Bug 540225 - SELinux is preventing /usr/sbin/upsd "dac_override" access.
Summary: SELinux is preventing /usr/sbin/upsd "dac_override" access.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 12
Hardware: x86_64
OS: Linux
low
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:bb15efea64b...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-11-22 19:43 UTC by hristo ivanov
Modified: 2010-08-20 01:45 UTC (History)
4 users (show)

Fixed In Version: selinux-policy-3.6.32-120.fc12
Clone Of:
Environment:
Last Closed: 2009-12-07 22:46:37 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
New nut policy (190.72 KB, application/octet-stream)
2009-12-02 12:58 UTC, Daniel Walsh
no flags Details
output of "ausearch -m avc -i" before reboot (78.32 KB, text/plain)
2009-12-02 19:34 UTC, Andre Robatino
no flags Details
output of "ausearch -m avc -i" after reboot (548.78 KB, text/plain)
2009-12-02 19:35 UTC, Andre Robatino
no flags Details

Description hristo ivanov 2009-11-22 19:43:48 UTC
Hash String generated from  selinux-policy-3.6.32-41.fc12,catchall,upsd,upsd_t,upsd_t,capability,dac_override
audit2allow suggests:

Comment 1 Daniel Walsh 2009-11-23 16:45:25 UTC
Please show me the entire avc message.

Comment 2 Carl Sopchak 2009-11-24 17:22:32 UTC
I am getting this error, too.

The message in syslog is "SELinux is preventing /usr/sbin/upsd "dac_override' access."

sealert shows raw audit messages of:

node=<host> type=AVC msg=audit(1259091999.72:22): avc: denied {dac_override } for pid=1966 comm="upsd" capability=1 scontext=unconfined_u:system_r:upsd_t:s0 tcontext=unconfined_u:system_r:upsd_t:s0 tclass=capability

node=<host> type=SYSCALL msg=audit(1259081999.73:22): arch=40000003 syscall=5 success=yes exit=4 a0=bf9a015c a1=0 a2=1b6 a3=80532db items=0 ppid=1965 pid=1966 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=1 comm="upsd" exe="/usr/sbin/upsd" subj=unconfined_u:system_r:upsd_t:s0 key=(null)

HTH,

Carl

Comment 3 Daniel Walsh 2009-11-24 20:02:58 UTC
You can add these rules for now using

# grep avc /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Fixed in selinux-policy-3.6.32-50.fc12.noarch

Comment 4 hristo ivanov 2009-11-25 16:11:36 UTC
Hello,
These are the raw avc messages I'm having


node=gadnio type=AVC msg=audit(1259165173.468:31): avc: denied { dac_override } for pid=1508 comm="upsd" capability=1 scontext=system_u:system_r:upsd_t:s0 tcontext=system_u:system_r:upsd_t:s0 tclass=capability node=gadnio type=SYSCALL msg=audit(1259165173.468:31): arch=c000003e syscall=42 success=no exit=-2 a0=6 a1=7fff761803b0 a2=6e a3=fffffff5 items=0 ppid=1 pid=1508 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="upsd" exe="/usr/sbin/upsd" subj=system_u:system_r:upsd_t:s0 key=(null) 

node=gadnio type=AVC msg=audit(1259165094.479:11): avc: denied { getattr } for pid=1515 comm="upsmon" laddr=127.0.0.1 lport=53768 faddr=127.0.0.1 fport=3493 scontext=system_u:system_r:upsmon_t:s0 tcontext=system_u:system_r:upsmon_t:s0 tclass=udp_socket node=gadnio type=SYSCALL msg=audit(1259165094.479:11): arch=c000003e syscall=51 success=yes exit=0 a0=3 a1=7fffa44a2638 a2=7fffa44a2844 a3=0 items=0 ppid=1513 pid=1515 auid=4294967295 uid=57 gid=57 euid=57 suid=57 fsuid=57 egid=57 sgid=57 fsgid=57 tty=(none) ses=4294967295 comm="upsmon" exe="/usr/sbin/upsmon" subj=system_u:system_r:upsmon_t:s0 key=(null) 

node=gadnio type=AVC msg=audit(1259165094.479:10): avc: denied { connect } for pid=1515 comm="upsmon" scontext=system_u:system_r:upsmon_t:s0 tcontext=system_u:system_r:upsmon_t:s0 tclass=udp_socket node=gadnio type=SYSCALL msg=audit(1259165094.479:10): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=1bc3a30 a2=10 a3=0 items=0 ppid=1513 pid=1515 auid=4294967295 uid=57 gid=57 euid=57 suid=57 fsuid=57 egid=57 sgid=57 fsgid=57 tty=(none) ses=4294967295 comm="upsmon" exe="/usr/sbin/upsmon" subj=system_u:system_r:upsmon_t:s0 key=(null) 

