Bug 216237 - Suspend and Hibernate conflicting with SELinux
Suspend and Hibernate conflicting with SELinux
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy-targeted (Show other bugs)
5.0
All Linux
high Severity medium
: ---
: ---
Assigned To: Daniel Walsh
: Regression
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2006-11-17 17:05 EST by Daniel Riek
Modified: 2007-11-30 17:07 EST (History)
3 users (show)

See Also:
Fixed In Version: 5.0.0
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-12-19 08:59:17 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Daniel Riek 2006-11-17 17:05:15 EST
With selinux-policy-targeted-2.4.4-2 and gnome-power-manager-2.16.0-6.el5
suspend is prevented by SELinux.

type=AVC msg=audit(1163798430.914:222): avc:  denied  { write } for  pid=30943
comm="touch" name="hal" dev=dm-0 ino=2060499
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lib_t:s0
tclass=dir
type=AVC msg=audit(1163798430.914:222): avc:  denied  { add_name } for 
pid=30943 comm="touch" name="system-power-suspend-output"
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lib_t:s0
tclass=dir
type=AVC msg=audit(1163798430.914:222): avc:  denied  { create } for  pid=30943
comm="touch" name="system-power-suspend-output"
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lib_t:s0
tclass=file
type=SYSCALL msg=audit(1163798430.914:222): arch=40000003 syscall=5 success=yes
exit=0 a0=bfb5b689 a1=8941 a2=1b6 a3=8941 items=0 ppid=30931 pid=30943
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) comm="touch" exe="/bin/touch" subj=system_u:system_r:hald_t:s0 key=(null)
type=AVC msg=audit(1163798430.916:223): avc:  denied  { write } for  pid=30943
comm="touch" name="system-power-suspend-output" dev=dm-0 ino=2060431
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lib_t:s0
tclass=file
type=SYSCALL msg=audit(1163798430.916:223): arch=40000003 syscall=271
success=yes exit=0 a0=bfb59e64 a1=0 a2=456e6ff4 a3=0 items=0 ppid=30931
pid=30943 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=(none) comm="touch" exe="/bin/touch"
subj=system_u:system_r:hald_t:s0 key=(null)
type=AVC msg=audit(1163798430.918:224): avc:  denied  { getattr } for  pid=30944
comm="chmod" name="system-power-suspend-output" dev=dm-0 ino=2060431
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lib_t:s0
tclass=file
type=SYSCALL msg=audit(1163798430.918:224): arch=40000003 syscall=195
success=yes exit=0 a0=83f42dc a1=83f427c a2=456e6ff4 a3=83f4240 items=0
ppid=30931 pid=30944 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="chmod" exe="/bin/chmod"
subj=system_u:system_r:hald_t:s0 key=(null)
type=AVC_PATH msg=audit(1163798430.918:224): 
path="/var/lib/hal/system-power-suspend-output"
type=AVC msg=audit(1163798430.918:225): avc:  denied  { setattr } for  pid=30944
comm="chmod" name="system-power-suspend-output" dev=dm-0 ino=2060431
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lib_t:s0
tclass=file
type=SYSCALL msg=audit(1163798430.918:225): arch=40000003 syscall=15 success=yes
exit=0 a0=83f3090 a1=1a4 a2=8051594 a3=0 items=0 ppid=30931 pid=30944
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) comm="chmod" exe="/bin/chmod" subj=system_u:system_r:hald_t:s0 key=(null)
type=AVC msg=audit(1163798430.918:226): avc:  denied  { append } for  pid=30931
comm="hal-system-powe" name="system-power-suspend-output" dev=dm-0 ino=2060431
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lib_t:s0
tclass=file
type=SYSCALL msg=audit(1163798430.918:226): arch=40000003 syscall=5 success=yes
exit=3 a0=8e47f98 a1=8441 a2=1b6 a3=8441 items=0 ppid=3325 pid=30931
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) comm="hal-system-powe" exe="/bin/bash"
subj=system_u:system_r:hald_t:s0 key=(null)
type=AVC msg=audit(1163798431.987:227): avc:  denied  { append } for  pid=30947
comm="bash" name="system-power-suspend-output" dev=dm-0 ino=2060431
