Bug 631673 - SELinux is preventing /usr/sbin/bluetoothd "open" access to device rfcomm0.
Summary: SELinux is preventing /usr/sbin/bluetoothd "open" access to device rfcomm0.
Keywords:
Status: CLOSED DUPLICATE of bug 566332
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 14
Hardware: x86_64
OS: Linux
low
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:e21668a6b01...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-09-08 06:43 UTC by Aaron Sowry
Modified: 2010-09-08 15:59 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2010-09-08 15:59:43 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Aaron Sowry 2010-09-08 06:43:53 UTC
Summary:

SELinux is preventing /usr/sbin/bluetoothd "open" access to device rfcomm0.

Detailed Description:

SELinux has denied bluetoothd "open" access to device rfcomm0. rfcomm0 is
mislabeled, this device has the default label of the /dev directory, which
should not happen. All Character and/or Block Devices should have a label. You
can attempt to change the label of the file using restorecon -v 'rfcomm0'. If
this device remains labeled device_t, then this is a bug in SELinux policy.
Please file a bg report. If you look at the other similar devices labels, ls -lZ
/dev/SIMILAR, and find a type that would work for rfcomm0, you can use chcon -t
SIMILAR_TYPE 'rfcomm0', If this fixes the problem, you can make this permanent
by executing semanage fcontext -a -t SIMILAR_TYPE 'rfcomm0' If the restorecon
changes the context, this indicates that the application that created the
device, created it without using SELinux APIs. If you can figure out which
application created the device, please file a bug report against this
application.

Allowing Access:

Attempt restorecon -v 'rfcomm0' or chcon -t SIMILAR_TYPE 'rfcomm0'

Additional Information:

Source Context                system_u:system_r:bluetooth_t:s0-s0:c0.c1023
Target Context                system_u:object_r:device_t:s0
Target Objects                rfcomm0 [ chr_file ]
Source                        bluetoothd
Source Path                   /usr/sbin/bluetoothd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           bluez-4.69-4.fc14
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.0-2.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   device
Host Name                     (removed)
Platform                      Linux (removed) 2.6.35.4-12.fc14.x86_64 #1 SMP Fri Aug
                              27 07:45:05 UTC 2010 x86_64 x86_64
Alert Count                   1
First Seen                    Wed 08 Sep 2010 07:44:34 AM CEST
Last Seen                     Wed 08 Sep 2010 07:44:34 AM CEST
Local ID                      42ae182e-61e4-4663-b4a8-d45b771c4fc8
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1283924674.422:49): avc:  denied  { open } for  pid=1412 comm="bluetoothd" name="rfcomm0" dev=devtmpfs ino=68496 scontext=system_u:system_r:bluetooth_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file

node=(removed) type=SYSCALL msg=audit(1283924674.422:49): arch=c000003e syscall=2 success=no exit=-13 a0=7faa3103f260 a1=100 a2=0 a3=7fff487cd08c items=0 ppid=1 pid=1412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="bluetoothd" exe="/usr/sbin/bluetoothd" subj=system_u:system_r:bluetooth_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  device,bluetoothd,bluetooth_t,device_t,chr_file,open
audit2allow suggests:

#============= bluetooth_t ==============
allow bluetooth_t device_t:chr_file open;

Comment 1 Aaron Sowry 2010-09-08 06:59:12 UTC
This occurs when trying to access the internet via bluetooth DUN.

Comment 2 Daniel Walsh 2010-09-08 15:59:43 UTC

*** This bug has been marked as a duplicate of bug 566332 ***


Note You need to log in before you can comment on or make changes to this bug.