Bug 2145005 - SELinux is preventing ModemManager from write access on the directory qmi.
Summary: SELinux is preventing ModemManager from write access on the directory qmi.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 36
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-11-22 21:42 UTC by Petr Hrasky
Modified: 2023-04-21 01:23 UTC (History)
9 users (show)

Fixed In Version: selinux-policy-36.18-1.fc36
Clone Of:
Environment:
Last Closed: 2023-04-21 01:23:47 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 1561 0 None open Allow ModemManager all permissions for netlink route socket 2023-01-20 17:33:35 UTC
Red Hat Bugzilla 2151240 0 medium CLOSED SELinux is preventing ModemManager from using the 'execmem' accesses on a process. 2023-08-19 12:08:19 UTC

Internal Links: 2149946

Description Petr Hrasky 2022-11-22 21:42:43 UTC
Description of problem:

d-link dwh-222 plugged in, connection set up in KDE Network Manager. No connection. SElinux reports error. 

lsusb
Bus 001 Device 017: ID 2001:7e3d D-Link Corp. Mobile Connect

You should report this as a bug.
You can generate a local policy module to allow this access.
Allow this access for now by executing:
# ausearch -c 'ModemManager' --raw | audit2allow -M my-ModemManager
# semodule -X 300 -i my-ModemManager.pp

Version-Release number of selected component (if applicable):
NetworkManager-1.38.6-1.fc36.x86_64
ModemManager-glib-1.18.8-1.fc36.x86_64
ModemManager-1.18.8-1.fc36.x86_64
modem-manager-gui-mm-ModemManager-0.0.20-7.fc36.x86_64
modem-manager-gui-cm-NetworkManager-0.0.20-7.fc36.x86_64
modem-manager-gui-0.0.20-7.fc36.x86_64

How reproducible:
always

Steps to Reproduce:
1. plug in modem
2. try to connect and fail
3. selinux error

Actual results:
no connection

Expected results:
connect to lte mobile broadband

Additional info:

SELinux is preventing ModemManager from write access on the directory qmi.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that ModemManager should be allowed write access on the qmi directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'ModemManager' --raw | audit2allow -M my-ModemManager
# semodule -X 300 -i my-ModemManager.pp

Additional Information:
Source Context                system_u:system_r:modemmanager_t:s0
Target Context                system_u:object_r:sysfs_t:s0
Target Objects                qmi [ dir ]
Source                        ModemManager
Source Path                   ModemManager
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-36.16-1.fc36.noarch
Local Policy RPM              selinux-policy-targeted-36.16-1.fc36.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux idea1 6.0.9-200.fc36.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Wed Nov 16 17:50:45 UTC 2022
                              x86_64 x86_64
Alert Count                   9
First Seen                    2022-08-16 15:56:55 CEST
Last Seen                     2022-11-22 22:10:24 CET
Local ID                      409850f4-1ad1-4cfd-83fa-f5d869cd3d5b

Raw Audit Messages
type=AVC msg=audit(1669151424.642:467): avc:  denied  { write } for  pid=1516 comm="ModemManager" name="qmi" dev="sysfs" ino=65361 scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=0


Hash: ModemManager,modemmanager_t,sysfs_t,dir,write

Comment 1 Zdenek Pytela 2023-01-18 09:57:45 UTC
Petr,

Will you be able to gather all denials with full auditing enabled?

0) Run
  # setenforce 0
1) Open the /etc/audit/rules.d/audit.rules file in an editor.
2) Remove the following line if it exists:
-a task,never
3) Add the following line to the end of the file:
-w /etc/shadow -p w
4) Restart the audit daemon:
  # service auditd restart
5) Re-run your scenario.
6) Collect AVC denials:
  # ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today
7) Run
  # setenforce 1

Comment 2 Petr Hrasky 2023-01-18 19:45:19 UTC
I tried to follow your procedure. I do not have sim in the modem now. Hope it does not matter. Let me know if you need anything else.

