SELinux preventing D-Bus starting ConsoleKit etc - Was: F10 - pulseaudio not running

[Mike Fleetwood]

I wrote:
>  I can see that on my functioning desktops that before login, gdm has
>  been granted read-write access, via ACLs, to the sound device files in
>  /dev/snd/.  After GDM login my user is granted read-write instead.
>
>  On my broken desktop there are no ACLs granting extra permissions.  I
>  have now restored the original permissions on the /dev/snd/* files and
>  added my user read-write access via ACLs.  Still pulseaudio does not
>  start.
>
>  I also noticed that on my broken desktop, console-kit-daemon is not
>  running.  So far I have only found that console-kit-daemon may have
>  been started with /etc/rc.d/init.d/ConsoleKit circa Fedora 8.  That
>  consoleKit service script been removed in Fedora 10 and I don't yet
>  know how console-kit-daemon is meant to be started.
>
>  Is console-kit-daemon running even relevant to GDM adding ACLs for the
>  console user to access devices?  Probably.  Is this relevant to why
>  pulseaudio fails to start?  Don't know as even when standard file
>  permissions, rather than ACLs, allowed access to /dev/snd/* pulseaudio
>  died on startup.
>
>  From my functional home desktop ...
>  [mike@rockover ~]$ getfacl -p /dev/snd/controlC0
>  # file: /dev/snd/controlC0
>  # owner: root
>  # group: root
>  user::rw-
>  user:mike:rw-
>  group::rw-
>  mask::rw-
>  other::---
>  (Same results of additional user mike ACL for all devices in /dev/snd/).
>  [mike@rockover ~]$ ck-list-sessions
>  Session4:
>         unix-user = '500'
>         realname = 'Mike Fleetwood,,,,'
>         seat = 'Seat1'
>         session-type = ''
>         active = TRUE
>         x11-display = ':0'
>         x11-display-device = '/dev/tty1'
>         display-device = ''
>         remote-host-name = ''
>         is-local = TRUE
>         on-since = '2009-04-08T19:06:01.429138Z'
>         login-session-id = '702'
>  [mike@rockover ~]$ ps -ef | fgrep console-kit-daemon
>  root      2477     1  0 Apr08 ?        00:00:00 /usr/sbin/console-kit-daemon
>  mike     23954 19225  0 12:05 pts/0    00:00:00 fgrep console-kit-daemon
>
>  From my broken work desktop ...
>  [mfleetwo@mfleetwo3 ~]$ su -
>  Password:
>  [root@mfleetwo3 ~]# chmod o= /dev/snd/*
>  [root@mfleetwo3 ~]# setfacl -m u:mfleetwo:rw /dev/snd/*
>  [root@mfleetwo3 ~]# ls -l /dev/snd/*
>  crw-rw----+ 1 root root 116, 7 2009-04-22 13:13 /dev/snd/controlC0
>  crw-rw----+ 1 root root 116, 6 2009-04-22 13:13 /dev/snd/hwC0D0
>  crw-rw----+ 1 root root 116, 5 2009-05-06 12:15 /dev/snd/pcmC0D0c
>  crw-rw----+ 1 root root 116, 4 2009-05-06 12:15 /dev/snd/pcmC0D0p
>  crw-rw----+ 1 root root 116, 3 2009-04-22 13:13 /dev/snd/seq
>  crw-rw----+ 1 root root 116, 2 2009-04-22 13:13 /dev/snd/timer
>  [root@mfleetwo3 ~]# getfacl -p /dev/snd/controlC0
>  # file: /dev/snd/controlC0
>  # owner: root
>  # group: root
>  user::rw-
>  user:mfleetwo:rw-
>  group::rw-
>  mask::rw-
>  other::---
>  [root@mfleetwo3 ~]# exit
>  logout
>  [mfleetwo@mfleetwo3 ~]$ pulseaudio --start --log-target=syslog
>  I: caps.c: Limited capabilities successfully to CAP_SYS_NICE.
>  I: caps.c: Dropping root privileges.
>  I: caps.c: Limited capabilities successfully to CAP_SYS_NICE.
>  [WARN  9224] polkit-session.c:144:polkit_session_set_uid(): session != NULL
>   Not built with -rdynamic so unable to print a backtrace
>  [mfleetwo@mfleetwo3 ~]$ echo $?
>  1
>  [mfleetwo@mfleetwo3 ~]$ ps -ef | fgrep pulseaudio
>  [mfleetwo@mfleetwo3 ~]$ ck-list-sessions
>
>  ** (ck-list-sessions:9244): WARNING **: Failed to get list of seats:
>  Cannot launch daemon, file not found or permissions invalid
>  [mfleetwo@mfleetwo3 ~]$ ps -ef | fgrep console-kit-daemon 
I have identified that my issues are caused by SELinux.  I have
rebooted with enforcing=0 to switch SELinux into permissive mode and
ConsoleKit and Pulseaudio start correctly and audacious plays music.
Even after performing a full relabelling of the SELinux security
context of all files by touching /.autorelabel and rebooting, SELinux
in enforcing is preventing D-Bus starting ConsoleKit and Pulseaudio
starting.  Investigation into SELinux continuing.

