Bug 720756 - SELinux is preventing /sbin/apcupsd from read access on the file LCK...
Summary: SELinux is preventing /sbin/apcupsd from read access on the file LCK...
Keywords:
Status: CLOSED WORKSFORME
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 15
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-07-12 17:04 UTC by Andre Robatino
Modified: 2011-07-12 18:15 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-07-12 18:09:48 UTC
Type: ---


Attachments (Terms of Use)

Description Andre Robatino 2011-07-12 17:04:33 UTC
Description of problem:

SELinux is preventing /sbin/apcupsd from read access on the file LCK...

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that apcupsd should be allowed read access on the LCK.. file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep apcupsd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:apcupsd_t:s0
Target Context                system_u:object_r:var_lock_t:s0
Target Objects                LCK.. [ file ]
Source                        apcupsd
Source Path                   /sbin/apcupsd
Port                          <Unknown>
Host                          compaq-pc
Source RPM Packages           apcupsd-3.14.8-8.fc15
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.16-23.fc15
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     compaq-pc
Platform                      Linux compaq-pc 2.6.38.8-32.fc15.x86_64 #1 SMP Mon
                              Jun 13 19:49:05 UTC 2011 x86_64 x86_64
Alert Count                   12
First Seen                    Tue 12 Jul 2011 12:35:10 PM EDT
Last Seen                     Tue 12 Jul 2011 12:52:35 PM EDT
Local ID                      bd67a7b7-f6c6-4d81-a549-58ae075b5f13

Raw Audit Messages
type=AVC msg=audit(1310489555.798:2589): avc:  denied  { read } for  pid=14686 comm="apcupsd" name="LCK.." dev=tmpfs ino=18144 scontext=system_u:system_r:apcupsd_t:s0 tcontext=system_u:object_r:var_lock_t:s0 tclass=file


type=SYSCALL msg=audit(1310489555.798:2589): arch=x86_64 syscall=open success=no exit=EACCES a0=28051e0 a1=0 a2=28091e8 a3=64 items=0 ppid=1 pid=14686 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=apcupsd exe=/sbin/apcupsd subj=system_u:system_r:apcupsd_t:s0 key=(null)

Hash: apcupsd,apcupsd_t,var_lock_t,file,read

audit2allow

#============= apcupsd_t ==============
allow apcupsd_t var_lock_t:file read;

audit2allow -R

#============= apcupsd_t ==============
allow apcupsd_t var_lock_t:file read;

Version-Release number of selected component (if applicable):
apcupsd-3.14.8-8.fc15.x86_64
selinux-policy-3.9.16-32.fc15.noarch
selinux-policy-targeted-3.9.16-32.fc15.noarch

How reproducible:
always

Steps to Reproduce:
1. As root: systemctl restart apcupsd.service

Additional info:
The apcaccess command returns

Error contacting apcupsd @ localhost:3551: Connection refused

This is a standard APC USB UPS (Back-UPS ES 650) which should work with the default apcupsd.conf configuration file, and did work with F15 until recently (I'm not sure exactly when it stopped).

Comment 1 Andre Robatino 2011-07-12 18:09:48 UTC
After booting into the latest kernel (2.6.38.8-35.fc15.x86_64), it's working properly. Don't know if it's the new kernel or something else that needed to be reinitialized. I'll reopen if it happens again.

Comment 2 Daniel Walsh 2011-07-12 18:15:48 UTC
It might have been something fixed in updates.


Note You need to log in before you can comment on or make changes to this bug.