Bug 849799 - SELinux is preventing /usr/lib64/dbus-1/dbus-daemon-launch-helper from 'name_connect' accesses on the tcp_socket .
SELinux is preventing /usr/lib64/dbus-1/dbus-daemon-launch-helper from 'name_...
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2012-08-20 18:16 EDT by Eugene Kanter
Modified: 2012-12-20 11:24 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-12-20 11:24:53 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Eugene Kanter 2012-08-20 18:16:36 EDT
libreport version: 2.0.10
executable:     /usr/bin/python2.7
hashmarkername: setroubleshoot
kernel:         3.5.2-1.fc17.x86_64
time:           Mon 20 Aug 2012 06:14:21 PM EDT

:SELinux is preventing /usr/lib64/dbus-1/dbus-daemon-launch-helper from 'name_connect' accesses on the tcp_socket .
:*****  Plugin catchall (100. confidence) suggests  ***************************
:If you believe that dbus-daemon-launch-helper should be allowed name_connect access on the  tcp_socket by default.
:Then you should report this as a bug.
:You can generate a local policy module to allow this access.
:allow this access for now by executing:
:# grep dbus-daemon-lau /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:Additional Information:
:Source Context                system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
:Target Context                system_u:object_r:ephemeral_port_t:s0
:Target Objects                 [ tcp_socket ]
:Source                        dbus-daemon-lau
:Source Path                   /usr/lib64/dbus-1/dbus-daemon-launch-helper
:Port                          39816
:Host                          (removed)
:Source RPM Packages           dbus-1.4.10-4.fc17.x86_64
:Target RPM Packages           
:Policy RPM                    selinux-policy-3.10.0-145.fc17.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Permissive
:Host Name                     (removed)
:Platform                      Linux (removed) 3.5.2-1.fc17.x86_64 #1 SMP Wed Aug
:                              15 16:09:27 UTC 2012 x86_64 x86_64
:Alert Count                   4
:First Seen                    2012-08-20 18:11:19 EDT
:Last Seen                     2012-08-20 18:13:18 EDT
:Local ID                      6fefe390-90b1-4dbb-a396-03daf459141b
:Raw Audit Messages
:type=AVC msg=audit(1345500798.727:102): avc:  denied  { name_connect } for  pid=2997 comm="dbus-daemon-lau" dest=39816 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ephemeral_port_t:s0 tclass=tcp_socket
:type=SYSCALL msg=audit(1345500798.727:102): arch=x86_64 syscall=connect success=yes exit=0 a0=3 a1=7fffcfec6f60 a2=10 a3=0 items=0 ppid=2996 pid=2997 auid=4294967295 uid=81 gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295 comm=dbus-daemon-lau exe=/usr/lib64/dbus-1/dbus-daemon-launch-helper subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)
:Hash: dbus-daemon-lau,system_dbusd_t,ephemeral_port_t,tcp_socket,name_connect
:#============= system_dbusd_t ==============
:allow system_dbusd_t ephemeral_port_t:tcp_socket name_connect;
:audit2allow -R
:#============= system_dbusd_t ==============
:allow system_dbusd_t ephemeral_port_t:tcp_socket name_connect;
Comment 1 Miroslav Grepl 2012-08-21 05:02:03 EDT
Do you know what you were doing when this happened?
Comment 2 Eugene Kanter 2012-08-21 14:01:11 EDT
This is an upgrade from F16 via preupgrade.
There was an existing NetworkManager VPN (openvpn) connection in F16, worked with no errors. In F17 the same connection is causing selinux message provided above.
Comment 3 Miroslav Grepl 2012-08-22 09:18:52 EDT
Ok, it could be an upgrade issue. Are you still getting it?
Comment 4 Eugene Kanter 2012-08-24 18:18:24 EDT
Yes, every time a VPN connection is established.
Comment 5 Miroslav Grepl 2012-08-27 05:34:26 EDT
Ok, does it happen also if you log out/in?
Comment 6 Eugene Kanter 2012-08-27 13:09:12 EDT
Even after upgrading to the latest as of now and rebooting.
Comment 7 Daniel Walsh 2012-08-29 12:53:31 EDT
Colin any idea what is happening here?
Comment 8 Colin Walters 2012-09-03 18:47:44 EDT
Could be the machine has say an LDAP NSS module configured, and the launch helper is calling getpwent()?

Hard to say without a stack trace.
Comment 9 Daniel Walsh 2012-09-06 23:37:08 EDT
Do you have nis/ypbind setup?
Comment 10 Eugene Kanter 2012-09-14 18:05:35 EDT
(In reply to comment #9)
> Do you have nis/ypbind setup?

yes, NIS is configured
Comment 11 Daniel Walsh 2012-09-17 19:30:29 EDT
Is allow_ypbind turned on

getsebool allow_ypbind
Comment 12 Eugene Kanter 2012-09-18 19:29:36 EDT
(In reply to comment #11)
> Is allow_ypbind turned on
> getsebool allow_ypbind

# getsebool allow_ypbind
allow_ypbind --> on
Comment 13 Daniel Walsh 2012-09-19 21:13:06 EDT
In F18 I added the ephemeral_port_t to all interfaces that use generic port, which would add them to the list used by nsswitch, we need to back port corenetwork.if.in from F18 to F17
Comment 14 Miroslav Grepl 2012-09-20 07:54:18 EDT
Backported to F17.
Comment 15 Fedora Update System 2012-09-24 15:00:01 EDT
selinux-policy-3.10.0-150.fc17 has been submitted as an update for Fedora 17.
Comment 16 Fedora Update System 2012-09-25 00:29:19 EDT
Package selinux-policy-3.10.0-150.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-150.fc17'
as soon as you are able to, then reboot.
Please go to the following url:
then log in and leave karma (feedback).
Comment 17 Eugene Kanter 2012-09-28 13:37:26 EDT
after upgrading to selinux-policy-3.10.0-150.fc17.noarch this sealert is no longer reproducible.
Comment 18 Miroslav Grepl 2012-10-02 05:36:56 EDT
Great. Thanks for testing.
Comment 19 Fedora Update System 2012-10-08 10:07:22 EDT
selinux-policy-3.10.0-153.fc17 has been submitted as an update for Fedora 17.
Comment 20 Fedora Update System 2012-12-20 11:24:55 EST
selinux-policy-3.10.0-153.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.