Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1946091 - SELinux is preventing dbus-daemon from read access on the lnk_file org.gnome.Weather.BackgroundService.service.
Summary: SELinux is preventing dbus-daemon from read access on the lnk_file org.gnome....
Keywords:
Status: CLOSED DUPLICATE of bug 1916652
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 33
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-04-04 10:39 UTC by Soliman Soliman
Modified: 2021-04-13 18:50 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-04-13 18:50:48 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Soliman Soliman 2021-04-04 10:39:56 UTC
Description of problem:
I recently installed a weather application in the Fedora Software and now i keep getting this message as a notification it is really irritating.

Version-Release number of selected component (if applicable):
SELinux is preventing dbus-daemon from read access on the lnk_file org.gnome.Weather.BackgroundService.service.
I have Fedora 33 but I originally had Fedora 27 but upgraded it online
to 28, then to 30 then to 32 then finally to 33 but doing a sudo
dnf update says everything is fine so I don't thing the problem is there
but with the weather application more likely.

How reproducible:
I keep getting a notification and here are the email details:
SELinux is preventing dbus-daemon from read access on the lnk_file org.gnome.Weather.BackgroundService.service.

*****  Plugin catchall_labels (83.8 confidence) suggests   *******************

If you want to allow dbus-daemon to have read access on the org.gnome.Weather.BackgroundService.service lnk_file
Then you need to change the label on org.gnome.Weather.BackgroundService.service
Do
# semanage fcontext -a -t FILE_TYPE 'org.gnome.Weather.BackgroundService.service'
where FILE_TYPE is one of the following: NetworkManager_etc_rw_t, NetworkManager_etc_t, abrt_etc_t, abrt_var_cache_t, admin_home_t, aiccu_etc_t, alsa_etc_rw_t, antivirus_conf_t, asterisk_etc_t, bin_t, bitlbee_conf_t, bluetooth_conf_t, boot_t, bootloader_etc_t, cache_home_t, cert_t, cgconfig_etc_t, cgroup_t, cgrules_etc_t, cluster_conf_t, cobbler_etc_t, condor_conf_t, config_home_t, config_usr_t, conntrackd_conf_t, couchdb_conf_t, courier_etc_t, cpucontrol_conf_t, cupsd_etc_t, cupsd_rw_etc_t, data_home_t, dbus_home_t, dbusd_etc_t, ddclient_etc_t, device_t, devlog_t, dhcp_etc_t, dictd_etc_t, dnsmasq_etc_t, dovecot_etc_t, ecryptfs_t, etc_mail_t, etc_runtime_t, etc_t, exports_t, fetchmail_etc_t, file_context_t, fingerd_etc_t, firewalld_etc_rw_t, firstboot_etc_t, fonts_cache_t, fonts_t, ftpd_etc_t, gconf_etc_t, gconf_home_t, gdomap_conf_t, getty_etc_t, gkeyringd_gnome_home_t, gkeyringd_tmp_t, gnome_home_t, gpm_conf_t, gstreamer_home_t, hddtemp_etc_t, home_root_t, hostname_etc_t, httpd_config_t, hwdata_t, ibacm_conf_t, icc_data_home_t, innd_etc_t, irc_conf_t, irssi_etc_t, kdump_etc_t, kmscon_conf_t, krb5_conf_t, krb5kdc_conf_t, l2tp_conf_t, ld_so_t, lib_t, likewise_etc_t, lircd_etc_t, locale_t, lvm_etc_t, machineid_t, man_cache_t, man_t, mcelog_etc_t, mdadm_conf_t, minidlna_conf_t, minissdpd_conf_t, mock_etc_t, modules_conf_t, mozilla_conf_t, mozilla_plugin_tmp_t, mozilla_plugin_tmpfs_t, mpd_etc_t, mplayer_etc_t, mrtg_etc_t, mscan_etc_t, munin_etc_t, mysqld_etc_t, nagios_etc_t, named_conf_t, net_conf_t, nrpe_etc_t, nslcd_conf_t, ntop_etc_t, ntp_conf_t, nut_conf_t, opendnssec_conf_t, openvpn_etc_rw_t, openvpn_etc_t, openvswitch_rw_t, oracleasm_conf_t, pads_config_t, pam_var_console_t, pdns_conf_t, pegasus_conf_t, pingd_etc_t, piranha_etc_rw_t, piranha_web_conf_t, polipo_etc_t, portreserve_etc_t, postfix_etc_t, postfix_postdrop_t, postgresql_etc_t, postgrey_etc_t, pppd_etc_t, prelude_correlator_config_t, printconf_t, proc_t, psad_etc_t, ptal_etc_t, puppet_etc_t, qmail_etc_t, rabbitmq_conf_t, radiusd_etc_t, radvd_etc_t, redis_conf_t, rhnsd_conf_t, rhsmcertd_config_t, root_t, rpm_script_tmp_t, rpm_var_cache_t, rpm_var_lib_t, rsync_etc_t, samba_etc_t, sanlock_conf_t, security_t, selinux_config_t, selinux_login_config_t, shell_exec_t, shorewall_etc_t, slapd_etc_t, snapperd_conf_t, snort_etc_t, soundd_etc_t, spamd_etc_t, squid_conf_t, src_t, ssh_home_t, sslh_config_t, sssd_conf_t, sssd_var_lib_t, stunnel_etc_t, svc_conf_t, sysfs_t, syslog_conf_t, system_conf_t, system_db_t, system_dbusd_var_lib_t, systemd_hwdb_etc_t, systemd_userdbd_runtime_t, textrel_shlib_t, tftpd_etc_t, tmp_t, tor_etc_t, tuned_etc_t, tuned_rw_etc_t, udev_etc_t, udev_var_run_t, ulogd_etc_t, user_home_dir_t, user_home_t, user_tmp_t, userhelper_conf_t, usr_t, var_lock_t, var_run_t, var_t, varnishd_etc_t, virt_etc_t, virt_var_lib_t, virtlogd_etc_t, vmware_sys_conf_t, webalizer_etc_t, xdm_etc_t, xdm_log_t, xdm_rw_etc_t, xdm_tmpfs_t, xdm_var_lib_t, xdm_var_run_t, xserver_etc_t, xserver_log_t, ypserv_conf_t, zarafa_etc_t, zebra_conf_t.
Then execute:
restorecon -v 'org.gnome.Weather.BackgroundService.service'