E.g. SELinux in enforcing mode:
[root@mfleetwo3 ~]# id -Z
unconfined_u:unconfined_r:unconfined_t:SystemLow-SystemHigh
[root@mfleetwo3 ~]# service messagebus status
env: /etc/init.d/messagebus: Permission denied

and SELinux in permissive mode:
[root@mfleetwo3 ~]# service messagebus status
dbus-daemon (pid 2736 2055) is running...

Thanks,
Mike

[Daniel J Walsh]

On 05/20/2009 04:23 AM, Mike Fleetwood wrote:
>  I wrote:
> > I can see that on my functioning desktops that before login, gdm has
> > been granted read-write access, via ACLs, to the sound device files in
> > /dev/snd/.  After GDM login my user is granted read-write instead.
> >
> > On my broken desktop there are no ACLs granting extra permissions.  I
> > have now restored the original permissions on the /dev/snd/* files and
> > added my user read-write access via ACLs.  Still pulseaudio does not
> > start.
> >
> > I also noticed that on my broken desktop, console-kit-daemon is not
> > running.  So far I have only found that console-kit-daemon may have
> > been started with /etc/rc.d/init.d/ConsoleKit circa Fedora 8.  That
> > consoleKit service script been removed in Fedora 10 and I don't yet
> > know how console-kit-daemon is meant to be started.
> >
> > Is console-kit-daemon running even relevant to GDM adding ACLs for the
> > console user to access devices?  Probably.  Is this relevant to why
> > pulseaudio fails to start?  Don't know as even when standard file
> > permissions, rather than ACLs, allowed access to /dev/snd/* pulseaudio
> > died on startup.
> >
> >  From my functional home desktop ...
> > [mike@rockover ~]$ getfacl -p /dev/snd/controlC0
> > # file: /dev/snd/controlC0
> > # owner: root
> > # group: root
> > user::rw-
> > user:mike:rw-
> > group::rw-
> > mask::rw-
> > other::---
> > (Same results of additional user mike ACL for all devices in /dev/snd/).
> > [mike@rockover ~]$ ck-list-sessions
> > Session4:
> >         unix-user = '500'
> >         realname = 'Mike Fleetwood,,,,'
> >         seat = 'Seat1'
> >         session-type = ''
> >         active = TRUE
> >         x11-display = ':0'
> >         x11-display-device = '/dev/tty1'
> >         display-device = ''
> >         remote-host-name = ''
> >         is-local = TRUE
> >         on-since = '2009-04-08T19:06:01.429138Z'
> >         login-session-id = '702'
> > [mike@rockover ~]$ ps -ef | fgrep console-kit-daemon
> > root      2477     1  0 Apr08 ?        00:00:00 /usr/sbin/console-kit-daemon
> > mike     23954 19225  0 12:05 pts/0    00:00:00 fgrep console-kit-daemon
> >
