6:33 p.m.
I have ACPI scripts that are supposed to run when Fn-Fx is pressed (for
various values of x). The scripts run fine when invoked from a shell,
but they fail when invoked by keypress. For example,
/etc/acpi/actions/Fn-F3.sh contains:
#!/bin/sh
if [ -f /var/tmp/acpi-lightoff ]; then
/usr/sbin/radeontool light on
/bin/rm /var/tmp/acpi-lightoff
else
/usr/sbin/radeontool light off
/bin/touch /var/tmp/acpi-lightoff
fi
When invoked by keypress, I get the following audit messages, and no
action is taken (light stays on, no file touched). Should I be doing
something different or is there something in selinux-policy-targeted that
needs to be fixed?
TIA.
type=AVC msg=audit(1126826853.791:2631316): avc: denied { search } for
pid=4112 comm="Fn-F3.sh" name="tmp" dev=dm-0 ino=906756
scontext=root:system_r:apmd_t tcontext=system_u:object_r:tmp_t tclass=dir
type=SYSCALL msg=audit(1126826853.791:2631316): arch=40000003 syscall=195
success=no exit=-13 a0=88fcda0 a1=bfffb488 a2=960ff4 a3=88fce30 items=1
pid=4112 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 comm="Fn-F3.sh" exe="/bin/bash"
type=CWD msg=audit(1126826853.791:2631316): cwd="/"
type=PATH msg=audit(1126826853.791:2631316): item=0
name="/var/tmp/acpi-lightoff" flags=1 inode=906756 dev=fd:00 mode=041777
ouid=0 ogid=0 rdev=00:00
type=AVC msg=audit(1126826853.800:2631748): avc: denied { read } for
pid=4114 comm="lspci" name="pci.ids" dev=dm-0 ino=809685
scontext=root:system_r:apmd_t tcontext=system_u:object_r:usr_t tclass=file
type=SYSCALL msg=audit(1126826853.800:2631748): arch=40000003 syscall=5
success=no exit=-13 a0=8054e5c a1=0 a2=fbad8001 a3=0 items=1 pid=4114
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
comm="lspci" exe="/sbin/lspci"
type=CWD msg=audit(1126826853.800:2631748): cwd="/"
type=PATH msg=audit(1126826853.800:2631748): item=0
name="/usr/share/hwdata/pci.ids" flags=101 inode=809685 dev=fd:00
mode=0100644 ouid=0 ogid=0 rdev=00:00
type=AVC msg=audit(1126826853.804:2631869): avc: denied { search } for
pid=4115 comm="touch" name="tmp" dev=dm-0 ino=906756
scontext=root:system_r:apmd_t tcontext=system_u:object_r:tmp_t tclass=dir
type=SYSCALL msg=audit(1126826853.804:2631869): arch=40000003 syscall=5
success=no exit=-13 a0=bfefbf71 a1=8941 a2=1b6 a3=8941 items=1 pid=4115
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
comm="touch" exe="/bin/touch"
type=CWD msg=audit(1126826853.804:2631869): cwd="/"
type=PATH msg=audit(1126826853.804:2631869): item=0
name="/var/tmp/acpi-lightoff" flags=310 inode=906756 dev=fd:00
mode=041777 ouid=0 ogid=0 rdev=00:00
type=AVC msg=audit(1126826853.804:2631870): avc: denied { search } for
pid=4115 comm="touch" name="tmp" dev=dm-0 ino=906756
scontext=root:system_r:apmd_t tcontext=system_u:object_r:tmp_t tclass=dir
type=SYSCALL msg=audit(1126826853.804:2631870): arch=40000003 syscall=30
success=no exit=-13 a0=bfefbf71 a1=0 a2=804f8bc a3=bfefbf71 items=1
pid=4115 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 comm="touch" exe="/bin/touch"
type=CWD msg=audit(1126826853.804:2631870): cwd="/"
type=PATH msg=audit(1126826853.804:2631870): item=0
name="/var/tmp/acpi-lightoff" flags=1 inode=906756 dev=fd:00 mode=041777
ouid=0 ogid=0 rdev=00:00
--
Matthew Saltzman
Clemson University Math Sciences
mjs AT clemson DOT edu
http://www.math.clemson.edu/~mjs
6:03 a.m.