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lib_t:s0
tclass=file
type=SYSCALL msg=audit(1163798431.987:227): arch=40000003 syscall=4 success=yes
exit=23 a0=2 a1=b7f52000 a2=17 a3=17 items=0 ppid=30931 pid=30947
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) comm="bash" exe="/bin/bash" subj=system_u:system_r:hald_t:s0 key=(null)
type=AVC_PATH msg=audit(1163798431.987:227): 
path="/var/lib/hal/system-power-suspend-output"
type=AVC msg=audit(1163798434.123:228): avc:  denied  { getattr } for  pid=31030
comm="awk" name="system-power-suspend-output" dev=dm-0 ino=2060431
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lib_t:s0
tclass=file
type=SYSCALL msg=audit(1163798434.123:228): arch=40000003 syscall=197
success=yes exit=0 a0=2 a1=bfcf30d4 a2=456e6ff4 a3=bfcf30d4 items=0 ppid=31028
pid=31030 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=(none) comm="awk" exe="/bin/gawk" subj=system_u:system_r:hald_t:s0
key=(null)
type=AVC_PATH msg=audit(1163798434.123:228): 
path="/var/lib/hal/system-power-suspend-output"
type=USYS_CONFIG msg=audit(1163798437.999:229): user pid=31230 uid=0
auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time:
exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
type=USYS_CONFIG msg=audit(1163798447.998:230): user pid=31286 uid=0
auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time:
exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
type=AVC msg=audit(1163798448.239:231): avc:  denied  { append } for  pid=30947
comm="bash" name="system-power-suspend-output" dev=dm-0 ino=2060431
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lib_t:s0
tclass=file
type=SYSCALL msg=audit(1163798448.239:231): arch=40000003 syscall=4 success=yes
exit=23 a0=2 a1=b7f52000 a2=17 a3=17 items=0 ppid=30931 pid=30947
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) comm="bash" exe="/bin/bash" subj=system_u:system_r:hald_t:s0 key=(null)
type=AVC_PATH msg=audit(1163798448.239:231): 
path="/var/lib/hal/system-power-suspend-output"
type=AVC msg=audit(1163798448.261:232): avc:  denied  { getattr } for  pid=31370
comm="awk" name="system-power-suspend-output" dev=dm-0 ino=2060431
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lib_t:s0
tclass=file
type=SYSCALL msg=audit(1163798448.261:232): arch=40000003 syscall=197
success=yes exit=0 a0=2 a1=bfd3b854 a2=456e6ff4 a3=bfd3b854 items=0 ppid=31368
pid=31370 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=(none) comm="awk" exe="/bin/gawk" subj=system_u:system_r:hald_t:s0
key=(null)
type=AVC_PATH msg=audit(1163798448.261:232): 
path="/var/lib/hal/system-power-suspend-output"
type=AVC msg=audit(1163798454.674:233): avc:  denied  { write } for  pid=31448
comm="rm" name="hal" dev=dm-0 ino=2060499 scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:var_lib_t:s0 tclass=dir
type=AVC msg=audit(1163798454.674:233): avc:  denied  { remove_name } for 
pid=31448 comm="rm" name="system-power-suspend-output" dev=dm-0 ino=2060431
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lib_t:s0
tclass=dir
type=AVC msg=audit(1163798454.674:233): avc:  denied  { unlink } for  pid=31448
comm="rm" name="system-power-suspend-output" dev=dm-0 ino=2060431
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lib_t:s0
tclass=file
type=SYSCALL msg=audit(1163798454.674:233): arch=40000003 syscall=10 success=yes
exit=0 a0=bfc5068f a1=0 a2=805277c a3=bfc4f8b4 items=0 ppid=31447 pid=31448
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) comm="rm" exe="/bin/rm" subj=system_u:system_r:hald_t:s0 key=(null)
Comment 2 Daniel Walsh 2006-11-20 13:28:53 EST
Already fixed in selinux-policy-2.4.5-1
Comment 3 James Laska 2006-12-05 10:03:28 EST
No problems suspending laptop when testing with selinux-policy-2.4.6-3.el5
Comment 4 Jay Turner 2006-12-19 08:59:17 EST
selinux-policy-2.4.6-15.el5 included in 20061218.1 trees.

Note You need to log in before you can comment on or make changes to this bug.