> >  From my broken work desktop ...
> > [mfleetwo@mfleetwo3 ~]$ su -
> > Password:
> > [root@mfleetwo3 ~]# chmod o= /dev/snd/*
> > [root@mfleetwo3 ~]# setfacl -m u:mfleetwo:rw /dev/snd/*
> > [root@mfleetwo3 ~]# ls -l /dev/snd/*
> > crw-rw----+ 1 root root 116, 7 2009-04-22 13:13 /dev/snd/controlC0
> > crw-rw----+ 1 root root 116, 6 2009-04-22 13:13 /dev/snd/hwC0D0
> > crw-rw----+ 1 root root 116, 5 2009-05-06 12:15 /dev/snd/pcmC0D0c
> > crw-rw----+ 1 root root 116, 4 2009-05-06 12:15 /dev/snd/pcmC0D0p
> > crw-rw----+ 1 root root 116, 3 2009-04-22 13:13 /dev/snd/seq
> > crw-rw----+ 1 root root 116, 2 2009-04-22 13:13 /dev/snd/timer
> > [root@mfleetwo3 ~]# getfacl -p /dev/snd/controlC0
> > # file: /dev/snd/controlC0
> > # owner: root
> > # group: root
> > user::rw-
> > user:mfleetwo:rw-
> > group::rw-
> > mask::rw-
> > other::---
> > [root@mfleetwo3 ~]# exit
> > logout
> > [mfleetwo@mfleetwo3 ~]$ pulseaudio --start --log-target=syslog
> > I: caps.c: Limited capabilities successfully to CAP_SYS_NICE.
> > I: caps.c: Dropping root privileges.
> > I: caps.c: Limited capabilities successfully to CAP_SYS_NICE.
> > [WARN  9224] polkit-session.c:144:polkit_session_set_uid(): session != NULL
> >   Not built with -rdynamic so unable to print a backtrace
> > [mfleetwo@mfleetwo3 ~]$ echo $?
> > 1
> > [mfleetwo@mfleetwo3 ~]$ ps -ef | fgrep pulseaudio
> > [mfleetwo@mfleetwo3 ~]$ ck-list-sessions
> >
> > ** (ck-list-sessions:9244): WARNING **: Failed to get list of seats:
> > Cannot launch daemon, file not found or permissions invalid
> > [mfleetwo@mfleetwo3 ~]$ ps -ef | fgrep console-kit-daemon
>
>  I have identified that my issues are caused by SELinux.  I have
>  rebooted with enforcing=0 to switch SELinux into permissive mode and
>  ConsoleKit and Pulseaudio start correctly and audacious plays music.
>  Even after performing a full relabelling of the SELinux security
>  context of all files by touching /.autorelabel and rebooting, SELinux
>  in enforcing is preventing D-Bus starting ConsoleKit and Pulseaudio
>  starting.  Investigation into SELinux continuing.
>
>  E.g. SELinux in enforcing mode:
>  [root@mfleetwo3 ~]# id -Z
>  unconfined_u:unconfined_r:unconfined_t:SystemLow-SystemHigh
>  [root@mfleetwo3 ~]# service messagebus status
>  env: /etc/init.d/messagebus: Permission denied
>
>  and SELinux in permissive mode:
>  [root@mfleetwo3 ~]# service messagebus status
>  dbus-daemon (pid 2736 2055) is running...
>
>  Thanks,
>  Mike
>  
Are you fully yum update on selinux policy?


yum -y upgrade selinux-policy-targeted

[Ian Malone]

