Fedora Account System
Red Hat Associate
Red Hat Customer
Summary: SELinux is preventing /usr/sbin/NetworkManager "write" access on /var/lib. Detailed Description: SELinux denied access requested by NetworkManager. It is not expected that this access is required by NetworkManager and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context system_u:system_r:NetworkManager_t:s0 Target Context system_u:object_r:var_lib_t:s0 Target Objects /var/lib [ dir ] Source NetworkManager Source Path /usr/sbin/NetworkManager Port <Unknown> Host (removed) Source RPM Packages NetworkManager-0.7.996-7.git20091113.fc13 Target RPM Packages filesystem-2.4.31-1.fc13 Policy RPM selinux-policy-3.6.32-41.fc12 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name (removed) Platform Linux (removed) 2.6.31.5-127.fc12.x86_64 #1 SMP Sat Nov 7 21:11:14 EST 2009 x86_64 x86_64 Alert Count 3 First Seen Sun 15 Nov 2009 11:44:20 PM MSK Last Seen Mon 16 Nov 2009 08:13:22 AM MSK Local ID f0dd6c14-2baa-4448-80c1-d283e971e3c3 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1258348402.771:7): avc: denied { write } for pid=1170 comm="NetworkManager" name="lib" dev=dm-0 ino=24579 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir node=(removed) type=SYSCALL msg=audit(1258348402.771:7): arch=c000003e syscall=83 success=no exit=-13 a0=e63d50 a1=1ed a2=72 a3=7ffff2c53150 items=0 ppid=1169 pid=1170 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="NetworkManager" exe="/usr/sbin/NetworkManager" subj=system_u:system_r:NetworkManager_t:s0 key=(null) Hash String generated from selinux-policy-3.6.32-41.fc12,catchall,NetworkManager,NetworkManager_t,var_lib_t,dir,write audit2allow suggests: #============= NetworkManager_t ============== allow NetworkManager_t var_lib_t:dir write;
Is NetworkManager trying to create the wicd dir? Or is this something new? If it is the wicd dir, you can create the dir and restorecon it and networkmanager should work fine.
This bug appears to have been reported against 'rawhide' during the Fedora 12 development cycle. Changing version to '12'. More information and reason for this action is here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping
I don't really know, all work just fine, but SELinux zenity popup has appeared.
Dan any ideas?
Yeah, we now write some state files to /var/lib/NetworkManager. That's now in F13/devel and F12-updates-testing.
Dan, Keep me informed when you create new directories that network manager needs to write to. Fixed in selinux-policy-3.6.32-47.fc12.noarch
BTW /var/lib/NetworkManager should be in the payload.
Sorry, will do. Good point, I will add that dir to the RPM for the next round of updates. Note that this has not hit F12 yet, so by the time it does, the SELinux rules will be out. Thanks!
This bug has now been seen on F11 system, brought on by NetworkManager.i586 1:0.7.2-1.fc11 update.
Yeah, patch was backported to F11 as well; I need to do better keeping dwalsh informed...
Miroslav, can you get an update out for this fast.
Added to selinux-policy-3.6.12-92.fc11
works now with latest versions
*** Bug 545726 has been marked as a duplicate of this bug. ***
Updated Fedora 11 Leonidas exhibited issue on 14 December. 2.6.30.9-102.fc11.i686.PAE Update results in: selinux-policy-3.6.12-91.fc11
I had just logged in and noticed the SELinux icon. This has been accumulating violations before I logged in.
I am experiencing this same bug in F11. I am running selinux-policy-3.6.12-92.fc11 and kernel 2.6.30.9-102.fc11.i586. I tried restorecon -v '/var/lib' but the context remained system_u:object_r:var_lib_t:s0. /var/lib/NetworkManager however has the context system_u:object_r:NetworkManager_var_lib_t:s0 which I assume is right. Interestingly NetworkManager connects faster and more reliably with this bug in effect.
Hi there, Just to report that today's update >> selinux-policy-3.6.12-92.fc11 << fixed the problem on my system. Thanks. BTW. kernel 2.6.30.9-102.fc11.i586
(In reply to comment #17) > I am experiencing this same bug in F11. I am running > selinux-policy-3.6.12-92.fc11 and kernel 2.6.30.9-102.fc11.i586. I tried > restorecon -v '/var/lib' but the context remained > system_u:object_r:var_lib_t:s0. /var/lib/NetworkManager however has the > context system_u:object_r:NetworkManager_var_lib_t:s0 which I assume is right. > Interestingly NetworkManager connects faster and more reliably with this bug in > effect. It is fixed now.
I'm afraid that it has returned. I started getting boot errors referencing NetworkManager,"** (NetworkManager:1669): WARNING **: State file /var/lib/NetworkManager/NetworkManager.state parsing failed: (2) Failed to create file '/var/lib/NetworkManager/NetworkManager.state.M14J6U': Permission denied." as well as the SELinux alert mentioned in comment 1. This started after I changed it from DHCP to a static IP manually. The network is working inspite of the errors/warnings.
What does restorecon -R -v /var/lib/NetworkManager Output?
restorecon reset /var/lib/NetworkManager context system_u:object_r:var_lib_t:s0->system_u:object_r:NetworkManager_var_lib_t:s0 Looks like that may have fixed it, I'll try a reboot to see if it works.
Okay, no more boot errors and no new SELinux alert. The old SELinux Troubleshooter used to display suggested "fixes", this new one doesn't seem to. I'm never sure what options to use.
Yes, if something is removing this file and recreating it, we have a bug.
I meant directory. Yes, if something is removing this directory (/var/lib/NetworkManager) and recreating it, we have a bug.
hi update's have fix it for me thanks
Thanks, closing.