Description of problem: As resolution of bug 819559 we need to call systemd-loginctl list-sessions to get all sessions from acpid script. This is currentlu blocked by selinux. Version-Release number of selected component (if applicable): selinux-policy-3.10.0-128.fc17.noarch How reproducible: Always Steps to Reproduce: 1. Apply fix from bug 819559 2. Login to KDE and press HW power button Actual results: Machine power offs, AVC is logged. Expected results: Shutdown dialog is shown, no AVC. Additional info: type=USER_AVC msg=audit(1339662436.773:131): pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.login1.Manager member=ListSessions dest=org.freedesktop.login1 spid=2649 tpid=718 scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:systemd_logind_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' # cat /var/log/audit/audit.log | audit2allow #============= apmd_t ============== allow apmd_t systemd_logind_t:dbus send_msg;
<RANT>And once again we have to get a bugfix copied to the SELinux policy for it to actually work. I'm so fed up of that dumb hardcoded ruleset that keeps thinking it knows better what a program needs to do than the actual program. Now WHY is that software equivalent of nonsensical bureaucracy enabled by default in Fedora?</RANT>
If you can tell me all of the applications that now need to talk to the systemd_logind_ daemon, I am willing to listen. Fixed in selinux-policy-3.10.0-131.fc17
selinux-policy-3.10.0-132.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-132.fc17
selinux-policy-3.10.0-132.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.