Fedora Account System
Red Hat Associate
Red Hat Customer
Hash String generated from selinux-policy-3.6.32-41.fc12,catchall,upsd,upsd_t,upsd_t,capability,dac_override audit2allow suggests:
Please show me the entire avc message.
I am getting this error, too. The message in syslog is "SELinux is preventing /usr/sbin/upsd "dac_override' access." sealert shows raw audit messages of: node=<host> type=AVC msg=audit(1259091999.72:22): avc: denied {dac_override } for pid=1966 comm="upsd" capability=1 scontext=unconfined_u:system_r:upsd_t:s0 tcontext=unconfined_u:system_r:upsd_t:s0 tclass=capability node=<host> type=SYSCALL msg=audit(1259081999.73:22): arch=40000003 syscall=5 success=yes exit=4 a0=bf9a015c a1=0 a2=1b6 a3=80532db items=0 ppid=1965 pid=1966 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=1 comm="upsd" exe="/usr/sbin/upsd" subj=unconfined_u:system_r:upsd_t:s0 key=(null) HTH, Carl
You can add these rules for now using # grep avc /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Fixed in selinux-policy-3.6.32-50.fc12.noarch
Hello, These are the raw avc messages I'm having node=gadnio type=AVC msg=audit(1259165173.468:31): avc: denied { dac_override } for pid=1508 comm="upsd" capability=1 scontext=system_u:system_r:upsd_t:s0 tcontext=system_u:system_r:upsd_t:s0 tclass=capability node=gadnio type=SYSCALL msg=audit(1259165173.468:31): arch=c000003e syscall=42 success=no exit=-2 a0=6 a1=7fff761803b0 a2=6e a3=fffffff5 items=0 ppid=1 pid=1508 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="upsd" exe="/usr/sbin/upsd" subj=system_u:system_r:upsd_t:s0 key=(null) node=gadnio type=AVC msg=audit(1259165094.479:11): avc: denied { getattr } for pid=1515 comm="upsmon" laddr=127.0.0.1 lport=53768 faddr=127.0.0.1 fport=3493 scontext=system_u:system_r:upsmon_t:s0 tcontext=system_u:system_r:upsmon_t:s0 tclass=udp_socket node=gadnio type=SYSCALL msg=audit(1259165094.479:11): arch=c000003e syscall=51 success=yes exit=0 a0=3 a1=7fffa44a2638 a2=7fffa44a2844 a3=0 items=0 ppid=1513 pid=1515 auid=4294967295 uid=57 gid=57 euid=57 suid=57 fsuid=57 egid=57 sgid=57 fsgid=57 tty=(none) ses=4294967295 comm="upsmon" exe="/usr/sbin/upsmon" subj=system_u:system_r:upsmon_t:s0 key=(null) node=gadnio type=AVC msg=audit(1259165094.479:10): avc: denied { connect } for pid=1515 comm="upsmon" scontext=system_u:system_r:upsmon_t:s0 tcontext=system_u:system_r:upsmon_t:s0 tclass=udp_socket node=gadnio type=SYSCALL msg=audit(1259165094.479:10): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=1bc3a30 a2=10 a3=0 items=0 ppid=1513 pid=1515 auid=4294967295 uid=57 gid=57 euid=57 suid=57 fsuid=57 egid=57 sgid=57 fsgid=57 tty=(none) ses=4294967295 comm="upsmon" exe="/usr/sbin/upsmon" subj=system_u:system_r:upsmon_t:s0 key=(null) node=gadnio type=AVC msg=audit(1259165094.479:9): avc: denied { create } for pid=1515 comm="upsmon" scontext=system_u:system_r:upsmon_t:s0 tcontext=system_u:system_r:upsmon_t:s0 tclass=udp_socket node=gadnio type=SYSCALL msg=audit(1259165094.479:9): arch=c000003e syscall=41 success=yes exit=3 a0=2 a1=2 a2=0 a3=0 items=0 ppid=1513 pid=1515 auid=4294967295 uid=57 gid=57 euid=57 suid=57 fsuid=57 egid=57 sgid=57 fsgid=57 tty=(none) ses=4294967295 comm="upsmon" exe="/usr/sbin/upsmon" subj=system_u:system_r:upsmon_t:s0 key=(null)
I'm seeing this too. Noticed that ups fails to start automatically on bootup since yesterday. It appears to have started after the 11/27 batch of updates. I can start ups manually after bootup, but just saw this selinux message after doing so. The following is from /var/log/messages after yesterday's bootup: Nov 28 09:40:56 localhost upsd[1583]: listening on 127.0.0.1 port 3493 Nov 28 09:40:56 localhost upsd[1583]: listening on ::1 port 3493 Nov 28 09:40:56 localhost upsd[1583]: Can't connect to UPS [ups] (genericups-ups): No such file or directory Nov 28 09:40:56 localhost upsd[1583]: allowfrom in upsd.users is no longer used Nov 28 09:40:56 localhost upsd[1584]: Startup successful Nov 28 09:40:56 localhost upsmon[1587]: Startup successful Nov 28 09:40:56 localhost upsd[1584]: User monuser@::1 logged into UPS [ups] Nov 28 09:40:56 localhost upsmon[1588]: Poll UPS [ups@localhost] failed - Driver not connected Nov 28 09:40:56 localhost upsmon[1588]: Communications with UPS ups@localhost lost Nov 28 09:40:56 localhost wall[1592]: wall: user nut broadcasted 1 lines (44 chars)
ou can add these rules for now using # grep avc /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Fixed in selinux-policy-3.6.32-52.fc12.noarch
selinux-policy-3.6.32-52.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-52.fc12
Are you getting additional AVC messages on boot?