On Thu, 15 Sep 2005, Matthew Saltzman wrote:
I have ACPI scripts that are supposed to run when Fn-Fx is pressed
(for
various values of x). The scripts run fine when invoked from a shell, but
they fail when invoked by keypress. For example, /etc/acpi/actions/Fn-F3.sh
contains:
#!/bin/sh
if [ -f /var/tmp/acpi-lightoff ]; then
/usr/sbin/radeontool light on
/bin/rm /var/tmp/acpi-lightoff
else
/usr/sbin/radeontool light off
/bin/touch /var/tmp/acpi-lightoff
fi
When invoked by keypress, I get the following audit messages, and no action
is taken (light stays on, no file touched). Should I be doing something
different or is there something in selinux-policy-targeted that needs to be
fixed?
I've changed the script so that it reads its status directly rather than
checking for the file:
if [ "$(/usr/sbin/radeontool light)" = "The radeon backlight looks
on" ]; then
/usr/sbin/radeontool light off
else
/usr/sbin/radeontool light on
fi
It still works fine if invoked from the command line and doesn't work if
invoked by acpid, unless setenforce 0 is set. How can I fix this, and can
it be fixed in selinux-policy-targeted? Thanks.
/var/log/acpi reports:
[Wed Sep 21 04:37:22 2005] received event "ibm/hotkey HKEY 00000080 00001003"
[Wed Sep 21 04:37:22 2005] notifying client 3203[500:500]
[Wed Sep 21 04:37:22 2005] executing action "/etc/acpi/actions/Fn-F3.sh"
[Wed Sep 21 04:37:22 2005] BEGIN HANDLER MESSAGES
Radeon hardware not found in lspci output.
Radeon hardware not found in lspci output.
[Wed Sep 21 04:37:23 2005] END HANDLER MESSAGES
[Wed Sep 21 04:37:23 2005] action exited with status 255
[Wed Sep 21 04:37:23 2005] completed event "ibm/hotkey HKEY 00000080 00001003"
/var/log/audit/audit.log reports:
type=AVC msg=audit(1127291842.986:3152715): avc: denied { read } for
pid=7984 comm="lspci" name="pci.ids" dev=dm-0 ino=809685
scontext=system_u:system_r:apmd_t tcontext=system_u:object_r:usr_t
tclass=file
type=SYSCALL msg=audit(1127291842.986:3152715): arch=40000003 syscall=5
success=no exit=-13 a0=8054e5c a1=0 a2=fbad8001 a3=0 items=1 pid=7984
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
comm="lspci" exe="/sbin/lspci"
type=CWD msg=audit(1127291842.986:3152715): cwd="/"
type=PATH msg=audit(1127291842.986:3152715): item=0
name="/usr/share/hwdata/pci.ids" flags=101 inode=809685 dev=fd:00
mode=0100644 ouid=0 ogid=0 rdev=00:00
type=AVC msg=audit(1127291842.997:3153231): avc: denied { read } for
pid=7986 comm="lspci" name="pci.ids" dev=dm-0 ino=809685
scontext=system_u:system_r:apmd_t tcontext=system_u:object_r:usr_t
tclass=file
type=SYSCALL msg=audit(1127291842.997:3153231): arch=40000003 syscall=5
success=no exit=-13 a0=8054e5c a1=0 a2=fbad8001 a3=0 items=1 pid=7986
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
comm="lspci" exe="/sbin/lspci"
type=CWD msg=audit(1127291842.997:3153231): cwd="/"
type=PATH msg=audit(1127291842.997:3153231): item=0
name="/usr/share/hwdata/pci.ids" flags=101 inode=809685 dev=fd:00
mode=0100644 ouid=0 ogid=0 rdev=00:00
--
Matthew Saltzman
Clemson University Math Sciences
mjs AT clemson DOT edu
http://www.math.clemson.edu/~mjs
3:09 p.m.
Can nobody here help with this (and if not, where could I go for
assistance)? selinux-policy-targeted-1.27.1-2.1 does not solve the
problem.
Thanks.