# cat /etc/audit/rules.d/audit.rules
## This set of rules is to suppress the performance effects of the
## audit system. The result is that you only get hardwired events.
-D

## This suppresses syscall auditing for all tasks started
## with this rule in effect.  Remove it if you need syscall
## auditing.
#-a task,never
-w /etc/shadow -p w

# service auditd restart
Stopping logging: 
Redirecting start to /bin/systemctl start auditd.service


# ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today
----
type=AVC msg=audit(01/18/2023 09:37:59.454:315) : avc:  denied  { search } for  pid=5435 comm=snapd name=/ dev="binfmt_misc" ino=1 scontext=system_u:system_r:snappy_t:s0 tcontext=system_u:object_r:binfmt_misc_fs_t:s0 tclass=dir permissive=1 
----
type=USER_AVC msg=audit(01/18/2023 09:37:59.502:317) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='avc:  denied  { status } for auid=unset uid=root gid=root cmdline="" function="method_get_unit_file_state" scontext=system_u:system_r:snappy_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=system permissive=1  exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' 
----
type=AVC msg=audit(01/18/2023 20:33:48.924:810) : avc:  denied  { execmem } for  pid=1302 comm=ModemManager scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:system_r:modemmanager_t:s0 tclass=process permissive=0 
----
type=AVC msg=audit(01/18/2023 20:33:58.834:813) : avc:  denied  { add_name } for  pid=1302 comm=ModemManager name=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=0 
----
type=AVC msg=audit(01/18/2023 20:37:32.853:850) : avc:  denied  { add_name } for  pid=1302 comm=ModemManager name=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=1 
----
type=AVC msg=audit(01/18/2023 20:37:32.853:851) : avc:  denied  { create } for  pid=1302 comm=ModemManager name=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(01/18/2023 20:38:53.846:868) : avc:  denied  { add_name } for  pid=1302 comm=ModemManager name=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=1 
----
type=AVC msg=audit(01/18/2023 20:38:53.846:869) : avc:  denied  { create } for  pid=1302 comm=ModemManager name=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(01/18/2023 20:43:12.857:884) : avc:  denied  { add_name } for  pid=1302 comm=ModemManager name=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=1 
----
type=AVC msg=audit(01/18/2023 20:43:12.857:885) : avc:  denied  { create } for  pid=1302 comm=ModemManager name=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=1

Comment 3 Zdenek Pytela 2023-01-19 08:39:10 UTC
Thank you.
The denials are different this time, so maybe the sim plays a role? Or there are different modes?
Also interesting that changes in auditing did not effect in showing additional data, so we can't see the syscalls and full path. Or is it the records are older than audit changes?

Comment 4 Petr Hrasky 2023-01-20 08:08:58 UTC
I collected the info Jan 18. Made the audit.rules changes as well yesterday. I will try with a sim. Also I have upgraded fedora meantime. Now I am on F37 and kernel 6.1.

I tried again - Jan 19 17:20.

 ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today
----
type=PROCTITLE msg=audit(01/19/2023 09:05:23.413:304) : proctitle=/usr/libexec/snapd/snapd  
type=PATH msg=audit(01/19/2023 09:05:23.413:304) : item=0 name=/proc/sys/fs/binfmt_misc/WSLInterop nametype=UN
KNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0  
type=CWD msg=audit(01/19/2023 09:05:23.413:304) : cwd=/  
type=SYSCALL msg=audit(01/19/2023 09:05:23.413:304) : arch=x86_64 syscall=newfstatat success=no exit=ENOENT(No
such file or directory) a0=AT_FDCWD a1=0xc00003e3f0 a2=0xc000039078 a3=0x0 items=1 ppid=1 pid=4634 auid=unset
uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sna
pd exe=/usr/libexec/snapd/snapd subj=system_u:system_r:snappy_t:s0 key=(null)  
type=AVC msg=audit(01/19/2023 09:05:23.413:304) : avc:  denied  { search } for  pid=4634 comm=snapd name=/ dev
="binfmt_misc" ino=1 scontext=system_u:system_r:snappy_t:s0 tcontext=system_u:object_r:binfmt_misc_fs_t:s0 tcl
ass=dir permissive=1  
----
type=USER_AVC msg=audit(01/19/2023 09:05:23.465:306) : pid=1 uid=root auid=unset ses=unset subj=system_u:syste
m_r:init_t:s0 msg='avc:  denied  { status } for auid=unset uid=root gid=root cmdline="" function="method_get_u
nit_file_state" scontext=system_u:system_r:snappy_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=system perm
issive=1  exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?'  
[root@idea1 ~]# ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today
----
type=PROCTITLE msg=audit(01/19/2023 09:05:23.413:304) : proctitle=/usr/libexec/snapd/snapd  
type=PATH msg=audit(01/19/2023 09:05:23.413:304) : item=0 name=/proc/sys/fs/binfmt_misc/WSLInterop nametype=UN
KNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0  
type=CWD msg=audit(01/19/2023 09:05:23.413:304) : cwd=/  
type=SYSCALL msg=audit(01/19/2023 09:05:23.413:304) : arch=x86_64 syscall=newfstatat success=no exit=ENOENT(No
such file or directory) a0=AT_FDCWD a1=0xc00003e3f0 a2=0xc000039078 a3=0x0 items=1 ppid=1 pid=4634 auid=unset
uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sna
pd exe=/usr/libexec/snapd/snapd subj=system_u:system_r:snappy_t:s0 key=(null)  
type=AVC msg=audit(01/19/2023 09:05:23.413:304) : avc:  denied  { search } for  pid=4634 comm=snapd name=/ dev
="binfmt_misc" ino=1 scontext=system_u:system_r:snappy_t:s0 tcontext=system_u:object_r:binfmt_misc_fs_t:s0 tcl
ass=dir permissive=1  
----
type=USER_AVC msg=audit(01/19/2023 09:05:23.465:306) : pid=1 uid=root auid=unset ses=unset subj=system_u:syste
m_r:init_t:s0 msg='avc:  denied  { status } for auid=unset uid=root gid=root cmdline="" function="method_get_u
nit_file_state" scontext=system_u:system_r:snappy_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=system perm
issive=1  exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?'  
----
type=PROCTITLE msg=audit(01/19/2023 17:27:09.008:761) : proctitle=/usr/sbin/ModemManager  
type=SYSCALL msg=audit(01/19/2023 17:27:09.008:761) : arch=x86_64 syscall=mmap success=yes exit=14071603066060
8 a0=0x0 a1=0x10000 a2=PROT_READ|PROT_WRITE|PROT_EXEC a3=MAP_PRIVATE|MAP_ANONYMOUS items=0 ppid=1 pid=1351 aui
d=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset c
omm=ModemManager exe=/usr/sbin/ModemManager subj=system_u:system_r:modemmanager_t:s0 key=(null)  
type=AVC msg=audit(01/19/2023 17:27:09.008:761) : avc:  denied  { execmem } for  pid=1351 comm=ModemManager sc
ontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:system_r:modemmanager_t:s0 tclass=process permiss
ive=1  
----
type=PROCTITLE msg=audit(01/19/2023 17:27:19.770:764) : proctitle=/usr/sbin/ModemManager  
type=SYSCALL msg=audit(01/19/2023 17:27:19.770:764) : arch=x86_64 syscall=mmap success=yes exit=14071603059507
2 a0=0x0 a1=0x10000 a2=PROT_READ|PROT_WRITE|PROT_EXEC a3=MAP_PRIVATE|MAP_ANONYMOUS items=0 ppid=1 pid=1351 aui
d=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset c
omm=ModemManager exe=/usr/sbin/ModemManager subj=system_u:system_r:modemmanager_t:s0 key=(null)  
type=AVC msg=audit(01/19/2023 17:27:19.770:764) : avc:  denied  { execmem } for  pid=1351 comm=ModemManager sc
ontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:system_r:modemmanager_t:s0 tclass=process permiss
ive=1  
----
type=PROCTITLE msg=audit(01/19/2023 17:27:19.815:765) : proctitle=/usr/sbin/ModemManager  
type=PATH msg=audit(01/19/2023 17:27:19.815:765) : item=1 name=/sys/class/net/wwp4s0f3u2i4/qmi/pass_through in
ode=70908 dev=00:16 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysfs_t:s0 nametype=NOR
MAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0  