node=gadnio type=AVC msg=audit(1259165094.479:9): avc: denied { create } for pid=1515 comm="upsmon" scontext=system_u:system_r:upsmon_t:s0 tcontext=system_u:system_r:upsmon_t:s0 tclass=udp_socket node=gadnio type=SYSCALL msg=audit(1259165094.479:9): arch=c000003e syscall=41 success=yes exit=3 a0=2 a1=2 a2=0 a3=0 items=0 ppid=1513 pid=1515 auid=4294967295 uid=57 gid=57 euid=57 suid=57 fsuid=57 egid=57 sgid=57 fsgid=57 tty=(none) ses=4294967295 comm="upsmon" exe="/usr/sbin/upsmon" subj=system_u:system_r:upsmon_t:s0 key=(null)

Comment 5 Andre Robatino 2009-11-29 17:10:02 UTC
I'm seeing this too.  Noticed that ups fails to start automatically on bootup since yesterday.  It appears to have started after the 11/27 batch of updates.  I can start ups manually after bootup, but just saw this selinux message after doing so.  The following is from /var/log/messages after yesterday's bootup:

Nov 28 09:40:56 localhost upsd[1583]: listening on 127.0.0.1 port 3493
Nov 28 09:40:56 localhost upsd[1583]: listening on ::1 port 3493
Nov 28 09:40:56 localhost upsd[1583]: Can't connect to UPS [ups] (genericups-ups): No such file or directory
Nov 28 09:40:56 localhost upsd[1583]: allowfrom in upsd.users is no longer used
Nov 28 09:40:56 localhost upsd[1584]: Startup successful
Nov 28 09:40:56 localhost upsmon[1587]: Startup successful
Nov 28 09:40:56 localhost upsd[1584]: User monuser@::1 logged into UPS [ups]
Nov 28 09:40:56 localhost upsmon[1588]: Poll UPS [ups@localhost] failed - Driver not connected
Nov 28 09:40:56 localhost upsmon[1588]: Communications with UPS ups@localhost lost
Nov 28 09:40:56 localhost wall[1592]: wall: user nut broadcasted 1 lines (44 chars)

Comment 6 Daniel Walsh 2009-11-30 21:50:59 UTC
ou can add these rules for now using

# grep avc /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Fixed in selinux-policy-3.6.32-52.fc12.noarch

Comment 7 Fedora Update System 2009-12-01 16:51:16 UTC
selinux-policy-3.6.32-52.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-52.fc12

Comment 8 Daniel Walsh 2009-12-01 21:06:29 UTC
Are you getting additional AVC messages on boot?

Comment 9 Andre Robatino 2009-12-02 02:39:40 UTC
If you're asking me, then the answer is yes, with selinux-policy*-3.6.32-46.fc12.noarch.rpm I see the following additional AVCs at boot, when ups startup fails:

----
type=SYSCALL msg=audit(12/01/2009 21:32:23.416:28594) : arch=x86_64 syscall=unlink success=yes exit=0 a0=817e10 a1=816900 a2=816900 a3=4000 items=0 ppid=1 pid=2654 auid=andre uid=nut gid=nut euid=nut suid=nut fsuid=nut egid=nut sgid=nut fsgid=nut tty=(none) ses=1 comm=genericups exe=/sbin/genericups subj=unconfined_u:system_r:upsdrvctl_t:s0 key=(null) 
type=AVC msg=audit(12/01/2009 21:32:23.416:28594) : avc:  denied  { unlink } for  pid=2654 comm=genericups name=genericups-ups dev=dm-0 ino=2622275 scontext=unconfined_u:system_r:upsdrvctl_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file

