SELinux Won't Allow Starting MIDI System

I am working on a project that I have created without MIDI configured (None selected as MIDI system). Now, I have connected a MIDI keyboard and I want to add MIDI connection, so I go to Window->MIDI Setup and then from MIDI System dropdown I select ALSA (Jack 2, 1.9.8 and later) or ALSA (Jack 1, 0.124 and later) and press Start. After a few moments, I get the message Could not connect to Audio/MIDI engine. At the same time I receive some SELINUX errors as follows:


SELinux is preventing gdb from open access on the chr_file /dev/snd/pcmC1D0p.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that gdb should be allowed open access on the pcmC1D0p chr_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'gdb' --raw | audit2allow -M my-gdb
# semodule -X 300 -i my-gdb.pp

Additional Information:
Source Context                system_u:system_r:abrt_t:s0-s0:c0.c1023
Target Context                system_u:object_r:sound_device_t:s0
Target Objects                /dev/snd/pcmC1D0p [ chr_file ]
Source                        gdb
Source Path                   gdb
Port                          <Unknown>
Host                          codezombie
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-34.21-1.fc34.noarch
Local Policy RPM              selinux-policy-targeted-34.21-1.fc34.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     codezombie
Platform                      Linux codezombie 5.14.9-200.fc34.x86_64 #1 SMP Thu
                              Sep 30 11:55:35 UTC 2021 x86_64 x86_64
Alert Count                   22
First Seen                    2021-10-05 10:46:17 EDT
Last Seen                     2021-10-06 02:14:48 EDT
Local ID                      4f529be1-286d-4ca8-9b69-c6cc26628268

Raw Audit Messages
type=AVC msg=audit(1633500888.873:497): avc:  denied  { open } for  pid=5829 comm="gdb" path="/dev/snd/pcmC1D0p" dev="devtmpfs" ino=496 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sound_device_t:s0 tclass=chr_file permissive=0


Hash: gdb,abrt_t,sound_device_t,chr_file,open

A screenshot is added.
Screenshot

I have tried running “setenforce 0” and tryng again, but SELinux errors keep popping up as though it’s still running, and starting MIDI keeps failing. Selecting the two legacy options ALSA raw devices and ALSA sequencer does not fail, but MIDI connection is not made and is not working.

What is the security context of that file on your system? Here is what I see on mine, owned by root, part of the audio group, and a sound_device_t object.

$ ls -lhZ /dev/snd/pcmC0D0c
crw-rw----+ 1 root audio system_u:object_r:sound_device_t:s0 116, 11 Oct 6 08:45 /dev/snd/pcmC0D0c

Is your user part of the audio group?

It does seem strange that gdb is trying to open the pcm device, perhaps gdb does not have permission to open audio devices.
Presumably you are running jackd if you select that as part of the MIDI setup, which version are you actually running, and what is the command that was used to start jackd?

1 Like

Hi Chris,

Here’s the output of ls -lhZ on the two files:

crw-rw----+ 1 root audio system_u:object_r:sound_device_t:s0 116, 12 Oct 7 08:58 /dev/snd/pcmC1D0p crw-rw----+ 1 root audio system_u:object_r:sound_device_t:s0 116, 13 Oct 7 08:57 /dev/snd/pcmC1D0c
My user is part of the audio group. I can start Jack, but not the MIDI engine from Ardour.

My version of Ardour is 6.9.0, but I have no idea what command is being used to start Jackd when I press “Start”.
However, I just found something. While Ardour’s dialog was open I tried starting Jack using QJackCtl. It started jack without error and then I pressed start on Ardour’s dialog with the drop down for midi selecting ALSA (Jack 2, 1.9.8 and later). Ardour started without problem. Then, I cannot find MIDI connections inside Ardour. This is weird. It used to be accessible from Input menu for each MIDI track, but I don’t find it there, though I can confirm MIDI has started with Ardour.

Search the internet for command: audit2allow it will let you create a allow-rule from selinux error message. You first start the service that is denied by selinux, this will create a selinux error message in the log. Then run allow2audit to create a allow-rule from the selinux error message.

There might be something else wrong with your setup since: “setenforce 0” disables selinux you should not get any selinux errors after that.

I do not think that will be a useful path. Why would running Ardour cause gdb to attempt to access the audio device? Did Ardour crash? I am not aware that an Ardour crash will automatically start gdb, I thought based on the debug instructions that you have to explicitly connect gdb to a running Ardour process or start Ardour with gdb.