*****  Plugin catchall (17.1 confidence) suggests   **************************

If you believe that dbus-daemon should be allowed read access on the org.gnome.Weather.BackgroundService.service lnk_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'dbus-daemon' --raw | audit2allow -M my-dbusdaemon
# semodule -X 300 -i my-dbusdaemon.pp

Additional Information:
Source Context                system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context                system_u:object_r:var_lib_t:s0
Target Objects                org.gnome.Weather.BackgroundService.service [
                              lnk_file ]
Source                        dbus-daemon
Source Path                   dbus-daemon
Port                          <Unknown>
Host                          solimanfedora
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-3.14.6-36.fc33.noarch
Local Policy RPM              selinux-policy-targeted-3.14.6-36.fc33.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     solimanfedora
Platform                      Linux solimanfedora 5.11.11-200.fc33.x86_64 #1 SMP
                              Tue Mar 30 16:53:32 UTC 2021 x86_64 x86_64
Alert Count                   8
First Seen                    2021-04-04 19:59:47 AEST
Last Seen                     2021-04-04 19:59:52 AEST
Local ID                      dc65c79c-3953-4d31-b2c7-617cb95b0fc7

Raw Audit Messages
type=AVC msg=audit(1617530392.365:671): avc:  denied  { read } for  pid=1058 comm="dbus-daemon" name="org.gnome.Weather.BackgroundService.service" dev="dm-3" ino=1445734 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lib_t:s0 tclass=lnk_file permissive=0


Hash: dbus-daemon,xdm_t,var_lib_t,lnk_file,read




Steps to Reproduce:
1. install weather application
2. Run weather application
3. You could get these multiple notifications.

Actual results: Getting multiple notifications but they have died down recently. The email is telling me to do alot of stuff but it is very
complicated I cant understand all of it as i am new to Fedora.


Expected results: If it is a bug please fix it otherwise we should not
be getting so many notifications and it should not be this difficult
instructions for us newbies. If the notifications are to go to an
administrator of some sort you need to let us know their email address.


Additional info:

Comment 1 Zdenek Pytela 2021-04-06 16:31:12 UTC
Hi,

Can you tell where the org.gnome.Weather.BackgroundService.service file is located and which package it is a part of?

Comment 2 Soliman Soliman 2021-04-08 04:45:22 UTC
Hello Zdenek Pytela,
If you can guide me how to do so I probably could but at the moment I don't have enough skills to do that as I am somewhat of a beginner with Fedora Linux.

Comment 3 Zdenek Pytela 2021-04-08 07:13:03 UTC
Use these commands:

find / -name org.gnome.Weather.BackgroundService.service
...shows a file path...
ls -lZd ...file...
ls -lLZd ...file...
rpm -qf ...file...

The find command can be limited to the volume used by dm-3 device

Comment 4 Soliman Soliman 2021-04-08 11:56:01 UTC
I get a whole heap of permission denied but 3 lines for the first command find might hold a clue:
find / -name org.gnome.Weather.BackgroundService.service

/var/lib/flatpak/app/org.gnome.Weather/x86_64/stable/4e24d0d5d4d5cdeaa2f1c5192fabfc6acf77c16bba6b3edba357b2e07ceb6076/files/share/dbus-1/services/org.gnome.Weather.BackgroundService.service
/var/lib/flatpak/app/org.gnome.Weather/x86_64/stable/4e24d0d5d4d5cdeaa2f1c5192fabfc6acf77c16bba6b3edba357b2e07ceb6076/export/share/dbus-1/services/org.gnome.Weather.BackgroundService.service
/var/lib/flatpak/exports/share/dbus-1/services/org.gnome.Weather.BackgroundService.service