2009/5/21 Mike Fleetwood <mike.fleetwood(a)googlemail.com&gt;:
>  Daniel J Walsh wrote:
> > Mike could you join me on irc #selinux on freenode and talk to me there
> > (dwalsh)?
>
>  In summary Daniel talked me through checking out SELinux in more
>  detail over IRC.  There was some sort of corruption with the SELinux
>  targeted policy from my Fedora 8 to 10 upgrade a couple of months ago.
>   Reinstalled the targeted policy RPM and relabelled everything.
>  ConsoleKit is now running and /sbin/service works.  I expect
>  Pulseaudio will start and audacious play audio, but I am not at the
>  console to login and check.
>  
In case anyone runs into this problem, I was in a similar situation
with a Fedora 8 -> 10 -> 11 upgrade via preupgrade, which prevented me
logging even via gdm even in permissive mode with an error:
"Could not get name on session bus"
At which point I'd get sent back to the log in screen. Simply
relabelling (via /.autorelabel, fixfiles or restorecon) or yum
reinstall selinux-policy-targeted wasn't sufficient to fix it for me
and it turned out it was necessary to:
# yum erase selinux-policy-targeted
# mv /etc/selinux/targeted/modules /etc/selinux/targeted/modules.old
# yum install selinux-policy-targeted
Followed for good measure by rebooting into permissive mode with
relabelling.  The system now runs fine in enforcing mode.

-- 
imalone

[Mike Fleetwood]

Daniel J Walsh wrote:
>  Mike could you join me on irc #selinux on freenode and talk to me
> there
>  (dwalsh)? 
In summary Daniel talked me through checking out SELinux in more
detail over IRC.  There was some sort of corruption with the SELinux
targeted policy from my Fedora 8 to 10 upgrade a couple of months ago.
 Reinstalled the targeted policy RPM and relabelled everything.
ConsoleKit is now running and /sbin/service works.  I expect
Pulseaudio will start and audacious play audio, but I am not at the
console to login and check.

Many thanks,
Mike

[Daniel J Walsh]

On 05/21/2009 03:26 PM, Mike Fleetwood wrote:
>  Daniel J Walsh:
> > What file system are you using?
> >
> > Try
> > # restorecon -R -v / 2>  /dev/null
> >
> > You will get lots of errors.
>
>  Ext3 file system.
>  [root@mfleetwo3 ~]# mount | egrep '/ |/boot'
>  /dev/mapper/VolGroup00-LogVol00 on / type ext3 (rw)
>  /dev/sda1 on /boot type ext3 (rw)
>
>  [root@mfleetwo3 ~]# restorecon -R -v / 2>  /dev/null
>  restorecon reset /dev/shm context
>  system_u:object_r:tmpfs_t:s0->system_u:object_r:device_t:s0
>  restorecon reset /dev/shm/pulse-shm-1549836239 context
>  unconfined_u:object_r:unconfined_tmpfs_t:s0->system_u:object_r:device_t:s0
>
>  I only got these 2 context corrections.  About as I expected as I
>  performed a full relabel earlier by touching /.autolabel and rebooting
>  only a few days ago before I asked for help.
>
>  Thanks,
>  Mike
>  
Mike could you join me on irc #selinux on freenode and talk to me there 
(dwalsh)?

[Mike Fleetwood]

Daniel J Walsh:
>  What file system are you using?
>
>  Try
>  # restorecon -R -v / 2> /dev/null
>
>  You will get lots of errors. 
Ext3 file system.
[root@mfleetwo3 ~]# mount | egrep '/ |/boot'
/dev/mapper/VolGroup00-LogVol00 on / type ext3 (rw)
/dev/sda1 on /boot type ext3 (rw)

[root@mfleetwo3 ~]# restorecon -R -v / 2> /dev/null
restorecon reset /dev/shm context
system_u:object_r:tmpfs_t:s0->system_u:object_r:device_t:s0
restorecon reset /dev/shm/pulse-shm-1549836239 context
unconfined_u:object_r:unconfined_tmpfs_t:s0->system_u:object_r:device_t:s0

I only got these 2 context corrections.  About as I expected as I
performed a full relabel earlier by touching /.autolabel and rebooting
only a few days ago before I asked for help.