In the audit logs I have looked at the application is typically shown with a full path, so it looks a little strange that the source is listed as “gdb” and not “/usr/bin/gdb”.

Do you have any problems if you use a2jmidid instead of the built in ALSA jack MIDI bridge?

Hi @ccaudle. Sorry for late response.
I installed a2jmidid and tried running it. It fails too, with the following output:

[djnotes@mylinux ~]$ sudo a2jmidid
JACK MIDI <-> ALSA sequencer MIDI bridge, version 9 built on Wed Dec 31 19:00:00 1969
Copyright 2006,2007 Dmitry S. Baikov
Copyright 2007,2008,2009,2011,2012 Nedko Arnaudov

Bridge starting...
Using JACK server 'default'
Hardware ports will not be exported.
Cannot connect to server socket err = No such file or directory
Cannot connect to server request channel
jack server is not running or cannot be started
JackShmReadWritePtr::~JackShmReadWritePtr - Init not done for -1, skipping unlock
JackShmReadWritePtr::~JackShmReadWritePtr - Init not done for -1, skipping unlock
ERROR: a2j_jack_client_create: Cannot create jack client
ERROR: a2j_start: a2j_new() failed.

I am really hard time making this work with Ardour 6.

You should not be using sudo to run JACK or JACK clients. Also, if you want hardware MIDI ports/devices to show up, a2jmidid requires the -e flag.

Hi Paul. Running without sudo does not make much difference in this case. Here’s the output for a2jmidi -e:

[djnotes@mylinux ~]$ a2jmidid -e
JACK MIDI <-> ALSA sequencer MIDI bridge, version 9 built on Wed Dec 31 19:00:00 1969
Copyright 2006,2007 Dmitry S. Baikov
Copyright 2007,2008,2009,2011,2012 Nedko Arnaudov

Bridge starting...
Using JACK server 'default'
Hardware ports will be exported.
Cannot connect to server socket err = Connection refused
Cannot connect to server request channel
jack server is not running or cannot be started
JackShmReadWritePtr::~JackShmReadWritePtr - Init not done for -1, skipping unlock
JackShmReadWritePtr::~JackShmReadWritePtr - Init not done for -1, skipping unlock
ERROR: a2j_jack_client_create: Cannot create jack client
ERROR: a2j_start: a2j_new() failed.

Is there a JACK server running (and started by the same user (ie. you)) ?

I started Jack using QJackCtl with the default settings and MIDI driver set to None, as seen in the screenshots (If my user level allows uploading):

Looks like a2jmidid was a big help, as now I can see that displaying my MIDI keyboard input ports in the list of inputs.

Why didn’t I have to install and use a2jmidid in Ardour 5?

Now, I can record from MIDI keyboard and play in Ardour. However, Ardour always, whether opening an existing project or creating a new one, uses the builtin audio interface on my system and not the USB sound card that is connected.

You don’t have to install or use a2jmidid at all, mostly because you don’t have to use JACK, unless you need to route audio/MIDI between applications. If you do use JACK, and you use JACK2, then you will never see ports corresponding to hardware MIDI devices without a2jmidid, and that has been since JACK2 was created.

If you are using JACK, then Ardour will use the audio interface that JACK is using. If you don’t tell JACK to use the USB audio device, then it will not.

If you don’t need JACK, you should almost certainly be using the ALSA backend.

It would be really nice, because I don’t understand much how Linux audio system works.
Does this mean my system does not support Jack2? Every time I start Ardour, not having already started Jack, I see the Audio/MIDI setup dialog, which contains JACK as the only Audio System.

You probably got Ardour from your Linux distribution, and they have split up the backends so that the ALSA one has to be separately installed. We do not support distro builds, but you can fix this by installing the ALSA backend.

Right, I installed it from fedoraproject repository. So, will these issues go away if I install Ardour from Flatpak or AppImage (not sure if it exists)?

Nice! After I installed ardour6-backend-alsa, I see ALSA as one of the Audio Systems in the Audio/MIDI setup dialog. I can select my USB sound card as both input and output device and ALSA sequencer as MIDI system. But, inside Ardour, I am only able to input notes. I don’t see output in the Output settings for the current MIDI track. So, there is no sound.

Your “amsynth” MIDI track has its outputs connected to the master bus, as it should.

After rebooting my system, now both ALSA and JACK‌ are working with Ardour and I can configure output.

In case of ALSA, however, there is significant clicking sound heard while playing or recording. JACK does not have this problem. Isn’t ALSA audio system realtime?

This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.