01/19/2023 17:28:30.824:777) : cwd=/ type=SYSCALL msg=audit(01/19/2023 17:28:30.824:777) : arch=x86_64 syscall=openat success=yes exit=12 a0=AT_FDC WD a1=0x55c71e132c90 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=2 ppid=1 pid=1351 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=ModemManager exe=/usr /sbin/ModemManager subj=system_u:system_r:modemmanager_t:s0 key=(null) type=AVC msg=audit(01/19/2023 17:28:30.824:777) : avc: denied { create } for pid=1351 comm=ModemManager nam e=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=1 type=AVC msg=audit(01/19/2023 17:28:30.824:777) : avc: denied { add_name } for pid=1351 comm=ModemManager n ame=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=1
Thank you, good job, unfortunately I do not have access to such devices. You can try the following packages: https://github.com/fedora-selinux/selinux-policy/pull/1561 Checks -> Artifacts -> rpms.zip which are currently only for rawhide, or check the content and commit message. Since ModemManager 1.18.12 the execmem permission should not be required.
I'm getting it with ModemManager-1.18.12-1.fc37.x86_64 too. sudo ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today ---- type=AVC msg=audit(02/20/2023 09:07:25.078:252) : avc: denied { execmem } for pid=1433 comm=ModemManager scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:system_r:modemmanager_t:s0 tclass=process permissive=0
FEDORA-2023-9323895447 has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2023-9323895447
FEDORA-2023-9323895447 has been pushed to the Fedora 36 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-9323895447` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-9323895447 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2023-9323895447 has been pushed to the Fedora 36 stable repository. If problem still persists, please make note of it in this bug report.