Thanks,
Mike

[Daniel J Walsh]

On 05/21/2009 11:27 AM, Mike Fleetwood wrote:
>  Daniel J Walsh wrote:
> > Your message bus is running as initrc_t which indicates that you have a
> > labeling problem.
> >
> > fixfiles restore
> >
> > Reboot and you should be all set.
> >
> > Your message bus should be running as system_dbusd_t.  It is also running as
> > unconfined_u:unconfined_r which indicates you have stopped and started it.
> >
> > If you run restorecon -R -v /bin  I would figure you will see some
> > mislabeled files.
>
>  Logged in to X11 via GDM as my user mfleetwo, then in a terminal su -.
>
>  [root@mfleetwo3 ~]# sestatus
>  SELinux status:                 enabled
>  SELinuxfs mount:                /selinux
>  Current mode:                   permissive
>  Mode from config file:          enforcing
>  Policy version:                 23
>  Policy from config file:        targeted
>
>  [root@mfleetwo3 ~]# fixfiles restore
>  ****************************************/sbin/setfiles:  unable to
>  stat file /home/mfleetwo/.gvfs: Permission denied
>  /sbin/setfiles:  error while labeling /:  Permission denied
>  /sbin/setfiles:  error while labeling /boot:  Permission denied
>
>  And in /var/log/audit/audit.log:
>  type=FS_RELABEL msg=audit(1242919396.655:30941): user pid=4985 uid=0
>  auid=500 ses=2 subj=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023
>  msg='op=mass relabel: exe="/sbin/setfiles" (hostname=?, addr=?,
>  terminal=pts/1 res=failed)'
>
>  Stopped at this point as to me it looks like 'fixfiles restore' didn't work.
>
>  [root@mfleetwo3 ~]# df -k
>  Filesystem           1K-blocks      Used Available Use% Mounted on
>  /dev/mapper/VolGroup00-LogVol00
>                         46884088  36970092   7504128  84% /
>  /dev/sda1               202219     28319    163573  15% /boot
>  tmpfs                   772768        76    772692   1% /dev/shm
>
>  [root@mfleetwo3 ~]# ls -dZ / /boot
>  drwxr-xr-x  root root system_u:object_r:root_t         /
>  drwxr-xr-x  root root system_u:object_r:boot_t         /boot
>
>  Thanks,
>  Mike
>  
What file system are you using?

Try
# restorecon -R -v / 2> /dev/null

You will get lots of errors.

[Mike Fleetwood]

Daniel J Walsh wrote:
>  Your message bus is running as initrc_t which indicates that you have
> a
>  labeling problem.
>
>  fixfiles restore
>
>  Reboot and you should be all set.
>
>  Your message bus should be running as system_dbusd_t.  It is also running as
>  unconfined_u:unconfined_r which indicates you have stopped and started it.
>
>  If you run restorecon -R -v /bin  I would figure you will see some
>  mislabeled files. 
Logged in to X11 via GDM as my user mfleetwo, then in a terminal su -.

[root@mfleetwo3 ~]# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          enforcing
Policy version:                 23
Policy from config file:        targeted

[root@mfleetwo3 ~]# fixfiles restore
****************************************/sbin/setfiles:  unable to
stat file /home/mfleetwo/.gvfs: Permission denied
/sbin/setfiles:  error while labeling /:  Permission denied
/sbin/setfiles:  error while labeling /boot:  Permission denied

And in /var/log/audit/audit.log:
type=FS_RELABEL msg=audit(1242919396.655:30941): user pid=4985 uid=0
auid=500 ses=2 subj=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023
msg='op=mass relabel: exe="/sbin/setfiles" (hostname=?, addr=?,
terminal=pts/1 res=failed)'

Stopped at this point as to me it looks like 'fixfiles restore' didn't work.

