Bug 608674 - SELinux is preventing /sbin/microcode_ctl "write" access to device microcode.
Summary: SELinux is preventing /sbin/microcode_ctl "write" access to device microcode.
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 12
Hardware: x86_64
OS: Linux
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
Whiteboard: setroubleshoot_trace_hash:3b58be3d9ce...
Depends On:
TreeView+ depends on / blocked
Reported: 2010-06-28 12:55 UTC by jesseb
Modified: 2010-11-03 12:49 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2010-11-03 12:49:50 UTC

Attachments (Terms of Use)

Description jesseb 2010-06-28 12:55:30 UTC

SELinux is preventing /sbin/microcode_ctl "write" access to device microcode.

Detailed Description:

[microcode_ctl has a permissive type (cpucontrol_t). This access was not

SELinux has denied microcode_ctl "write" access to device microcode. microcode
is mislabeled, this device has the default label of the /dev directory, which
should not happen. All Character and/or Block Devices should have a label. You
can attempt to change the label of the file using restorecon -v 'microcode'. If
this device remains labeled device_t, then this is a bug in SELinux policy.
Please file a bg report. If you look at the other similar devices labels, ls -lZ
/dev/SIMILAR, and find a type that would work for microcode, you can use chcon
-t SIMILAR_TYPE 'microcode', If this fixes the problem, you can make this
permanent by executing semanage fcontext -a -t SIMILAR_TYPE 'microcode' If the
restorecon changes the context, this indicates that the application that created
the device, created it without using SELinux APIs. If you can figure out which
application created the device, please file a bug report against this

Allowing Access:

Attempt restorecon -v 'microcode' or chcon -t SIMILAR_TYPE 'microcode'

Additional Information:

Source Context                system_u:system_r:cpucontrol_t:s0
Target Context                system_u:object_r:device_t:s0
Target Objects                microcode [ chr_file ]
Source                        microcode_ctl
Source Path                   /sbin/microcode_ctl
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           microcode_ctl-1.17-1.57.fc12
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.32-118.fc12
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   device
Host Name                     (removed)
Platform                      Linux (removed)
                     #1 SMP Fri May 28
                              04:30:39 UTC 2010 x86_64 x86_64
Alert Count                   1
First Seen                    Mon 28 Jun 2010 08:52:24 AM EDT
Last Seen                     Mon 28 Jun 2010 08:52:24 AM EDT
Local ID                      8d40cd24-ffc1-4ecb-98e0-85947c912723
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1277729544.395:779): avc:  denied  { write } for  pid=18033 comm="microcode_ctl" name="microcode" dev=devtmpfs ino=10257738 scontext=system_u:system_r:cpucontrol_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file

node=(removed) type=SYSCALL msg=audit(1277729544.395:779): arch=c000003e syscall=2 success=yes exit=4294967424 a0=602020 a1=1 a2=fdf a3=2e items=0 ppid=17997 pid=18033 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="microcode_ctl" exe="/sbin/microcode_ctl" subj=system_u:system_r:cpucontrol_t:s0 key=(null)

Hash String generated from  device,microcode_ctl,cpucontrol_t,device_t,chr_file,write
audit2allow suggests:

#============= cpucontrol_t ==============
allow cpucontrol_t device_t:chr_file write;

Comment 1 Daniel Walsh 2010-06-28 13:52:37 UTC
The problem is a mislabeled /dev/microcode 

What does 

matchpathcon /dev/microcode 


ls -lZ /dev/microcode

Comment 2 Bug Zapper 2010-11-03 12:46:58 UTC
This message is a reminder that Fedora 12 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 12.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '12'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 12's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 12 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 

Note You need to log in before you can comment on or make changes to this bug.