On Wed, 21 Sep 2005, Matthew Saltzman wrote:
On Thu, 15 Sep 2005, Matthew Saltzman wrote:
> I have ACPI scripts that are supposed to run when Fn-Fx is pressed (for
> various values of x). The scripts run fine when invoked from a shell, but
> they fail when invoked by keypress. For example,
> /etc/acpi/actions/Fn-F3.sh contains:
>
> #!/bin/sh
>
> if [ -f /var/tmp/acpi-lightoff ]; then
> /usr/sbin/radeontool light on
> /bin/rm /var/tmp/acpi-lightoff
> else
> /usr/sbin/radeontool light off
> /bin/touch /var/tmp/acpi-lightoff
> fi
>
> When invoked by keypress, I get the following audit messages, and no action
> is taken (light stays on, no file touched). Should I be doing something
> different or is there something in selinux-policy-targeted that needs to be
> fixed?
I've changed the script so that it reads its status directly rather than
checking for the file:
if [ "$(/usr/sbin/radeontool light)" = "The radeon backlight looks
on"
]; then
/usr/sbin/radeontool light off
else
/usr/sbin/radeontool light on
fi
It still works fine if invoked from the command line and doesn't work if
invoked by acpid, unless setenforce 0 is set. How can I fix this, and can it
be fixed in selinux-policy-targeted? Thanks.
/var/log/acpi reports:
[Wed Sep 21 04:37:22 2005] received event "ibm/hotkey HKEY 00000080 00001003"
[Wed Sep 21 04:37:22 2005] notifying client 3203[500:500]
[Wed Sep 21 04:37:22 2005] executing action "/etc/acpi/actions/Fn-F3.sh"
[Wed Sep 21 04:37:22 2005] BEGIN HANDLER MESSAGES
Radeon hardware not found in lspci output.
Radeon hardware not found in lspci output.
[Wed Sep 21 04:37:23 2005] END HANDLER MESSAGES
[Wed Sep 21 04:37:23 2005] action exited with status 255
[Wed Sep 21 04:37:23 2005] completed event "ibm/hotkey HKEY 00000080
00001003"
/var/log/audit/audit.log reports:
type=AVC msg=audit(1127291842.986:3152715): avc: denied { read } for
pid=7984 comm="lspci" name="pci.ids" dev=dm-0 ino=809685
scontext=system_u:system_r:apmd_t tcontext=system_u:object_r:usr_t
tclass=file
type=SYSCALL msg=audit(1127291842.986:3152715): arch=40000003 syscall=5
success=no exit=-13 a0=8054e5c a1=0 a2=fbad8001 a3=0 items=1 pid=7984
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
comm="lspci" exe="/sbin/lspci"
type=CWD msg=audit(1127291842.986:3152715): cwd="/"
type=PATH msg=audit(1127291842.986:3152715): item=0
name="/usr/share/hwdata/pci.ids" flags=101 inode=809685 dev=fd:00
mode=0100644 ouid=0 ogid=0 rdev=00:00
type=AVC msg=audit(1127291842.997:3153231): avc: denied { read } for
pid=7986 comm="lspci" name="pci.ids" dev=dm-0 ino=809685
scontext=system_u:system_r:apmd_t tcontext=system_u:object_r:usr_t
tclass=file
type=SYSCALL msg=audit(1127291842.997:3153231): arch=40000003 syscall=5
success=no exit=-13 a0=8054e5c a1=0 a2=fbad8001 a3=0 items=1 pid=7986
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
comm="lspci" exe="/sbin/lspci"
type=CWD msg=audit(1127291842.997:3153231): cwd="/"
type=PATH msg=audit(1127291842.997:3153231): item=0
name="/usr/share/hwdata/pci.ids" flags=101 inode=809685 dev=fd:00
mode=0100644 ouid=0 ogid=0 rdev=00:00
--
Matthew Saltzman
Clemson University Math Sciences
mjs AT clemson DOT edu
http://www.math.clemson.edu/~mjs
3:22 p.m.
On Fri, 2005-09-23 at 16:09 -0400, Matthew Saltzman wrote:
Can nobody here help with this (and if not, where could I go for
assistance)? selinux-policy-targeted-1.27.1-2.1 does not solve the
problem.
