| Summary: | SELinux is preventing tuned from 'write' accesses on the directory /sys/fs/selinux. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Heiko Adams <bugzilla> |
| Component: | tuned | Assignee: | Jaroslav Škarvada <jskarvad> |
| Status: | CLOSED EOL | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 20 | CC: | bugzilla, dominick.grift, dwalsh, jkaluza, jskarvad, jv+fedora, lvrabec, mgrepl, rvokal, twoerner |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:f48e87d90fbaed2559dc18b81e69da58301049e271a4b98ee2c745d770e08204 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-06-30 00:42:48 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
What is tuned trying to do with SELInux? Description of problem: Just booted my system and logged into my Xfce session Additional info: reporter: libreport-2.1.7 hashmarkername: setroubleshoot kernel: 3.11.2-301.fc20.x86_64 type: libreport (In reply to Daniel Walsh from comment #1) > What is tuned trying to do with SELInux? AFAIK nothing, there is no support code for it. Maybe it is caused by some third party plugin or script? Heiko, what's the profile name you were using (cat /etc/tuned/active_profile)? Is it standard profile from the tuned package or your customized profile? Also please provide output of: # rpm -qV tuned I'm using the standard profile $ rpm -qV tuned S.5....T. c /etc/tuned/active_profile Is it the balanced profile? # cat /etc/tuned/active_profile $ cat /etc/tuned/active_profile balanced Hmm, I have currently no idea what caused this. I am unable to reproduce it on my machines, xfce with lightdm (also tried gdm) and: selinux-policy-3.12.1-90 tuned-2.2.2-2 Could you attach your /var/log/tuned/tuned.log? And also please provide output of the following command: # ls /etc/tuned curiously I can't reproduce this anymore. Seems to be fixed with one of the last policy updates. $ cat /var/log/tuned/tuned.log 2013-10-21 10:37:22,049 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 10:37:32,365 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 10:37:42,367 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 10:41:22,391 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 10:42:22,398 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 10:42:42,401 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 10:51:22,763 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 10:51:32,765 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 10:51:42,847 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 10:52:02,850 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 11:01:33,720 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 11:02:03,790 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 11:02:23,913 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 11:02:33,915 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 11:02:43,917 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 11:03:03,919 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 11:08:44,583 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 11:08:54,585 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 11:10:14,593 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 11:10:24,594 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 11:13:04,611 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 11:13:24,668 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 11:13:34,669 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 11:15:04,710 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 11:25:56,111 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 11:26:46,255 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 11:30:46,727 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 11:32:16,746 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 11:34:57,053 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 11:35:07,055 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 11:35:17,057 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 11:35:27,058 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 11:59:51,599 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 12:01:41,836 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 12:01:51,838 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 12:02:01,840 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 12:02:51,845 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 12:03:01,846 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 12:04:01,853 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 12:04:21,855 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 12:04:31,857 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 12:04:41,858 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 12:27:54,270 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 12:29:54,283 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 12:30:04,284 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 12:30:54,570 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 12:37:35,804 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 12:38:26,112 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 13:06:18,380 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 13:06:28,499 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 13:06:38,500 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 13:07:18,505 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 13:08:08,510 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 13:08:18,512 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 2013-10-21 13:12:38,768 INFO tuned.plugins.plugin_cpu: setting new cpu latency 1000 2013-10-21 13:12:58,826 INFO tuned.plugins.plugin_cpu: setting new cpu latency 100 $ ls /etc/tuned active_profile This message is a reminder that Fedora 20 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 20. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '20'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 20 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. Fedora 20 changed to end-of-life (EOL) status on 2015-06-23. Fedora 20 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed. |
Description of problem: SELinux is preventing tuned from 'write' accesses on the directory /sys/fs/selinux. ***** Plugin restorecon (90.5 confidence) suggests ************************ If sie die Kennzeichnung korrigieren möchten. /sys/fs/selinux Standard-Kennzeichnung sollte sysfs_t sein. Then sie können restorecon ausführen. Do # /sbin/restorecon -v /sys/fs/selinux ***** Plugin setenforce (9.50 confidence) suggests ************************ If sie glauben, dass tuned versuchte, SELinux zu deaktivieren. Then sie werden eventuell durch einen Hacker angegriffen, da eingeschränkte Anwendungen diesen Zugriff nicht benötigen sollten. Do setzen Sie sich mit Ihrem Sicherheitsadministrator in Verbindung und melden Sie dieses Problem. ***** Plugin catchall (1.40 confidence) suggests ************************** If sie denken, dass es tuned standardmässig erlaubt sein sollte, write Zugriff auf selinux directory zu erhalten. Then sie sollten dies als Fehler melden. Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen. Do zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen: # grep tuned /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:tuned_t:s0 Target Context system_u:object_r:security_t:s0 Target Objects /sys/fs/selinux [ dir ] Source tuned Source Path tuned Port <Unbekannt> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.12.1-83.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.11.1-300.fc20.x86_64 #1 SMP Sat Sep 14 15:01:23 UTC 2013 x86_64 x86_64 Alert Count 1 First Seen 2013-09-28 12:07:32 CEST Last Seen 2013-09-28 12:07:32 CEST Local ID 8565f21b-42ea-4414-8fb2-cfa4af5eb600 Raw Audit Messages type=AVC msg=audit(1380362852.435:320): avc: denied { write } for pid=568 comm="tuned" name="/" dev="selinuxfs" ino=1 scontext=system_u:system_r:tuned_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=dir Hash: tuned,tuned_t,security_t,dir,write Additional info: reporter: libreport-2.1.7 hashmarkername: setroubleshoot kernel: 3.11.1-300.fc20.x86_64 type: libreport