Bug 708587 - SELinux is preventing /usr/sbin/NetworkManager from 'read' accesses on the file NetworkManager.pid.
Summary: SELinux is preventing /usr/sbin/NetworkManager from 'read' accesses on the fi...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 15
Hardware: i386
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:d71561832ef...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-05-28 07:20 UTC by vingt
Modified: 2011-10-07 14:19 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-10-07 14:19:09 UTC
Type: ---


Attachments (Terms of Use)

Description vingt 2011-05-28 07:20:49 UTC
SELinux is preventing /usr/sbin/NetworkManager from 'read' accesses on the file NetworkManager.pid.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that NetworkManager should be allowed read access on the NetworkManager.pid file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep NetworkManager /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:NetworkManager_t:s0
Target Context                unconfined_u:object_r:var_run_t:s0
Target Objects                NetworkManager.pid [ file ]
Source                        NetworkManager
Source Path                   /usr/sbin/NetworkManager
Port                          <未知>
Host                          (removed)
Source RPM Packages           NetworkManager-0.8.999-3.git20110526.fc15
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.16-24.fc15
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.38.6-27.fc15.i686 #1 SMP
                              Sun May 15 17:57:13 UTC 2011 i686 i686
Alert Count                   1
First Seen                    2011年05月28日 星期六 15时11分50秒
Last Seen                     2011年05月28日 星期六 15时11分50秒
Local ID                      2b1fd48b-2e04-4d6d-9d1d-65cb150e60b6

Raw Audit Messages
type=AVC msg=audit(1306566710.761:128): avc:  denied  { read } for  pid=8065 comm="NetworkManager" name="NetworkManager.pid" dev=tmpfs ino=110020 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file


type=SYSCALL msg=audit(1306566710.761:128): arch=i386 syscall=open success=no exit=EACCES a0=8c598b8 a1=8000 a2=0 a3=8c596e8 items=0 ppid=1 pid=8065 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=NetworkManager exe=/usr/sbin/NetworkManager subj=system_u:system_r:NetworkManager_t:s0 key=(null)

Hash: NetworkManager,NetworkManager_t,var_run_t,file,read

audit2allow

#============= NetworkManager_t ==============
allow NetworkManager_t var_run_t:file read;

audit2allow -R

#============= NetworkManager_t ==============
allow NetworkManager_t var_run_t:file read;

Comment 1 Dominick Grift 2011-05-28 09:41:30 UTC
Looks like NetworkManager was run manually by unconfined_t, there does not seem to be a domain transition for unconfined_t to NetworkManager_t currently, and so the pid file was created with the generic pid file type. A second instance started by the system was not able to read the instance started by unconfined_t it seems. Either that or the pid file created by the unconfined_t instance was not removed.

This looks like a misconfiguration issue to me.

Comment 2 Miroslav Grepl 2011-05-29 20:17:41 UTC
Did you start NM by hand?

It looks so. 

Please reopen the bug if the problem still exists.

Comment 3 Dominick Grift 2011-05-30 08:45:24 UTC
Try:  restorecon -R -v /var, just in case you have some mislabelled symlinks as well (/var/run and /var/lock)

Comment 4 vingt 2011-06-02 15:36:33 UTC
actually,I have a problem like this:
http://www.surfer07.be/fedora/
so I follow the step in order to solve my problem.but,when I go to step 2.2 and  use the command "nm-connection-editor"
the SElinux show the bug above..

sorry about my bad English..

Comment 5 Dominick Grift 2011-06-02 15:48:42 UTC
[quote]After that restart Network Manager.
# sudo NetworkManager
Now you should be back online. [/quote]

That is not the encouraged way to start network manager. Instead use service NetworkManager start or systemctl start NetworkManager.service.


Note You need to log in before you can comment on or make changes to this bug.