Bug 2365764 - SELinux policy preventing nut-monitor (upsmon) from creating sleep inhibitor
Summary: SELinux policy preventing nut-monitor (upsmon) from creating sleep inhibitor
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 42
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-05-12 22:27 UTC by Scott Shambarger
Modified: 2025-05-15 01:55 UTC (History)
7 users (show)

Fixed In Version: selinux-policy-41.40-1.fc42
Clone Of:
Environment:
Last Closed: 2025-05-15 01:55:58 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 2688 0 None open Allow nut-upsmon write systemd inhibit pipes 2025-05-13 07:30:10 UTC

Description Scott Shambarger 2025-05-12 22:27:24 UTC
SELinux policy currently doesn't allow nut_upsmon_t to write to fifo_file:systemd_logind_inhibit_var_run_t


Reproducible: Always

Steps to Reproduce:
1.Install/configure nut-client
2.Start nut-monitor
3.Run systemd-inhibit --list
Actual Results:
No upsmon sleep inhibitor is listed

Expected Results:
WHO            UID USER PID    COMM           WHAT  WHY                        >
upsmon         57  nut  435457 upsmon         sleep Careful handling of OS slee>


Additional Information:
Denial is:

type=AVC msg=audit(1747088012.000:22345): avc:  denied  { write } for  pid=1452 comm="upsmon" path="/run/systemd/inhibit/6237.ref" dev="tmpfs" ino=46602 scontext=system_u:system_r:nut_upsmon_t:s0 tcontext=system_u:object_r:systemd_logind_inhibit_var_run_t:s0 tclass=fifo_file permissive=0

Adding a module with the following rule allows upsmon to work correctly:

allow nut_upsmon_t systemd_logind_inhibit_var_run_t:fifo_file write;

Comment 1 Fedora Update System 2025-05-13 19:17:53 UTC
FEDORA-2025-5e64167ac4 (selinux-policy-41.40-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-5e64167ac4

Comment 2 Scott Shambarger 2025-05-13 19:43:38 UTC
Update fixes denial, karma added :)

Comment 3 Fedora Update System 2025-05-14 02:07:52 UTC
FEDORA-2025-5e64167ac4 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-5e64167ac4`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-5e64167ac4

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Fedora Update System 2025-05-15 01:55:58 UTC
FEDORA-2025-5e64167ac4 (selinux-policy-41.40-1.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.