Comment 10 Andre Robatino 2009-12-02 05:22:55 UTC
No change with selinux-policy*-3.6.32-49.fc12.noarch.rpm.  The ups service fails to start on bootup, corresponding to AVCs

type=SYSCALL msg=audit(12/02/2009 00:14:34.067:29964) : arch=x86_64 syscall=unlink success=yes exit=0 a0=ff9e10 a1=ff8900 a2=ff8900 a3=4000 items=0 ppid=1 pid=2842 auid=andre uid=nut gid=nut euid=nut suid=nut fsuid=nut egid=nut sgid=nut fsgid=nut tty=(none) ses=1 comm=genericups exe=/sbin/genericups subj=unconfined_u:system_r:upsdrvctl_t:s0 key=(null) 
type=AVC msg=audit(12/02/2009 00:14:34.067:29964) : avc:  denied  { unlink } for  pid=2842 comm=genericups name=genericups-ups dev=dm-0 ino=2622275 scontext=unconfined_u:system_r:upsdrvctl_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file

and I can then start ups manually, but the dac_override selinux message is generated, corresponding to AVCs

type=SYSCALL msg=audit(12/02/2009 00:17:28.929:29753) : arch=x86_64 syscall=unlink success=yes exit=0 a0=60e7c0 a1=1 a2=3cb9573330 a3=4000 items=0 ppid=2709 pid=2710 auid=andre uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=1 comm=upsd exe=/usr/sbin/upsd subj=unconfined_u:system_r:upsd_t:s0 key=(null) 
type=AVC msg=audit(12/02/2009 00:17:28.929:29753) : avc:  denied  { dac_override } for  pid=2710 comm=upsd capability=dac_override scontext=unconfined_u:system_r:upsd_t:s0 tcontext=unconfined_u:system_r:upsd_t:s0 tclass=capability

Comment 11 Daniel Walsh 2009-12-02 12:58:10 UTC
Created attachment 375422 [details]
New nut policy

Could you install this nut.pp policy file to see if it solves your problem.

semodule -i nut.pp

Comment 12 Daniel Walsh 2009-12-02 12:59:19 UTC
Fixed in selinux-policy-3.6.32-53.fc12.noarch

Comment 17 Andre Robatino 2009-12-02 18:30:10 UTC
Is this supposed to survive a reboot?  I don't see any filesystem changes that would indicate that it could.  The ups service still fails to start on bootup, but if I run "semodule -i nut.pp" just before "service ups start", I don't get the selinux warning.

Comment 18 Daniel Walsh 2009-12-02 18:57:44 UTC
Yes it is supposed to survive a reboot.

Could you execute 

# semodule -DB
# reboot
Gather all of the AVC messages about ups
# semodule -B

This will generate lots of AVC messages that you can ignore but might get us to the root of your problem.

Comment 19 Andre Robatino 2009-12-02 19:34:49 UTC
Created attachment 375565 [details]
output of "ausearch -m avc -i" before reboot

Comment 20 Andre Robatino 2009-12-02 19:35:45 UTC
Created attachment 375567 [details]
output of "ausearch -m avc -i" after reboot

Comment 21 Daniel Walsh 2009-12-02 19:57:23 UTC
setsebool -P allow_xserver_execmem 1
Which should remove the execstack error on xserver

If you want to run wine apps you need to turn on the mmap_low_allowed boolean
	
# setsebool -P mmap_low_allowed 1


It does not look like you installed the module that I attached either.

Comment 22 Andre Robatino 2009-12-02 20:04:08 UTC
I ran the command "semodule -i nut.pp" earlier as you indicated in comment #11.  Did it need to be run again after the commands in comment #18?

Comment 23 Daniel Walsh 2009-12-02 20:14:31 UTC
no, it should not have had to.

Comment 24 Andre Robatino 2009-12-03 00:01:16 UTC
Updated to selinux-policy*-3.6.32-53.fc12.noarch from Koji and rebooted.  Ups still fails to start at boot, still get the dac_override when starting manually, and in addition, a 25-second delay for the password prompt for su.

Comment 25 Fedora Update System 2009-12-03 04:58:16 UTC
selinux-policy-3.6.32-52.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-12549

Comment 26 Daniel Walsh 2009-12-03 14:48:05 UTC
Andre could you attach the output of ausearch -m AVC  recent to show the DAC_OVERRIDE problem.  Also could you check if the delay is related to selinux by executing setenforce 0 and seeing if the su timeout still happens.

Comment 27 Andre Robatino 2009-12-03 18:08:07 UTC
Do you want me to test 52 or 53 (I've already reverted to 49 so will have to update again)?  Also, I would rather not turn selinux off completely, as mentioned in the other bug report.  There seem to be other people seeing the same problem with su so I'd rather let them test that.  Also, have my selinux upgrades and downgrades eliminated the effect of the "semodule -i nut.pp" command I ran earlier, or do I need do something for that?  Where is the change in the file system which allows the effect of this command to survive reboots?  I couldn't see any - there is a file /usr/share/selinux/targeted/nut.pp.bz2 belonging to selinux-policy-targeted, but it didn't change, since "rpm -V selinux-policy-targeted" verified after running this command.  There is also a file /etc/selinux/targeted/modules/active/modules/nut.pp which does not belong to any package.

