0

I've installed acpid and setup an event for lid close which works in debug mode, however I cannot get it to work when acpid is started by systemd.

I used the suggestions here to configure acpid Linux suspend or sleep on lid close

cat /etc/acpi/events/lid

event=button[ /]lid
action=/etc/acpi/actions/lid_down.sh %

cat /etc/acpi/actions/lid_down.sh

#!/bin/bash

[ "$1" = "button/lid" ] && [ "$2" = "LID" ] && [ "$3" = "close" ] && xscreensaver-command -lock

running acpid -d -l works, but systemctl start acpid produces the following error when I close the lid

# ausearch -m avc -ts recent -i
----
type=AVC msg=audit(19/07/18 04:14:19.214:452) : avc:  denied  { connectto } for  pid=16632 comm=xscreensaver-co path=/tmp/.X11-unix/X0 scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=0 

What selinux policy do I require to allow xscreensaver-command access to my display socket when launched from acpid ?

================================================

So, I edited my script and I can get it to work as follows:

cat /etc/acpi/actions/lid_down.sh

#!/bin/bash

[ "$1" = "button/lid" ] && [ "$2" = "LID" ] && [ "$3" = "close" ] && /usr/local/bin/xscreensaver-lock-all

cat /usr/local/bin/xscreensaver-lock-all

#!/bin/bash

logger "screen saver lock script started"
for user in $(ps -ef | awk '($0~/xscreensaver/&&$0!~/awk/){print $1}')
do
    su $user -c "/usr/bin/xscreensaver-command -lock"
done

I did try inserting various runcon options into lid_down.sh, but to no avail. So my current workaround is:

# semanage permissive -a apmd_t

But that produces the following errors:

# ausearch -m avc -ts recent -i
----
type=AVC msg=audit(19/07/18 10:24:19.266:287) : avc:  denied  { bind } for  pid=3372 comm=su scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:apmd_t:s0 tclass=netlink_selinux_socket permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:19.266:286) : avc:  denied  { create } for  pid=3372 comm=su scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:apmd_t:s0 tclass=netlink_selinux_socket permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:19.267:288) : avc:  denied  { compute_av } for  pid=3372 comm=su scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=security permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:19.268:292) : avc:  denied  { setgid } for  pid=3372 comm=su capability=setgid  scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:apmd_t:s0 tclass=capability permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:19.271:294) : avc:  denied  { setsched } for  pid=3372 comm=su scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:apmd_t:s0 tclass=process permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:19.284:298) : avc:  denied  { read write } for  pid=3372 comm=su name=lastlog dev="dm-0" ino=659972 scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:object_r:lastlog_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:19.285:299) : avc:  denied  { open } for  pid=3372 comm=su path=/var/log/lastlog dev="dm-0" ino=659972 scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:object_r:lastlog_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:19.342:301) : avc:  denied  { connectto } for  pid=3373 comm=xscreensaver-co path=/tmp/.X11-unix/X0 scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:19.343:302) : avc:  denied  { read } for  pid=3373 comm=xscreensaver-co name=.Xauthority dev="dm-4" ino=15466502 scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:object_r:xauth_home_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:19.343:303) : avc:  denied  { open } for  pid=3373 comm=xscreensaver-co path=/home/ken/.Xauthority dev="dm-4" ino=15466502 scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:object_r:xauth_home_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:19.538:315) : avc:  denied  { read write } for  pid=3374 comm=su name=lastlog dev="dm-0" ino=659972 scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:object_r:lastlog_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:19.538:316) : avc:  denied  { open } for  pid=3374 comm=su path=/var/log/lastlog dev="dm-0" ino=659972 scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:object_r:lastlog_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:19.539:318) : avc:  denied  { setgid } for  pid=3382 comm=su capability=setgid  scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:apmd_t:s0 tclass=capability permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:19.543:319) : avc:  denied  { connectto } for  pid=3382 comm=xscreensaver-co path=/tmp/.X11-unix/X0 scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:22.153:336) : avc:  denied  { read write } for  pid=3386 comm=su name=lastlog dev="dm-0" ino=659972 scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:object_r:lastlog_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:22.153:337) : avc:  denied  { open } for  pid=3386 comm=su path=/var/log/lastlog dev="dm-0" ino=659972 scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:object_r:lastlog_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:22.153:339) : avc:  denied  { setgid } for  pid=3395 comm=su capability=setgid  scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:apmd_t:s0 tclass=capability permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:22.157:340) : avc:  denied  { connectto } for  pid=3395 comm=xscreensaver-co path=/tmp/.X11-unix/X0 scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:21.901:322) : avc:  denied  { create } for  pid=3386 comm=su scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:apmd_t:s0 tclass=netlink_selinux_socket permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:21.901:323) : avc:  denied  { bind } for  pid=3386 comm=su scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:apmd_t:s0 tclass=netlink_selinux_socket permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:21.901:324) : avc:  denied  { compute_av } for  pid=3386 comm=su scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=security permissive=1 
----
type=AVC msg=audit(19/07/18 10:24:21.905:329) : avc:  denied  { setsched } for  pid=3386 comm=su scontext=system_u:system_r:apmd_t:s0 tcontext=system_u:system_r:apmd_t:s0 tclass=process permissive=1 

There must be a neater way to do this without disabling selinux for acpi

0

If you're looking for a "neater" way, making a service start graphical programs is right out. It's poor design, not only because of SELinux.

Change the command to /usr/bin/loginctl lock-sessions. This broadcasts a "lock" signal to all graphical sessions, and each session can react to it internally (e.g. start a locker without any SELinux troubles). Chances are that LXDE might already support it.

If LXDE does not react to the lock signal, run a helper which does:

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.