If you're asking me, then the answer is yes, with selinux-policy*-3.6.32-46.fc12.noarch.rpm I see the following additional AVCs at boot, when ups startup fails: ---- type=SYSCALL msg=audit(12/01/2009 21:32:23.416:28594) : arch=x86_64 syscall=unlink success=yes exit=0 a0=817e10 a1=816900 a2=816900 a3=4000 items=0 ppid=1 pid=2654 auid=andre uid=nut gid=nut euid=nut suid=nut fsuid=nut egid=nut sgid=nut fsgid=nut tty=(none) ses=1 comm=genericups exe=/sbin/genericups subj=unconfined_u:system_r:upsdrvctl_t:s0 key=(null) type=AVC msg=audit(12/01/2009 21:32:23.416:28594) : avc: denied { unlink } for pid=2654 comm=genericups name=genericups-ups dev=dm-0 ino=2622275 scontext=unconfined_u:system_r:upsdrvctl_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file
No change with selinux-policy*-3.6.32-49.fc12.noarch.rpm. The ups service fails to start on bootup, corresponding to AVCs type=SYSCALL msg=audit(12/02/2009 00:14:34.067:29964) : arch=x86_64 syscall=unlink success=yes exit=0 a0=ff9e10 a1=ff8900 a2=ff8900 a3=4000 items=0 ppid=1 pid=2842 auid=andre uid=nut gid=nut euid=nut suid=nut fsuid=nut egid=nut sgid=nut fsgid=nut tty=(none) ses=1 comm=genericups exe=/sbin/genericups subj=unconfined_u:system_r:upsdrvctl_t:s0 key=(null) type=AVC msg=audit(12/02/2009 00:14:34.067:29964) : avc: denied { unlink } for pid=2842 comm=genericups name=genericups-ups dev=dm-0 ino=2622275 scontext=unconfined_u:system_r:upsdrvctl_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file and I can then start ups manually, but the dac_override selinux message is generated, corresponding to AVCs type=SYSCALL msg=audit(12/02/2009 00:17:28.929:29753) : arch=x86_64 syscall=unlink success=yes exit=0 a0=60e7c0 a1=1 a2=3cb9573330 a3=4000 items=0 ppid=2709 pid=2710 auid=andre uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=1 comm=upsd exe=/usr/sbin/upsd subj=unconfined_u:system_r:upsd_t:s0 key=(null) type=AVC msg=audit(12/02/2009 00:17:28.929:29753) : avc: denied { dac_override } for pid=2710 comm=upsd capability=dac_override scontext=unconfined_u:system_r:upsd_t:s0 tcontext=unconfined_u:system_r:upsd_t:s0 tclass=capability
Created attachment 375422 [details] New nut policy Could you install this nut.pp policy file to see if it solves your problem. semodule -i nut.pp
Fixed in selinux-policy-3.6.32-53.fc12.noarch
Is this supposed to survive a reboot? I don't see any filesystem changes that would indicate that it could. The ups service still fails to start on bootup, but if I run "semodule -i nut.pp" just before "service ups start", I don't get the selinux warning.
Yes it is supposed to survive a reboot. Could you execute # semodule -DB # reboot Gather all of the AVC messages about ups # semodule -B This will generate lots of AVC messages that you can ignore but might get us to the root of your problem.
