SELinux is preventing /usr/sbin/ntpd from read, write access on the shared memory Unknown. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that ntpd should be allowed read write access on the Unknown shm by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep ntpd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:system_r:ntpd_t:s0 Target Context system_u:system_r:udev_t:s0-s0:c0.c1023 Target Objects Unknown [ shm ] Source ntpd Source Path /usr/sbin/ntpd Port <Unknown> Host (removed) Source RPM Packages ntp-4.2.6p3-0.1.rc10.fc14 Target RPM Packages Policy RPM selinux-policy-3.9.7-37.fc14 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux defi.saperlipopette.net 2.6.35.12-88.fc14.i686.PAE #1 SMP Thu Mar 31 21:54:35 UTC 2011 i686 i686 Alert Count 1 First Seen Thu 21 Apr 2011 02:00:28 PM CEST Last Seen Thu 21 Apr 2011 02:00:28 PM CEST Local ID cb7db45f-9f3a-4f41-9dc2-55bb88fae92d Raw Audit Messages type=AVC msg=audit(1303387228.993:83): avc: denied { read write } for pid=3278 comm="ntpd" key=1314148401 scontext=unconfined_u:system_r:ntpd_t:s0 tcontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tclass=shm type=SYSCALL msg=audit(1303387228.993:83): arch=i386 syscall=ipc success=no exit=EACCES a0=15 a1=6800a a2=0 a3=bfa22ee8 items=0 ppid=1 pid=3278 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm=ntpd exe=/usr/sbin/ntpd subj=unconfined_u:system_r:ntpd_t:s0 key=(null) Hash: ntpd,ntpd_t,udev_t,shm,read,write audit2allow #============= ntpd_t ============== allow ntpd_t udev_t:shm { read write }; audit2allow -R #============= ntpd_t ============== allow ntpd_t udev_t:shm { read write };
The report occurs after ntpd is running a while and when gpsd is not running. If gpsd is running, the error does not occur.
ps -eZ | grep udev_t Does udev start gpsd?
# ps -eZ | grep udev_t system_u:system_r:udev_t:s0-s0:c0.c1023 452 ? 00:00:00 udevd system_u:system_r:udev_t:s0-s0:c0.c1023 1896 ? 00:00:00 udevd system_u:system_r:udev_t:s0-s0:c0.c1023 1897 ? 00:00:00 udevd gpsd is not started by default because the GPS mouse is not always connected to the USB port.
Claude if you plugin in the gps mouse, some software is launched by udev that we need to transition to gpsd. That is what I am looking for, so if you could plugin your gpsd mouse, I would like to see the context it is running under.
*** I plug the mouse in *** In /var/log/messages: Apr 25 15:50:17 defi kernel: [16159.025083] usb 6-1: new full speed USB device using uhci_hcd and address 2 Apr 25 15:50:18 defi kernel: [16159.221110] usb 6-1: New USB device found, idVendor=1546, idProduct=01a5 Apr 25 15:50:18 defi kernel: [16159.221114] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 Apr 25 15:50:18 defi kernel: [16159.221117] usb 6-1: Product: u-blox 5 - GPS Receiver Apr 25 15:50:18 defi kernel: [16159.221119] usb 6-1: Manufacturer: u-blox AG - www.u-blox.com Apr 25 15:50:18 defi kernel: [16159.325606] cdc_acm 6-1:1.0: ttyACM0: USB ACM device Apr 25 15:50:18 defi kernel: [16159.328322] usbcore: registered new interface driver cdc_acm Apr 25 15:50:18 defi kernel: [16159.328324] cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters Apr 25 15:50:18 defi gpsd.hotplug: gpsd_control(action=add, arg=/dev/ttyACM0) Apr 25 15:50:18 defi gpsd.hotplug: socket /var/run/gpsd.sock doesn't exist Apr 25 15:50:18 defi gpsd.hotplug: launching gpsd -n -F /var/run/gpsd.sock And now .... # ps -eZ | grep udev_t system_u:system_r:udev_t:s0-s0:c0.c1023 452 ? 00:00:00 udevd system_u:system_r:udev_t:s0-s0:c0.c1023 1896 ? 00:00:00 udevd system_u:system_r:udev_t:s0-s0:c0.c1023 1897 ? 00:00:00 udevd system_u:system_r:udev_t:s0-s0:c0.c1023 3587 ? 00:00:00 gpsd
Miroslav we need to add optional_policy(` gpsd_domtrans(udev_t) ') Please back port to F13 and RHEL6.
Fixed in selinux-policy-3.9.7-41.fc14
selinux-policy-3.9.16-18.fc15 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/selinux-policy-3.9.16-18.fc15
Package selinux-policy-3.9.16-18.fc15: * should fix your issue, * was pushed to the Fedora 15 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.9.16-18.fc15' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/selinux-policy-3.9.16-18.fc15 then log in and leave karma (feedback).
selinux-policy-3.9.16-18.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report.