The following was filed automatically by setroubleshoot: Summary: SELinux is preventing modem-manager (ModemManager_t) "read" device_t. Detailed Description: SELinux denied access requested by modem-manager. It is not expected that this access is required by modem-manager and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:ModemManager_t:s0-s0:c0.c1023 Target Context unconfined_u:object_r:device_t:s0 Target Objects \x2fdevices\x2fpci0000:00\x2f0000:00:1a.7\x2fusb1\ x2f1-2 [ file ] Source modem-manager Source Path /usr/sbin/modem-manager Port <Unknown> Host (removed) Source RPM Packages ModemManager-0.2-3.20090707.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.26-4.fc12 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name (removed) Platform Linux (removed) 2.6.31-0.122.rc5.git2.fc12.x86_64 #1 SMP Mon Aug 3 12:58:47 EDT 2009 x86_64 x86_64 Alert Count 2 First Seen Sun 09 Aug 2009 01:06:19 PM PDT Last Seen Sun 09 Aug 2009 01:06:19 PM PDT Local ID 6da9bdbc-65ae-4c95-a210-81c3ef5c2e7f Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1249848379.303:28352): avc: denied { read } for pid=1234 comm="modem-manager" name="\x2fdevices\x2fpci0000:00\x2f0000:00:1a.7\x2fusb1\x2f1-2" dev=tmpfs ino=1049297 scontext=system_u:system_r:ModemManager_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:device_t:s0 tclass=file node=(removed) type=AVC msg=audit(1249848379.303:28352): avc: denied { open } for pid=1234 comm="modem-manager" name="\x2fdevices\x2fpci0000:00\x2f0000:00:1a.7\x2fusb1\x2f1-2" dev=tmpfs ino=1049297 scontext=system_u:system_r:ModemManager_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:device_t:s0 tclass=file node=(removed) type=SYSCALL msg=audit(1249848379.303:28352): arch=c000003e syscall=2 success=yes exit=0 a0=7fff7fadf0f0 a1=0 a2=1b6 a3=238 items=0 ppid=1 pid=1234 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modem-manager" exe="/usr/sbin/modem-manager" subj=system_u:system_r:ModemManager_t:s0-s0:c0.c1023 key=(null) audit2allow suggests: #============= ModemManager_t ============== allow ModemManager_t device_t:file { read open };
Just plugged in my phone (in mass storage mode, but MM likely doesn't know this). Probably related to NM/MM switching from hal to udev for device detection? -- Fedora Bugzappers volunteer triage team https://fedoraproject.org/wiki/BugZappers
Either udev or some udev scripts are creating mislabled files undev /dev/.udev/db/ On my machine I see find /dev/.udev/db/ -type f -printf "%p %Z\n" | grep device_t/dev/.udev/db/\x2fdevices\x2fplatform\x2fhost7\x2fsession3\x2ftarget7:0:0\x2f7:0:0:0\x2fblock\x2fsdb\x2fsdb1 unconfined_u:object_r:device_t:s0 /dev/.udev/db/\x2fdevices\x2fplatform\x2fhost7\x2fsession3\x2ftarget7:0:0\x2f7:0:0:1\x2fblock\x2fsdc\x2fsdc1 unconfined_u:object_r:device_t:s0 /dev/.udev/db/\x2fdevices\x2fplatform\x2fhost7\x2fsession3\x2ftarget7:0:0\x2f7:0:0:4\x2fblock\x2fsdf unconfined_u:object_r:device_t:s0 /dev/.udev/db/\x2fdevices\x2fplatform\x2fhost7\x2fsession3\x2ftarget7:0:0\x2f7:0:0:0\x2fblock\x2fsdb unconfined_u:object_r:device_t:s0 /dev/.udev/db/\x2fdevices\x2fplatform\x2fhost7\x2fsession3\x2ftarget7:0:0\x2f7:0:0:3\x2fblock\x2fsde unconfined_u:object_r:device_t:s0 /dev/.udev/db/\x2fdevices\x2fplatform\x2fhost7\x2fsession3\x2ftarget7:0:0\x2f7:0:0:2\x2fblock\x2fsdd unconfined_u:object_r:device_t:s0 /dev/.udev/db/\x2fdevices\x2fplatform\x2fhost7\x2fsession3\x2ftarget7:0:0\x2f7:0:0:1\x2fblock\x2fsdc unconfined_u:object_r:device_t:s0 /dev/.udev/db/\x2fdevices\x2fpci0000:00\x2f0000:00:02.0\x2fdrm\x2fcard0 unconfined_u:object_r:device_t:s0 /dev/.udev/db/\x2fdevices\x2fpci0000:00\x2f0000:00:1a.7\x2fusb1\x2f1-4 unconfined_u:object_r:device_t:s0 /dev/.udev/db/\x2fdevices\x2fpci0000:00\x2f0000:00:1a.0\x2fusb3\x2f3-1 unconfined_u:object_r:device_t:s0
Odd, all mine are fine here on F11... can you try relabeling and see if, when you plug a modem in, it still gets unconfined_t created on its' device node?
as dan walsh (oh lordy, another dan w, it's a conspiracy!) said, it's a udev issue, correctly assigned there - I just mentioned it to you while judging the short-term impact. -- Fedora Bugzappers volunteer triage team https://fedoraproject.org/wiki/BugZappers
This bug appears to have been reported against 'rawhide' during the Fedora 12 development cycle. Changing version to '12'. More information and reason for this action is here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Adam is this still happening for you in RHEL6?
I have no idea, I don't have any systems that run RHEL.
Ok Does it still happen on F12?
I'm on Rawhide now. :) afaict it's not happening there - I'm not entirely sure whether selinux alert notification is working right in Rawhide, but if I tail /var/log/messages and plug in my phone, I don't see any selinux / audit messages.
Well we can hope that this has been fixed.
Haven't seen anything like this in Fedora for years. No idea about RHEL though.