[root@mfleetwo3 ~]# df -k
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
                      46884088  36970092   7504128  84% /
/dev/sda1               202219     28319    163573  15% /boot
tmpfs                   772768        76    772692   1% /dev/shm

[root@mfleetwo3 ~]# ls -dZ / /boot
drwxr-xr-x  root root system_u:object_r:root_t         /
drwxr-xr-x  root root system_u:object_r:boot_t         /boot

Thanks,
Mike

[Daniel J Walsh]

On 05/21/2009 09:42 AM, Mike Fleetwood wrote:
>  Daniel J Walsh wrote:
> > Are you seeing any avc's in /var/log/audit/audit.log?
>
>  With SELinux in permissive mode ...
>  [root@mfleetwo3 ~]# id
>  uid=0(root) gid=0(root)
>  groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
>  context=unconfined_u:unconfined_r:unconfined_t:SystemLow-SystemHigh
>  [root@mfleetwo3 ~]# service messagebus status
>  dbus-daemon (pid 2736 2055) is running...
>
>  I get the following in /var/log/audit/audit.log:
>  type=SELINUX_ERR msg=audit(1242912572.287:30134):
>  security_compute_sid:  invalid context
>  unconfined_u:unconfined_r:initrc_t:s0 for
>  scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>  tcontext=system_u:object_r:initrc_exec_t:s0 tclass=process
>  type=SYSCALL msg=audit(1242912572.287:30134): arch=40000003 syscall=11
>  success=yes exit=0 a0=bf981981 a1=bf980194 a2=8fca858 a3=4 items=0
>  ppid=4082 pid=4087 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
>  sgid=0 fsgid=0 tty=pts1 ses=2 comm="messagebus" exe="/bin/bash"
>  subj=unconfined_u:unconfined_r:initrc_t:s0 key=(null)
>  type=SELINUX_ERR msg=audit(1242912572.294:30135):
>  security_compute_sid:  invalid context
>  unconfined_u:unconfined_r:initrc_t:s0 for
>  scontext=unconfined_u:unconfined_r:initrc_t:s0
>  tcontext=system_u:object_r:consoletype_exec_t:s0 tclass=process
>  type=SYSCALL msg=audit(1242912572.294:30135): arch=40000003 syscall=11
>  success=yes exit=0 a0=8ec9e78 a1=8ec44b8 a2=8ec9c08 a3=0 items=0
>  ppid=4088 pid=4089 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
>  sgid=0 fsgid=0 tty=pts1 ses=2 comm="consoletype"
>  exe="/sbin/consoletype" subj=unconfined_u:unconfined_r:initrc_t:s0
>  key=(null)
>  type=SELINUX_ERR msg=audit(1242912572.310:30136):
>  security_compute_sid:  invalid context
>  unconfined_u:unconfined_r:initrc_t:s0 for
>  scontext=unconfined_u:unconfined_r:initrc_t:s0
>  tcontext=system_u:object_r:bin_t:s0 tclass=process
>  type=SYSCALL msg=audit(1242912572.310:30136): arch=40000003 syscall=11
>  success=yes exit=0 a0=8ec8e80 a1=8ec48f8 a2=8ec8fd0 a3=0 items=0
>  ppid=4090 pid=4091 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
>  sgid=0 fsgid=0 tty=pts1 ses=2 comm="pidof" exe="/sbin/killall5"
>  subj=unconfined_u:unconfined_r:initrc_t:s0 key=(null)
>
>
>  I assume that there is a single SELinux related root cause which is
>  preventing D-Bus starting ConsoleKit and preventing /sbin/service
>  reporting status of daemon when SELinux is in enforcing mode.
>
>  P.S. Sorry in advance if I don't replay for a week I am away on
>  holiday from Friday for a week with unknown Internet connectivity.
>
>  Thanks,
>  Mike
>  
Your message bus is running as initrc_t which indicates that you have a 
labeling problem.

fixfiles restore

Reboot and you should be all set.

