Bug 430437 - cnsole-kit-daemon massive errors
cnsole-kit-daemon massive errors
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
rawhide
All Linux
low Severity low
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-01-27 21:04 EST by Jim Cornette
Modified: 2008-01-30 11:33 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-01-30 11:33:03 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
console-kit-daemon error search (3.11 KB, text/plain)
2008-01-27 21:04 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "sys_nice" to <Unknown> (system_dbusd_t). Detailed Description (2.63 KB, text/plain)
2008-01-27 21:27 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "sys_ptrace" to <Unknown> (system_dbusd_t). (2.92 KB, text/plain)
2008-01-27 21:29 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "getattr" to /proc/2643/stat (polkit_auth_t). (2.94 KB, text/plain)
2008-01-27 21:31 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "getattr" to /var/log/ConsoleKit/history (var_log_t). (2.97 KB, text/plain)
2008-01-27 21:32 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "getattr" to /proc/2403/stat (xdm_t). (2.92 KB, text/plain)
2008-01-27 21:34 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "read" to <Unknown> (var_log_t) (2.87 KB, text/plain)
2008-01-27 21:35 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "search" to <Unknown> (hald_t). (3.08 KB, text/plain)
2008-01-27 21:36 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "search" to <Unknown> (var_log_t). (3.10 KB, text/plain)
2008-01-27 21:37 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "search" to <Unknown> (xdm_t). (3.12 KB, text/plain)
2008-01-27 21:38 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "sys_nice" to <Unknown> (system_dbusd_t). (2.63 KB, text/plain)
2008-01-27 21:39 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "sys_ptrace" to <Unknown> (system_dbusd_t). (2.84 KB, text/plain)
2008-01-27 21:40 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "getattr" to /proc/2152/stat (hald_t). (2.89 KB, text/plain)
2008-01-27 21:41 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "getattr" to /proc/2947/stat (polkit_auth_t). (2.92 KB, text/plain)
2008-01-27 21:42 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "getattr" to /proc/2939/environ (unconfined_t). (2.94 KB, text/plain)
2008-01-27 21:43 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "ptrace" to <Unknown> (hald_t). (2.58 KB, text/plain)
2008-01-27 21:46 EST, Jim Cornette
no flags Details
SELinux prevented console-kit-dae(/usr/sbin/console-kit-daemon) from using the terminal <Unknown> (2.66 KB, text/plain)
2008-01-27 21:48 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "search" to <Unknown> (system_crond_var_lib_t). (3.16 KB, text/plain)
2008-01-27 21:49 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "getattr" to pipe (system_dbusd_t). (2.65 KB, text/plain)
2008-01-27 21:50 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "getsched" to <Unknown> (system_dbusd_t). (2.62 KB, text/plain)
2008-01-27 21:51 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "getsched" to <Unknown> (system_dbusd_t). (2.86 KB, text/plain)
2008-01-27 21:52 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "setattr" to <Unknown> (var_log_t). (2.86 KB, text/plain)
2008-01-27 21:53 EST, Jim Cornette
no flags Details
Module to workaround most "sound" issues (1.88 KB, text/plain)
2008-01-28 10:17 EST, Tom London
no flags Details
.te generated for shutdown issues (1.01 KB, text/plain)
2008-01-28 10:18 EST, Tom London
no flags Details
"Magic" allow needed by both sound and shutdown (201 bytes, text/plain)
2008-01-28 10:20 EST, Tom London
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (consolekit_t) "execute" to <Unknown> (polkit_auth_exec_t). (2.80 KB, text/plain)
2008-01-29 23:32 EST, Jim Cornette
no flags Details
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (consolekit_t) "read" to <Unknown> (usr_t). (2.74 KB, text/plain)
2008-01-29 23:34 EST, Jim Cornette
no flags Details

  None (edit)
Description Jim Cornette 2008-01-27 21:04:51 EST
Description of problem:


Version-Release number of selected component (if applicable):
selinux-policy-3.2.5-19.fc9.noarch

How reproducible:
Update to current policy

Steps to Reproduce:
1. Log onto system in permissive mode
2. Get sound back but many errors reported
3. start from error 1
  
Actual results:
Could not get sound or shut down via shutdown on menu

Expected results:
Able to log in.

Additional info:
Comment 1 Jim Cornette 2008-01-27 21:04:51 EST
Created attachment 293096 [details]
console-kit-daemon error search
Comment 2 Jim Cornette 2008-01-27 21:27:25 EST
Created attachment 293098 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (system_dbusd_t) "sys_nice" to <Unknown> (system_dbusd_t). Detailed Description