From the audit messages you posted, I would have expected that:
- a new type would have been assigned to /usr/share/hwdata, and apmd_t
would have been allowed to read it.
- tmp_domain(apmd_t) would have been added to enable it to create its
own temporary files under /tmp without disturbing anyone else's
temporary files.
Looking at the latest rawhide targeted policy (1.27.1-5), it looks like
the tmp_domain() has been added, it has been directly allowed to read
usr_t (which I would have preferred not doing) and it has been made
unconfined in targeted policy (which seems overkill). So I would expect
your scripts to work just fine with that policy, even though I'd still
favor adding a new type for /usr/share/hwdata and not making apmd_t
completely unconfined.
--
Stephen Smalley
National Security Agency
11:14 a.m.
On Fri, 23 Sep 2005, Stephen Smalley wrote:
On Fri, 2005-09-23 at 16:09 -0400, Matthew Saltzman wrote:
> Can nobody here help with this (and if not, where could I go for
> assistance)? selinux-policy-targeted-1.27.1-2.1 does not solve the
> problem.
It also appears that there is a regression in acpid's ability to write log
files. My suspend script writes battery usage stats to
/var/log/battery.log. Since the most recent update, access to that file
is denied.
Several records like this appear in audit.log:
type=AVC msg=audit(1127578352.719:7582708): avc: denied { append } for
pid=3860 comm="thinkpad-T4x-su" name="battery.log" dev=dm-0 ino=910036
scontext=system_u:system_r:apmd_t tcontext=system_u:object_r:var_log_t
tclass=file
> From the audit messages you posted, I would have expected that:
- a new type would have been assigned to /usr/share/hwdata, and apmd_t
would have been allowed to read it.
- tmp_domain(apmd_t) would have been added to enable it to create its
own temporary files under /tmp without disturbing anyone else's
temporary files.
Looking at the latest rawhide targeted policy (1.27.1-5), it looks like
the tmp_domain() has been added, it has been directly allowed to read
usr_t (which I would have preferred not doing) and it has been made
unconfined in targeted policy (which seems overkill). So I would expect
your scripts to work just fine with that policy, even though I'd still
favor adding a new type for /usr/share/hwdata and not making apmd_t
completely unconfined.
--
Matthew Saltzman
Clemson University Math Sciences
mjs AT clemson DOT edu
http://www.math.clemson.edu/~mjs
2:51 p.m.
Stephen Smalley wrote:
On Fri, 2005-09-23 at 16:09 -0400, Matthew Saltzman wrote:
>Can nobody here help with this (and if not, where could I go for
>assistance)? selinux-policy-targeted-1.27.1-2.1 does not solve the
>problem.
>
>
>From the audit messages you posted, I would have expected that:
- a new type would have been assigned to /usr/share/hwdata, and apmd_t
would have been allowed to read it.
I am making this change.
- tmp_domain(apmd_t) would have been added to enable it to create its
own temporary files under /tmp without disturbing anyone else's
temporary files.
Looking at the latest rawhide targeted policy (1.27.1-5), it looks like
the tmp_domain() has been added, it has been directly allowed to read
usr_t (which I would have preferred not doing) and it has been made
unconfined in targeted policy (which seems overkill). So I would expect
your scripts to work just fine with that policy, even though I'd still
favor adding a new type for /usr/share/hwdata and not making apmd_t
completely unconfined.
The problem is there is no standard scripts for this yet. Trying to
lock down acpid is a moving target at this time, until the distros
settle on a standard way of doing this. So until then it is better to
run unconfined. If in FC5 timeframe a standard
develops in Fedora, I will make the policy work and remove the
unconfined_domain.
--
3:44 p.m.
Should this have been fixed in selinux-policy-targeted-1.27.1-2.2, or is
that still behind the Rawhide one?
This works from console but not from Fn-F3.
