Bug 883163 - selinux blocks NetworkManager communications to dbus
Summary: selinux blocks NetworkManager communications to dbus
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 18
Hardware: arm
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-12-03 22:53 UTC by Jeff Bastian
Modified: 2012-12-08 04:01 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2012-12-07 04:28:58 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Jeff Bastian 2012-12-03 22:53:13 UTC
Description of problem:
I'm helping with the Fedora 18 Beta on ARM VFAD testing today (on a Pandaboard) and I noticed that the network does not always come up properly on boot (sometimes it does, but not always).  Scanning through the logs I noticed this:

Dec 31 19:00:48 panda-f18-v7hl NetworkManager[484]: <error> [946684848.973573] [
nm-dbus-manager.c:332] nm_dbus_manager_start_service(): Could not acquire the Ne
tworkManager service.

And:

[root@panda-f18-v7hl ~]# ausearch -m USER_AVC
time->Fri Dec 31 19:00:24 1999
type=USER_AVC msg=audit(946684824.777:26): pid=535 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=signal interface=org.freedesktop.systemd1.Activator member=ActivationRequest dest=org.freedesktop.systemd1 spid=527 tpid=1 scontext=system_u:system_r:accountsd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'


Ignore the date: the Pandaboard does not have a battery-backed RTC so it's always January 1, 2000 00:00 UTC (or Dec 31, 1999, 19:00 US Central) on boot until ntp/chrony can set the clock.


Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.11.1-50.fc18.noarch

How reproducible:
every time (?)

Steps to Reproduce:
1. boot Pandaboard from SD card with F18 Beta image
2. check network status
3. check /var/log/messages for errors from NetworkManager
4. ausearch -m USER_AVC
  
Actual results:
network sometimes fails to start on boot
logs show errors with NetworkManager and dbus communications
audit logs show send_msg blocked between NM and dbus

Expected results:
network comes up on boot every time

Additional info:
https://fedoraproject.org/wiki/Architectures/ARM/Quality_Assurance/2012-12-03-VFAD-Fedora_18_Beta

Comment 1 Jeff Bastian 2012-12-03 23:11:28 UTC
As another test, I put the system in Permissive mode and rebooted 5 times.  The network came up properly all 5 times.

Comment 2 Miroslav Grepl 2012-12-04 12:46:20 UTC
Added to selinux-policy-3.11.1-60.fc18

Comment 3 Fedora Update System 2012-12-06 10:13:01 UTC
selinux-policy-3.11.1-60.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/FEDORA-2012-19374/selinux-policy-3.11.1-60.fc18

Comment 4 Fedora Update System 2012-12-06 20:09:44 UTC
Package selinux-policy-3.11.1-60.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-60.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-19374/selinux-policy-3.11.1-60.fc18
then log in and leave karma (feedback).

Comment 5 Fedora Update System 2012-12-07 04:29:00 UTC
selinux-policy-3.11.1-60.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Jon Disnard 2012-12-08 04:01:29 UTC
This worked for me.

Thanks


Note You need to log in before you can comment on or make changes to this bug.