Your message bus should be running as system_dbusd_t.  It is also 
running as unconfined_u:unconfined_r which indicates you have stopped 
and started it.

If you run restorecon -R -v /bin  I would figure you will see some 
mislabeled files.

[Mike Fleetwood]

Daniel J Walsh wrote:
>  Are you seeing any avc's in /var/log/audit/audit.log? 
With SELinux in permissive mode ...
[root@mfleetwo3 ~]# id
uid=0(root) gid=0(root)
groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
context=unconfined_u:unconfined_r:unconfined_t:SystemLow-SystemHigh
[root@mfleetwo3 ~]# service messagebus status
dbus-daemon (pid 2736 2055) is running...

I get the following in /var/log/audit/audit.log:
type=SELINUX_ERR msg=audit(1242912572.287:30134):
security_compute_sid:  invalid context
unconfined_u:unconfined_r:initrc_t:s0 for
scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tcontext=system_u:object_r:initrc_exec_t:s0 tclass=process
type=SYSCALL msg=audit(1242912572.287:30134): arch=40000003 syscall=11
success=yes exit=0 a0=bf981981 a1=bf980194 a2=8fca858 a3=4 items=0
ppid=4082 pid=4087 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts1 ses=2 comm="messagebus" exe="/bin/bash"
subj=unconfined_u:unconfined_r:initrc_t:s0 key=(null)
type=SELINUX_ERR msg=audit(1242912572.294:30135):
security_compute_sid:  invalid context
unconfined_u:unconfined_r:initrc_t:s0 for
scontext=unconfined_u:unconfined_r:initrc_t:s0
tcontext=system_u:object_r:consoletype_exec_t:s0 tclass=process
type=SYSCALL msg=audit(1242912572.294:30135): arch=40000003 syscall=11
success=yes exit=0 a0=8ec9e78 a1=8ec44b8 a2=8ec9c08 a3=0 items=0
ppid=4088 pid=4089 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts1 ses=2 comm="consoletype"
exe="/sbin/consoletype" subj=unconfined_u:unconfined_r:initrc_t:s0
key=(null)
type=SELINUX_ERR msg=audit(1242912572.310:30136):
security_compute_sid:  invalid context
unconfined_u:unconfined_r:initrc_t:s0 for
scontext=unconfined_u:unconfined_r:initrc_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
type=SYSCALL msg=audit(1242912572.310:30136): arch=40000003 syscall=11
success=yes exit=0 a0=8ec8e80 a1=8ec48f8 a2=8ec8fd0 a3=0 items=0
ppid=4090 pid=4091 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts1 ses=2 comm="pidof" exe="/sbin/killall5"
subj=unconfined_u:unconfined_r:initrc_t:s0 key=(null)


I assume that there is a single SELinux related root cause which is
preventing D-Bus starting ConsoleKit and preventing /sbin/service
reporting status of daemon when SELinux is in enforcing mode.

P.S. Sorry in advance if I don't replay for a week I am away on
holiday from Friday for a week with unknown Internet connectivity.

Thanks,
Mike

[Daniel J Walsh]

