Bug 1115987
| Summary: | SELinux is preventing /usr/sbin/tmpwatch from 'setattr' accesses on the directory . | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Tomas Dolezal <todoleza> | |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | |
| Status: | CLOSED ERRATA | QA Contact: | Dalibor Pospíšil <dapospis> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 7.3 | CC: | dapospis, dwalsh, lvrabec, mmalik, neil.boemio, ssekidde | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | x86_64 | |||
| OS: | Linux | |||
| Whiteboard: | abrt_hash:4b113028e85818a50c06ac45727f5af286cebf528b618db8d4105dec65d51ad2 | |||
| Fixed In Version: | selinux-policy-3.13.1-77.el7 | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1234929 (view as bug list) | Environment: | ||
| Last Closed: | 2016-11-04 02:17:37 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1234929 | |||
Yes, this is questionable but you won't be able to fix labeling in /tmp which is correct. We probably should have a similar policy for tmpreaper_t as we have for systemd_tmpfiles_t. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2283.html |
Description of problem: possible policy change is questionable because the dir in /tmp should not have this context. actually it is backup made by root user which preserves original context. it prevents tmpwatch from working correctly on dir File: ‘/var/tmp/beakerlib-mRdwVgU/backup’ Size: 16 Blocks: 0 IO Block: 4096 directory Device: fd02h/64770d Inode: 103254493 Links: 3 Access: (0755/drwxr-xr-x) Uid: (19436/todoleza) Gid: (19436/todoleza) Context: system_u:object_r:root_t:s0 Access: 2014-07-03 15:02:15.448512353 +0200 Modify: 2014-06-26 17:07:26.455757725 +0200 Change: 2014-07-02 10:23:17.626811067 +0200 Birth: - grep tmpwatch /var/log/audit/audit.log | audit2allow #============= tmpreaper_t ============== allow tmpreaper_t etc_t:dir setattr; allow tmpreaper_t root_t:dir setattr; SELinux is preventing /usr/sbin/tmpwatch from 'setattr' accesses on the directory . ***** Plugin catchall (100. confidence) suggests ************************** If you believe that tmpwatch should be allowed setattr access on the directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep tmpwatch /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 Target Context system_u:object_r:root_t:s0 Target Objects [ dir ] Source tmpwatch Source Path /usr/sbin/tmpwatch Port <Unknown> Host (removed) Source RPM Packages tmpwatch-2.11-5.el7.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-153.el7_0.10.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.10.0-123.4.2.el7.x86_64 #1 SMP Thu Jun 5 21:43:43 EDT 2014 x86_64 x86_64 Alert Count 1 First Seen 2014-07-03 03:47:24 CEST Last Seen 2014-07-03 03:47:24 CEST Local ID b90222d1-ccbd-4d30-b84e-cb5c290c52d2 Raw Audit Messages type=AVC msg=audit(1404352044.377:1267): avc: denied { setattr } for pid=20767 comm="tmpwatch" name="backup" dev="dm-2" ino=103254493 scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=dir type=SYSCALL msg=audit(1404352044.377:1267): arch=x86_64 syscall=utime success=no exit=EACCES a0=4042b7 a1=7fff606c5100 a2=141 a3=7fefb8df77b8 items=0 ppid=20764 pid=20767 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=108 comm=tmpwatch exe=/usr/sbin/tmpwatch subj=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 key=(null) Hash: tmpwatch,tmpreaper_t,root_t,dir,setattr Additional info: reporter: libreport-2.1.11 hashmarkername: setroubleshoot kernel: 3.10.0-123.4.2.el7.x86_64 type: libreport