Many errors related to SELinux and console-kit-daemon second error
Comment 3 Jim Cornette 2008-01-27 21:29:55 EST
Created attachment 293099 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "sys_ptrace" to <Unknown> (system_dbusd_t).
Comment 4 Jim Cornette 2008-01-27 21:31:07 EST
Created attachment 293100 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "getattr" to /proc/2643/stat (polkit_auth_t).
Comment 5 Jim Cornette 2008-01-27 21:32:50 EST
Created attachment 293102 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "getattr" to /var/log/ConsoleKit/history (var_log_t).
Comment 6 Jim Cornette 2008-01-27 21:34:15 EST
Created attachment 293103 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "getattr" to /proc/2403/stat (xdm_t).
Comment 7 Jim Cornette 2008-01-27 21:35:39 EST
Created attachment 293104 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "read" to <Unknown> (var_log_t)
Comment 8 Jim Cornette 2008-01-27 21:36:35 EST
Created attachment 293105 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "search" to <Unknown> (hald_t).
Comment 9 Jim Cornette 2008-01-27 21:37:31 EST
Created attachment 293106 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "search" to <Unknown> (var_log_t).
Comment 10 Jim Cornette 2008-01-27 21:38:36 EST
Created attachment 293107 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "search" to <Unknown> (xdm_t).
Comment 11 Jim Cornette 2008-01-27 21:39:38 EST
Created attachment 293108 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "sys_nice" to <Unknown> (system_dbusd_t).
Comment 12 Jim Cornette 2008-01-27 21:40:32 EST
Created attachment 293109 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "sys_ptrace" to <Unknown> (system_dbusd_t).
Comment 13 Jim Cornette 2008-01-27 21:41:25 EST
Created attachment 293110 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "getattr" to /proc/2152/stat (hald_t).
Comment 14 Jim Cornette 2008-01-27 21:42:28 EST
Created attachment 293111 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "getattr" to /proc/2947/stat (polkit_auth_t).
Comment 15 Jim Cornette 2008-01-27 21:43:26 EST
Created attachment 293112 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "getattr" to /proc/2939/environ (unconfined_t).
Comment 16 Jim Cornette 2008-01-27 21:46:01 EST
Created attachment 293113 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "ptrace" to <Unknown> (hald_t).
Comment 17 Jim Cornette 2008-01-27 21:48:00 EST
Created attachment 293114 [details]
SELinux prevented console-kit-dae(/usr/sbin/console-kit-daemon) from using the
terminal <Unknown>
Comment 18 Jim Cornette 2008-01-27 21:49:14 EST
Created attachment 293115 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "search" to <Unknown> (system_crond_var_lib_t).
Comment 19 Jim Cornette 2008-01-27 21:50:45 EST
Created attachment 293116 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "getattr" to pipe (system_dbusd_t).
Comment 20 Jim Cornette 2008-01-27 21:51:59 EST
Created attachment 293118 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "getsched" to <Unknown> (system_dbusd_t).
Comment 21 Jim Cornette 2008-01-27 21:52:46 EST
Created attachment 293119 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "getsched" to <Unknown> (system_dbusd_t).
Comment 22 Jim Cornette 2008-01-27 21:53:58 EST
Created attachment 293120 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon)
(system_dbusd_t) "setattr" to <Unknown> (var_log_t).
Comment 23 Jim Cornette 2008-01-27 21:56:23 EST
End of SELinux error bomb related to console-kit-daemon
Some descriptions could be off in early attachments. 
Comment 24 Tom London 2008-01-28 09:43:43 EST
As reported on selinux-list, there is one additional AVC that only shows its
head when 'semodule -DB' is run:

type=AVC msg=audit(1201380657.580:110): avc:  denied  { sys_tty_config
} for  pid=2474 comm="console-kit-dae" capability=26
scontext=system_u:system_r:system_dbusd_t:s0
tcontext=system_u:system_r:system_dbusd_t:s0 tclass=capability
type=SYSCALL msg=audit(1201380657.580:110): arch=40000003 syscall=54
success=yes exit=0 a0=c a1=5603 a2=bfd48356 a3=c items=0 ppid=1
pid=2474 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="console-kit-dae"
exe="/usr/sbin/console-kit-daemon"
subj=system_u:system_r:system_dbusd_t:s0 key=(null)

or

#============= system_dbusd_t ==============
allow system_dbusd_t self:capability sys_tty_config;

This appears needed for console-kit both for "sound" as well as for "shutdown".
Comment 25 Tom London 2008-01-28 10:17:23 EST
Created attachment 293160 [details]
Module to workaround most "sound" issues

First of 3 .te files that seem to workaround sound and shutdown issues.

The first 2 were done with "blunt hammer": all generated AVCs were fed to
"audit2allow -M".

This one captures the sound related AVCs.
Comment 26 Tom London 2008-01-28 10:18:28 EST
Created attachment 293161 [details]
.te generated for shutdown issues

.te file generated from AVCs generated after selecting "shutdown" from gnome
menue.
Comment 27 Tom London 2008-01-28 10:20:26 EST
Created attachment 293162 [details]
"Magic" allow needed by both sound and shutdown

This last AVC only appeared when I turned off the "dontaudit" rules via
"semodule -DB".

Adding this with the previous 2 makes both "sound" and "shutdown" work.
Comment 28 Jim Cornette 2008-01-29 23:32:46 EST
Created attachment 293365 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (consolekit_t) "execute" to <Unknown> (polkit_auth_exec_t). 

I don't believe this error was listed, most errors seem to be not present in
enforcing. This error was generated during shutdown from the system menu. Error
1 of 2
Comment 29 Jim Cornette 2008-01-29 23:34:43 EST
Created attachment 293366 [details]
SELinux is preventing console-kit-dae(/usr/sbin/console-kit-daemon) (consolekit_t) "read" to <Unknown> (usr_t). 

Likewise generated when attempting to shut down system from menu. 2 of 2 errors
generated.
Comment 30 Tom London 2008-01-30 09:38:24 EST
selinux-policy-3.2.5-21.fc9.noarch fixes these for me.

Note You need to log in before you can comment on or make changes to this bug.