This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 467212 - SELinux is preventing hal-acl-tool (hald_acl_t) "sys_resource" hald_acl_t.
SELinux is preventing hal-acl-tool (hald_acl_t) "sys_resource" hald_acl_t.
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
rawhide
All Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Ben Levenson
:
Depends On:
Blocks: F10Blocker/F10FinalBlocker
  Show dependency treegraph
 
Reported: 2008-10-16 08:22 EDT by Antonio A. Olivares
Modified: 2008-10-24 05:26 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-10-23 10:40:59 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Antonio A. Olivares 2008-10-16 08:22:47 EDT
Description of problem:
SELinux is preventing hal-acl-tool (hald_acl_t) "sys_resource" hald_acl_t.

Version-Release number of selected component (if applicable):
hal-0.5.12-3.20081013git.fc10

How reproducible:
Log in to desktop, setroubleshoot should click in and display denied avc 

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Summary:

SELinux is preventing hal-acl-tool (hald_acl_t) "sys_resource" hald_acl_t.

Detailed Description:

SELinux denied access requested by hal-acl-tool. It is not expected that this
access is required by hal-acl-tool and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                system_u:system_r:hald_acl_t:s0
Target Context                system_u:system_r:hald_acl_t:s0
Target Objects                None [ capability ]
Source                        hal-acl-tool
Source Path                   /usr/libexec/hal-acl-tool
Port                          <Unknown>
Host                          riohigh
Source RPM Packages           hal-0.5.12-3.20081013git.fc10
Target RPM Packages           
Policy RPM                    selinux-policy-3.5.10-3.fc10
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     riohigh
Platform                      Linux riohigh 2.6.27-3.fc10.i686 #1 SMP Fri Oct 10
                              01:26:26 EDT 2008 i686 athlon
Alert Count                   73
First Seen                    Sat 04 Oct 2008 11:10:27 AM CDT
Last Seen                     Thu 16 Oct 2008 06:33:03 AM CDT
Local ID                      16181f84-ddf2-4510-bd51-aef5ff647a63
Line Numbers                 

Raw Audit Messages           

node=riohigh type=AVC msg=audit(1224156783.891:89): avc:  denied  { sys_resource } for  pid=2568 comm="hal-acl-tool" capability=24 scontext=system_u:system_r:hald_acl_t:s0 tcontext=system_u:system_r:hald_acl_t:s0 tclass=capability

node=riohigh type=SYSCALL msg=audit(1224156783.891:89): arch=40000003 syscall=4 success=yes exit=2057 a0=5 a1=b7ff4000 a2=809 a3=809 items=0 ppid=1834 pid=2568 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="hal-acl-tool" exe="/usr/libexec/hal-acl-tool" subj=system_u:system_r:hald_acl_t:s0 key=(null)
Comment 1 Daniel Walsh 2008-10-23 10:40:59 EDT
You can allow this for now.

# audit2allow -M mypol -l -i /var/log/audit/audit.log
# semodule -i mypol.pp

Fixed in selinux-policy-3.5.13-6.fc10
Comment 2 Richard Hughes 2008-10-24 05:26:58 EDT
Cheers Daniel, appreciated.

Note You need to log in before you can comment on or make changes to this bug.