type=PATH msg=audit(01/19/2023 17:27:19.815:765) : item=0 name=/sys/class/net/wwp4s0f3u2i4/qmi/ inode=70904 de
v=00:16 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysfs_t:s0 nametype=PARENT cap_fp=no
ne cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0  
type=CWD msg=audit(01/19/2023 17:27:19.815:765) : cwd=/  
type=SYSCALL msg=audit(01/19/2023 17:27:19.815:765) : arch=x86_64 syscall=openat success=yes exit=12 a0=AT_FDC
WD a1=0x55c71e0f4290 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=2 ppid=1 pid=1351 auid=unset uid=root gid=root
euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=ModemManager exe=/usr
/sbin/ModemManager subj=system_u:system_r:modemmanager_t:s0 key=(null)  
type=AVC msg=audit(01/19/2023 17:27:19.815:765) : avc:  denied  { create } for  pid=1351 comm=ModemManager nam
e=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file
permissive=1  
type=AVC msg=audit(01/19/2023 17:27:19.815:765) : avc:  denied  { add_name } for  pid=1351 comm=ModemManager n
ame=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir
permissive=1  
----
type=PROCTITLE msg=audit(01/19/2023 17:28:21.332:774) : proctitle=/usr/sbin/ModemManager  
type=SYSCALL msg=audit(01/19/2023 17:28:21.332:774) : arch=x86_64 syscall=mmap success=yes exit=14071603066060
8 a0=0x0 a1=0x10000 a2=PROT_READ|PROT_WRITE|PROT_EXEC a3=MAP_PRIVATE|MAP_ANONYMOUS items=0 ppid=1 pid=1351 aui
d=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset c
omm=ModemManager exe=/usr/sbin/ModemManager subj=system_u:system_r:modemmanager_t:s0 key=(null)  
type=AVC msg=audit(01/19/2023 17:28:21.332:774) : avc:  denied  { execmem } for  pid=1351 comm=ModemManager sc
ontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:system_r:modemmanager_t:s0 tclass=process permiss
ive=1  
----
type=PROCTITLE msg=audit(01/19/2023 17:28:30.824:777) : proctitle=/usr/sbin/ModemManager  
type=PATH msg=audit(01/19/2023 17:28:30.824:777) : item=1 name=/sys/class/net/wwp4s0f3u2i4/qmi/pass_through in
ode=72201 dev=00:16 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysfs_t:s0 nametype=NOR
MAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0  
type=PATH msg=audit(01/19/2023 17:28:30.824:777) : item=0 name=/sys/class/net/wwp4s0f3u2i4/qmi/ inode=72197 de
v=00:16 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysfs_t:s0 nametype=PARENT cap_fp=no
ne cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0  
type=CWD msg=audit(01/19/2023 17:28:30.824:777) : cwd=/  
type=SYSCALL msg=audit(01/19/2023 17:28:30.824:777) : arch=x86_64 syscall=openat success=yes exit=12 a0=AT_FDC
WD a1=0x55c71e132c90 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=2 ppid=1 pid=1351 auid=unset uid=root gid=root
euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=ModemManager exe=/usr
/sbin/ModemManager subj=system_u:system_r:modemmanager_t:s0 key=(null)  
type=AVC msg=audit(01/19/2023 17:28:30.824:777) : avc:  denied  { create } for  pid=1351 comm=ModemManager nam
e=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file
permissive=1  
type=AVC msg=audit(01/19/2023 17:28:30.824:777) : avc:  denied  { add_name } for  pid=1351 comm=ModemManager n
ame=pass_through scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir
permissive=1

Comment 5 Zdenek Pytela 2023-01-20 17:33:36 UTC
Thank you, good job, unfortunately I do not have access to such devices.

You can try the following packages:
https://github.com/fedora-selinux/selinux-policy/pull/1561
Checks -> Artifacts -> rpms.zip

which are currently only for rawhide, or check the content and commit message.

Since ModemManager 1.18.12 the execmem permission should not be required.

Comment 6 strasharo2000 2023-02-20 08:16:25 UTC
I'm getting it with ModemManager-1.18.12-1.fc37.x86_64 too.

sudo ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today
----
type=AVC msg=audit(02/20/2023 09:07:25.078:252) : avc:  denied  { execmem } for  pid=1433 comm=ModemManager scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:system_r:modemmanager_t:s0 tclass=process permissive=0

Comment 7 Fedora Update System 2023-04-05 11:47:22 UTC
FEDORA-2023-9323895447 has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2023-9323895447

Comment 8 Fedora Update System 2023-04-06 02:24:44 UTC
FEDORA-2023-9323895447 has been pushed to the Fedora 36 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-9323895447`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-9323895447

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2023-04-21 01:23:47 UTC
FEDORA-2023-9323895447 has been pushed to the Fedora 36 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.