Bug 697617 - wpa_supplicant + selinux = sys_module denial
wpa_supplicant + selinux = sys_module denial
Product: Fedora
Classification: Fedora
Component: wpa_supplicant (Show other bugs)
Unspecified Linux
unspecified Severity low
: ---
: ---
Assigned To: Dan Williams
Fedora Extras Quality Assurance
: 697221 (view as bug list)
Depends On:
  Show dependency treegraph
Reported: 2011-04-18 14:37 EDT by Maciej Żenczykowski
Modified: 2012-08-16 18:25 EDT (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-08-16 18:25:01 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Maciej Żenczykowski 2011-04-18 14:37:10 EDT
After running "sudo /etc/init.d/wpa_supplicant restart" ran across this (I have absolutely no idea what kernel modules wpa_supplicant might possibly be trying to load...):

SELinux is preventing /usr/sbin/wpa_supplicant from using the sys_module capability.

*****  Plugin sys_module (99.5 confidence) suggests  *************************

If you do not believe that /usr/sbin/wpa_supplicant should be attempting to modify the kernel by loading a kernel module.
Then a process might be attempting to hack into your system.
Do contact your security administrator and report this issue.

*****  Plugin catchall (1.49 confidence) suggests  ***************************

If you believe that wpa_supplicant should have the sys_module capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do allow this access for now by executing:
# grep wpa_supplicant /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:system_r:NetworkManager_t:s0
Target Context                unconfined_u:system_r:NetworkManager_t:s0
Target Objects                Unknown [ capability ]
Source                        wpa_supplicant
Source Path                   /usr/sbin/wpa_supplicant
Port                          <Unknown>
Host                          nike
Source RPM Packages           wpa_supplicant-0.6.8-10.fc14
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.7-37.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     nike
Platform                      Linux nike
                     #1 SMP Thu Mar 31
                              21:21:57 UTC 2011 x86_64 x86_64
Alert Count                   1
First Seen                    Mon 18 Apr 2011 11:30:37 AM PDT
Last Seen                     Mon 18 Apr 2011 11:30:37 AM PDT
Local ID                      900e0119-d22d-42ee-9844-ac3804470ae6

Raw Audit Messages
type=AVC msg=audit(1303151437.782:34081): avc:  denied  { sys_module } for  pid=17403 comm="wpa_supplicant" capability=16  scontext=unconfined_u:system_r:NetworkManager_t:s0
Comment 1 Daniel Walsh 2011-04-18 15:27:02 EDT
This is a kernel regression but we dontaudit it in 

Comment 2 Paul Bolle 2011-04-21 04:00:54 EDT
(In reply to comment #0)
> [...] (I have
> absolutely no idea what kernel modules wpa_supplicant might possibly be trying
> to load...):

0) Neither have I, but the (verbose) "SETroubleshoot Detail Window", which you apperently copied, doesn't tell us which module wpa_supplicant loaded. Separate bug?

1) Anyhow, identical to bug #697221.
Comment 3 Daniel Walsh 2011-04-21 08:30:16 EDT
*** Bug 697221 has been marked as a duplicate of this bug. ***
Comment 4 Daniel Walsh 2011-04-21 08:31:08 EDT
There is a kernel bug on this, and yes it would be nice if the kernel would tell us which module was attempted to be loaded.
Comment 5 Paul Bolle 2011-04-21 11:23:16 EDT
(In reply to comment #4)
> There is a kernel bug on this,

0) That seems to be bug #684415 (and this one may be closed as a duplicate too, I guess).

> and yes it would be nice if the kernel would
> tell us which module was attempted to be loaded.

1) Well, a comment in bug #684415 (https://bugzilla.redhat.com/show_bug.cgi?id=684415#c15) links to the upstream commit that apparently started all this: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=8909c9ad8ff03611c9c96c9a92656213e4bb495b .

A snippet from that commit suggests that this shouldn't fail silently if we have CAP_SYS_MODULE. But maybe that commit is not at issue here or maybe SELinux somehow hides that pr_err() because capable(CAP_SYS_MODULE) fails, or something entirely different is going on. Anyway, it should be trivial to make the code more verbose. I'm referring to this:

 void dev_load(struct net *net, const char *name)
        struct net_device *dev;
+       int no_module;
        dev = dev_get_by_name_rcu(net, name);
-       if (!dev && capable(CAP_NET_ADMIN))
-               request_module("%s", name);
+       no_module = !dev;
+       if (no_module && capable(CAP_NET_ADMIN))
+               no_module = request_module("netdev-%s", name);
+       if (no_module && capable(CAP_SYS_MODULE)) {
+               if (!request_module("%s", name))
+                       pr_err("Loading kernel module for a network device "
+"with CAP_SYS_MODULE (deprecated).  Use CAP_NET_ADMIN and alias netdev-%s "
+"instead\n", name);
+       }
Comment 6 Fedora End Of Life 2012-08-16 18:25:04 EDT
This message is a notice that Fedora 14 is now at end of life. Fedora 
has stopped maintaining and issuing updates for Fedora 14. It is 
Fedora's policy to close all bug reports from releases that are no 
longer maintained.  At this time, all open bugs with a Fedora 'version'
of '14' have been closed as WONTFIX.

(Please note: Our normal process is to give advanced warning of this 
occurring, but we forgot to do that. A thousand apologies.)

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, feel free to reopen 
this bug and simply change the 'version' to a later Fedora version.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we were unable to fix it before Fedora 14 reached end of life. If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora, you are encouraged to click on 
"Clone This Bug" (top right of this page) and open it against that 
version of Fedora.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 

Note You need to log in before you can comment on or make changes to this bug.