Bug 712944 - SELinux is preventing bluetoothd from using the 'sys_module' capabilities.
Summary: SELinux is preventing bluetoothd from using the 'sys_module' capabilities.
Keywords:
Status: CLOSED INSUFFICIENT_DATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 15
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:3baa59848d4...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-06-13 17:10 UTC by Roy
Modified: 2011-10-07 14:28 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-10-07 14:28:19 UTC
Type: ---


Attachments (Terms of Use)

Description Roy 2011-06-13 17:10:52 UTC
SELinux is preventing bluetoothd from using the 'sys_module' capabilities.

*****  Plugin sys_module (99.5 confidence) suggests  *************************

If je denkt dat bluetoothd niet moet proberen om de kernel te veranderen door het laden van een kernel module.
Then een proces probeert mogelijk jouw systeem te hacken.
Do
neem contact op met jouw beveiliging beheerder en rapporteer dit probleem.

*****  Plugin catchall (1.49 confidence) suggests  ***************************

If je denkt dat bluetoothd standaard de sys_module mogelijkheid moet hebben.
Then je moet dit melden als een fout.
Je kunt een locale tactiek module genereren om deze toegang toe te staan.
Do
sta deze toegang nu toe door het uitvoeren van:
# grep bluetoothd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:bluetooth_t:s0
Target Context                system_u:system_r:bluetooth_t:s0
Target Objects                Unknown [ capability ]
Source                        bluetoothd
Source Path                   bluetoothd
Port                          <Onbekend>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.16-26.fc15
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.38.7-30.fc15.x86_64 #1 SMP Fri
                              May 27 05:15:53 UTC 2011 x86_64 x86_64
Alert Count                   3
First Seen                    wo 01 jun 2011 10:07:12 CEST
Last Seen                     ma 13 jun 2011 13:21:00 CEST
Local ID                      9479502d-9f80-4692-bbb3-3e071b091059

Raw Audit Messages
type=AVC msg=audit(1307964060.515:65): avc:  denied  { sys_module } for  pid=845 comm="bluetoothd" capability=16  scontext=system_u:system_r:bluetooth_t:s0 tcontext=system_u:system_r:bluetooth_t:s0 tclass=capability


Hash: bluetoothd,bluetooth_t,bluetooth_t,capability,sys_module

audit2allow

#============= bluetooth_t ==============
allow bluetooth_t self:capability sys_module;

audit2allow -R

#============= bluetooth_t ==============
allow bluetooth_t self:capability sys_module;

Comment 1 Daniel Walsh 2011-06-13 18:01:50 UTC
Eric, we are quickly heading to dontaudit domain self:capability sys_module;

Comment 2 Eric Paris 2011-06-13 18:15:26 UTC
Where is the SYSCALL record?  -ESADNESS.

Comment 3 Daniel Walsh 2011-06-13 18:58:03 UTC
Roy could you attach your audit.log?


ausearch -m avc -ts recent


Note You need to log in before you can comment on or make changes to this bug.