On 05/20/2009 05:33 PM, Mike Fleetwood wrote:
>  Daniel J Walsh wrote:
> > On 05/20/2009 04:23 AM, Mike Fleetwood wrote:
> >> I have identified that my issues are caused by SELinux.  I have
> >> rebooted with enforcing=0 to switch SELinux into permissive mode and
> >> ConsoleKit and Pulseaudio start correctly and audacious plays music.
> >> Even after performing a full relabelling of the SELinux security
> >> context of all files by touching /.autorelabel and rebooting, SELinux
> >> in enforcing is preventing D-Bus starting ConsoleKit and Pulseaudio
> >> starting.  Investigation into SELinux continuing.
> >>
> >> E.g. SELinux in enforcing mode:
> >> [root@mfleetwo3 ~]# id -Z
> >> unconfined_u:unconfined_r:unconfined_t:SystemLow-SystemHigh
> >> [root@mfleetwo3 ~]# service messagebus status
> >> env: /etc/init.d/messagebus: Permission denied
> >>
> >> and SELinux in permissive mode:
> >> [root@mfleetwo3 ~]# service messagebus status
> >> dbus-daemon (pid 2736 2055) is running...
> >>
> > Are you fully yum update on selinux policy?
> >
> >
> > yum -y upgrade selinux-policy-targeted
>
>  SELinux is fully update to date.
>
>  [root@mfleetwo3 ~]# yum -y upgrade selinux-policy-targeted
>  Loaded plugins: refresh-packagekit
>  Setting up Upgrade Process
>  No Packages marked for Update
>
>  [root@mfleetwo3 ~]# rpm -qa | egrep 'selinux|policy'
>  checkpolicy-2.0.16-3.fc10.i386
>  libselinux-devel-2.0.78-1.fc10.i386
>  selinux-policy-targeted-3.5.13-59.fc10.noarch
>  libselinux-2.0.78-1.fc10.i386
>  libselinux-utils-2.0.78-1.fc10.i386
>  policycoreutils-2.0.57-17.fc10.i386
>  selinux-policy-3.5.13-59.fc10.noarch
>  libselinux-python-2.0.78-1.fc10.i386
>  [root@mfleetwo3 ~]# rpm -qa | egrep 'selinux|policy' | xargs rpm -V
>
>  Thanks,
>  Mike
>  
Are you seeing any avc's in /var/log/audit/audit.log?

[Mike Fleetwood]

Daniel J Walsh wrote:
>  On 05/20/2009 04:23 AM, Mike Fleetwood wrote:
> > I have identified that my issues are caused by SELinux.  I have
> > rebooted with enforcing=0 to switch SELinux into permissive mode and
> > ConsoleKit and Pulseaudio start correctly and audacious plays music.
> > Even after performing a full relabelling of the SELinux security
> > context of all files by touching /.autorelabel and rebooting, SELinux
> > in enforcing is preventing D-Bus starting ConsoleKit and Pulseaudio
> > starting.  Investigation into SELinux continuing.
> >
> > E.g. SELinux in enforcing mode:
> > [root@mfleetwo3 ~]# id -Z
> > unconfined_u:unconfined_r:unconfined_t:SystemLow-SystemHigh
> > [root@mfleetwo3 ~]# service messagebus status
> > env: /etc/init.d/messagebus: Permission denied
> >
> > and SELinux in permissive mode:
> > [root@mfleetwo3 ~]# service messagebus status
> > dbus-daemon (pid 2736 2055) is running...
> >
>  Are you fully yum update on selinux policy?
>
>
>  yum -y upgrade selinux-policy-targeted 
SELinux is fully update to date.

[root@mfleetwo3 ~]# yum -y upgrade selinux-policy-targeted
Loaded plugins: refresh-packagekit
Setting up Upgrade Process
No Packages marked for Update

[root@mfleetwo3 ~]# rpm -qa | egrep 'selinux|policy'
checkpolicy-2.0.16-3.fc10.i386
libselinux-devel-2.0.78-1.fc10.i386
selinux-policy-targeted-3.5.13-59.fc10.noarch
libselinux-2.0.78-1.fc10.i386
libselinux-utils-2.0.78-1.fc10.i386
policycoreutils-2.0.57-17.fc10.i386
selinux-policy-3.5.13-59.fc10.noarch
libselinux-python-2.0.78-1.fc10.i386
[root@mfleetwo3 ~]# rpm -qa | egrep 'selinux|policy' | xargs rpm -V

Thanks,
Mike