Created attachment 375565 [details] output of "ausearch -m avc -i" before reboot
Created attachment 375567 [details] output of "ausearch -m avc -i" after reboot
setsebool -P allow_xserver_execmem 1 Which should remove the execstack error on xserver If you want to run wine apps you need to turn on the mmap_low_allowed boolean # setsebool -P mmap_low_allowed 1 It does not look like you installed the module that I attached either.
I ran the command "semodule -i nut.pp" earlier as you indicated in comment #11. Did it need to be run again after the commands in comment #18?
no, it should not have had to.
Updated to selinux-policy*-3.6.32-53.fc12.noarch from Koji and rebooted. Ups still fails to start at boot, still get the dac_override when starting manually, and in addition, a 25-second delay for the password prompt for su.
selinux-policy-3.6.32-52.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-12549
Andre could you attach the output of ausearch -m AVC recent to show the DAC_OVERRIDE problem. Also could you check if the delay is related to selinux by executing setenforce 0 and seeing if the su timeout still happens.
Do you want me to test 52 or 53 (I've already reverted to 49 so will have to update again)? Also, I would rather not turn selinux off completely, as mentioned in the other bug report. There seem to be other people seeing the same problem with su so I'd rather let them test that. Also, have my selinux upgrades and downgrades eliminated the effect of the "semodule -i nut.pp" command I ran earlier, or do I need do something for that? Where is the change in the file system which allows the effect of this command to survive reboots? I couldn't see any - there is a file /usr/share/selinux/targeted/nut.pp.bz2 belonging to selinux-policy-targeted, but it didn't change, since "rpm -V selinux-policy-targeted" verified after running this command. There is also a file /etc/selinux/targeted/modules/active/modules/nut.pp which does not belong to any package.
Andre you can upgrade to 53 to test it out. Yes the nut.pp you installed has been overridden. But 53 should have the equivalent.
I updated to 53, saved the ausearch output, rebooted, started ups manually (generating the selinux warning), then saved the ausearch output again. The only difference was type=SYSCALL msg=audit(12/03/2009 14:27:44.042:30171) : arch=x86_64 syscall=unlink success=yes exit=0 a0=60e7c0 a1=1 a2=3cb9573330 a3=4000 items=0 ppid=2726 pid=2727 auid=andre uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=1 comm=upsd exe=/usr/sbin/upsd subj=unconfined_u:system_r:nut_upsd_t:s0 key=(null) type=AVC msg=audit(12/03/2009 14:27:44.042:30171) : avc: denied { dac_override } for pid=2727 comm=upsd capability=dac_override scontext=unconfined_u:system_r:nut_upsd_t:s0 tcontext=unconfined_u:system_r:nut_upsd_t:s0 tclass=capability which happened when I started ups manually.
selinux-policy-3.6.32-55.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-55.fc12
Updated to 55, saved the ausearch output, rebooted, started ups manually after it failed to start automatically (no selinux warning anymore, at least), saved ausearch output again. There is no difference this time. The su password delay is also gone.
So now you only fail to start on boot. If you boot in permissive mode does the ups service start?
Went to System->Administration->SELinux Management, changed System Default Enforcing Mode from Enforcing to Permissive, and rebooted. Ups still fails to start automatically, the following appears in /var/log/messages (same as before, I think): Dec 3 17:13:24 localhost upsd[1624]: listening on 127.0.0.1 port 3493 Dec 3 17:13:24 localhost upsd[1624]: listening on ::1 port 3493 Dec 3 17:13:24 localhost upsd[1624]: Can't connect to UPS [ups] (genericups-ups ): No such file or directory Dec 3 17:13:24 localhost upsd[1624]: allowfrom in upsd.users is no longer used Dec 3 17:13:24 localhost upsd[1625]: Startup successful Dec 3 17:13:24 localhost upsmon[1628]: Startup successful Dec 3 17:13:24 localhost upsd[1625]: User monuser@::1 logged into UPS [ups] Dec 3 17:13:24 localhost upsmon[1629]: Poll UPS [ups@localhost] failed - Driver not connected Dec 3 17:13:24 localhost upsmon[1629]: Communications with UPS ups@localhost lo st Dec 3 17:13:24 localhost wall[1633]: wall: user nut broadcasted 1 lines (44 cha rs) Have now changed System Default Enforcing Mode and Current Enforcing Mode back to Enforcing.
I would open a bug with the ups guys. I don't beleive this is SELinux related at this point.
Created bug #544121. Feel free to close this bug if no one else objects.
I will close when -55 gets released.
selinux-policy-3.6.32-55.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-12650
selinux-policy-3.6.32-55.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.
selinux-policy-3.6.32-120.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-120.fc12
selinux-policy-3.6.32-120.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.