Next one: ls -lZd /var/lib/flatpak/app/org.gnome.Weather/x86_64/stable/4e24d0d5d4d5cdeaa2f1c5192fabfc6acf77c16bba6b3edba357b2e07ceb6076/files/share/dbus-1/services/org.gnome.Weather.BackgroundService.service
-rw-r--r--. 2 root root system_u:object_r:var_lib_t:s0 127 Jan  1  1970 /var/lib/flatpak/app/org.gnome.Weather/x86_64/stable/4e24d0d5d4d5cdeaa2f1c5192fabfc6acf77c16bba6b3edba357b2e07ceb6076/files/share/dbus-1/services/org.gnome.Weather.BackgroundService.service

ls -lZd /var/lib/flatpak/app/org.gnome.Weather/x86_64/stable/4e24d0d5d4d5cdeaa2f1c5192fabfc6acf77c16bba6b3edba357b2e07ceb6076/export/share/dbus-1/services/org.gnome.Weather.BackgroundService.service
-rwxr-xr-x. 1 root root system_u:object_r:var_lib_t:s0 206 Apr  7 10:21 /var/lib/flatpak/app/org.gnome.Weather/x86_64/stable/4e24d0d5d4d5cdeaa2f1c5192fabfc6acf77c16bba6b3edba357b2e07ceb6076/export/share/dbus-1/services/org.gnome.Weather.BackgroundService.service

lrwxrwxrwx. 1 root root system_u:object_r:var_lib_t:s0 121 Apr  7 10:21 /var/lib/flatpak/exports/share/dbus-1/services/org.gnome.Weather.BackgroundService.service -> ../../../../app/org.gnome.Weather/current/active/export/share/dbus-1/services/org.gnome.Weather.BackgroundService.service

third command for the 3 files:
ls -lLZd /var/lib/flatpak/app/org.gnome.Weather/x86_64/stable/4e24d0d5d4d5cdeaa2f1c5192fabfc6acf77c16bba6b3edba357b2e07ceb6076/files/share/dbus-1/services/org.gnome.Weather.BackgroundService.service
-rw-r--r--. 2 root root system_u:object_r:var_lib_t:s0 127 Jan  1  1970 /var/lib/flatpak/app/org.gnome.Weather/x86_64/stable/4e24d0d5d4d5cdeaa2f1c5192fabfc6acf77c16bba6b3edba357b2e07ceb6076/files/share/dbus-1/services/org.gnome.Weather.BackgroundService.service

ls -lLZd /var/lib/flatpak/app/org.gnome.Weather/x86_64/stable/4e24d0d5d4d5cdeaa2f1c5192fabfc6acf77c16bba6b3edba357b2e07ceb6076/export/share/dbus-1/services/org.gnome.Weather.BackgroundService.service
-rwxr-xr-x. 1 root root system_u:object_r:var_lib_t:s0 206 Apr  7 10:21 /var/lib/flatpak/app/org.gnome.Weather/x86_64/stable/4e24d0d5d4d5cdeaa2f1c5192fabfc6acf77c16bba6b3edba357b2e07ceb6076/export/share/dbus-1/services/org.gnome.Weather.BackgroundService.service

ls -lLZd /var/lib/flatpak/exports/share/dbus-1/services/org.gnome.Weather.BackgroundService.service
-rwxr-xr-x. 1 root root system_u:object_r:var_lib_t:s0 206 Apr  7 10:21 /var/lib/flatpak/exports/share/dbus-1/services/org.gnome.Weather.BackgroundService.service

Fourth command for the 3 files (rpm):
rpm -qf /var/lib/flatpak/app/org.gnome.Weather/x86_64/stable/4e24d0d5d4d5cdeaa2f1c5192fabfc6acf77c16bba6b3edba357b2e07ceb6076/files/share/dbus-1/services/org.gnome.Weather.BackgroundService.service
file /var/lib/flatpak/app/org.gnome.Weather/x86_64/stable/4e24d0d5d4d5cdeaa2f1c5192fabfc6acf77c16bba6b3edba357b2e07ceb6076/files/share/dbus-1/services/org.gnome.Weather.BackgroundService.service is not owned by any package

rpm -qf /var/lib/flatpak/app/org.gnome.Weather/x86_64/stable/4e24d0d5d4d5cdeaa2f1c5192fabfc6acf77c16bba6b3edba357b2e07ceb6076/export/share/dbus-1/services/org.gnome.Weather.BackgroundService.service
file /var/lib/flatpak/app/org.gnome.Weather/x86_64/stable/4e24d0d5d4d5cdeaa2f1c5192fabfc6acf77c16bba6b3edba357b2e07ceb6076/export/share/dbus-1/services/org.gnome.Weather.BackgroundService.service is not owned by any package

rpm -qf /var/lib/flatpak/exports/share/dbus-1/services/org.gnome.Weather.BackgroundService.service
file /var/lib/flatpak/exports/share/dbus-1/services/org.gnome.Weather.BackgroundService.service is not owned by any package

Hopefully this helps.

Comment 5 Zdenek Pytela 2021-04-13 18:50:48 UTC
Man services report SELinux denials which started with a new version of flatpak. We are discussing the approach towards resolving.

*** This bug has been marked as a duplicate of bug 1916652 ***


Note You need to log in before you can comment on or make changes to this bug.