Comment 28 Daniel Walsh 2009-12-03 19:15:29 UTC
Andre you can upgrade to 53 to test it out.

Yes the nut.pp you installed has been overridden.  But 53 should have the equivalent.

Comment 29 Andre Robatino 2009-12-03 19:33:50 UTC
I updated to 53, saved the ausearch output, rebooted, started ups manually (generating the selinux warning), then saved the ausearch output again.  The only difference was

type=SYSCALL msg=audit(12/03/2009 14:27:44.042:30171) : arch=x86_64 syscall=unlink success=yes exit=0 a0=60e7c0 a1=1 a2=3cb9573330 a3=4000 items=0 ppid=2726 pid=2727 auid=andre uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=1 comm=upsd exe=/usr/sbin/upsd subj=unconfined_u:system_r:nut_upsd_t:s0 key=(null) 
type=AVC msg=audit(12/03/2009 14:27:44.042:30171) : avc:  denied  { dac_override } for  pid=2727 comm=upsd capability=dac_override scontext=unconfined_u:system_r:nut_upsd_t:s0 tcontext=unconfined_u:system_r:nut_upsd_t:s0 tclass=capability

which happened when I started ups manually.

Comment 30 Fedora Update System 2009-12-03 20:29:26 UTC
selinux-policy-3.6.32-55.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-55.fc12

Comment 31 Andre Robatino 2009-12-03 20:46:43 UTC
Updated to 55, saved the ausearch output, rebooted, started ups manually after it failed to start automatically (no selinux warning anymore, at least), saved ausearch output again.  There is no difference this time.  The su password delay is also gone.

Comment 32 Daniel Walsh 2009-12-03 22:01:04 UTC
So now you only fail to start on boot.

If you boot in permissive mode does the ups service start?

Comment 33 Andre Robatino 2009-12-03 22:23:03 UTC
Went to System->Administration->SELinux Management, changed System Default Enforcing Mode from Enforcing to Permissive, and rebooted.  Ups still fails to start automatically, the following appears in /var/log/messages (same as before, I think):

Dec  3 17:13:24 localhost upsd[1624]: listening on 127.0.0.1 port 3493
Dec  3 17:13:24 localhost upsd[1624]: listening on ::1 port 3493
Dec  3 17:13:24 localhost upsd[1624]: Can't connect to UPS [ups] (genericups-ups
): No such file or directory
Dec  3 17:13:24 localhost upsd[1624]: allowfrom in upsd.users is no longer used
Dec  3 17:13:24 localhost upsd[1625]: Startup successful
Dec  3 17:13:24 localhost upsmon[1628]: Startup successful
Dec  3 17:13:24 localhost upsd[1625]: User monuser@::1 logged into UPS [ups]
Dec  3 17:13:24 localhost upsmon[1629]: Poll UPS [ups@localhost] failed - Driver
 not connected
Dec  3 17:13:24 localhost upsmon[1629]: Communications with UPS ups@localhost lo
st
Dec  3 17:13:24 localhost wall[1633]: wall: user nut broadcasted 1 lines (44 cha
rs)

Have now changed System Default Enforcing Mode and Current Enforcing Mode back to Enforcing.

Comment 34 Daniel Walsh 2009-12-03 22:56:23 UTC
I would open a bug with the ups guys.  I don't beleive this is SELinux related at this point.

Comment 35 Andre Robatino 2009-12-03 23:11:11 UTC
Created bug #544121.  Feel free to close this bug if no one else objects.

Comment 36 Daniel Walsh 2009-12-04 14:00:17 UTC
I will close when -55 gets released.

Comment 37 Fedora Update System 2009-12-04 23:47:46 UTC
selinux-policy-3.6.32-55.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-12650

Comment 38 Fedora Update System 2009-12-08 07:54:26 UTC
selinux-policy-3.6.32-55.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 39 Fedora Update System 2010-08-05 13:20:04 UTC
selinux-policy-3.6.32-120.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-120.fc12

Comment 40 Fedora Update System 2010-08-20 01:40:22 UTC
selinux-policy-3.6.32-120.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.