Thanks.
script:
#!/bin/sh
if [ "$(/usr/sbin/radeontool light)" = "The radeon backlight looks on"
];
then
/usr/sbin/radeontool light off
else
/usr/sbin/radeontool light on
fi
acpid.log:
---------
[Mon Sep 26 16:37:59 2005] received event "ibm/hotkey HKEY 00000080
00001003"
[Mon Sep 26 16:37:59 2005] notifying client 3001[500:500]
[Mon Sep 26 16:37:59 2005] executing action "/etc/acpi/actions/Fn-F3.sh"
[Mon Sep 26 16:37:59 2005] BEGIN HANDLER MESSAGES
can't open /dev/mem
Are you root?
can't open /dev/mem
Are you root?
[Mon Sep 26 16:37:59 2005] END HANDLER MESSAGES
[Mon Sep 26 16:37:59 2005] action exited with status 255
[Mon Sep 26 16:37:59 2005] completed event "ibm/hotkey HKEY 00000080
00001003"
audit.log:
---------
type=AVC msg=audit(1127767197.001:907558): avc: denied { read write }
for pid=6106 comm="radeontool" name="mem" dev=tmpfs ino=901
scontext=system_u:system_r:apmd_t
tcontext=system_u:object_r:memory_device_t tclass=chr_file
type=SYSCALL msg=audit(1127767197.001:907558): arch=40000003 syscall=5
success=no exit=-13 a0=8049c06 a1=2 a2=bfca76e8 a3=bfca72f8 items=1
pid=6106 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 comm="radeontool" exe="/usr/sbin/radeontool"
type=CWD msg=audit(1127767197.001:907558): cwd="/"
type=PATH msg=audit(1127767197.001:907558): item=0 name="/dev/mem"
flags=101 inode=901 dev=00:0d mode=020640 ouid=0 ogid=9 rdev=01:01
type=AVC msg=audit(1127767197.066:908249): avc: denied { read write }
for pid=6108 comm="radeontool" name="mem" dev=tmpfs ino=901
scontext=system_u:system_r:apmd_t
tcontext=system_u:object_r:memory_device_t tclass=chr_file
type=SYSCALL msg=audit(1127767197.066:908249): arch=40000003 syscall=5
success=no exit=-13 a0=8049c06 a1=2 a2=bf952a78 a3=bf952688 items=1
pid=6108 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 comm="radeontool" exe="/usr/sbin/radeontool"
type=CWD msg=audit(1127767197.066:908249): cwd="/"
type=PATH msg=audit(1127767197.066:908249): item=0 name="/dev/mem"
flags=101 inode=901 dev=00:0d mode=020640 ouid=0 ogid=9 rdev=01:01
On Mon, 26 Sep 2005, Daniel J Walsh wrote:
Stephen Smalley wrote:
> On Fri, 2005-09-23 at 16:09 -0400, Matthew Saltzman wrote:
>
>> Can nobody here help with this (and if not, where could I go for
>> assistance)? selinux-policy-targeted-1.27.1-2.1 does not solve the
>> problem.
>>
>
>> From the audit messages you posted, I would have expected that:
> - a new type would have been assigned to /usr/share/hwdata, and apmd_t
> would have been allowed to read it.
>
I am making this change.
> - tmp_domain(apmd_t) would have been added to enable it to create its
> own temporary files under /tmp without disturbing anyone else's
> temporary files.
>
> Looking at the latest rawhide targeted policy (1.27.1-5), it looks like
> the tmp_domain() has been added, it has been directly allowed to read
> usr_t (which I would have preferred not doing) and it has been made
> unconfined in targeted policy (which seems overkill). So I would expect
> your scripts to work just fine with that policy, even though I'd still
> favor adding a new type for /usr/share/hwdata and not making apmd_t
> completely unconfined.
>
>
The problem is there is no standard scripts for this yet. Trying to lock
down acpid is a moving target at this time, until the distros settle on a
standard way of doing this. So until then it is better to run unconfined.
If in FC5 timeframe a standard
develops in Fedora, I will make the policy work and remove the
unconfined_domain.
--
Matthew Saltzman
Clemson University Math Sciences
mjs AT clemson DOT edu
http://www.math.clemson.edu/~mjs
6784
days inactive
6795
days old
selinux@lists.fedoraproject.org
6 comments
3 participants
participants (3)
-
Daniel J Walsh -
Matthew Saltzman -
Stephen Smalley