Bug 1209183
| Summary: | SELinux is preventing dnf-automatic from using the 'transition' accesses on a process. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | joshua |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 21 | CC: | dominick.grift, dwalsh, j, lvrabec, mgrepl, plautrba |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:e0c846e61acc5bc30c8e5fd6c5efb7344ab6b97e2086669357e3d69ab16b746f | ||
| Fixed In Version: | selinux-policy-3.13.1-105.20.fc21 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-08-15 02:11:03 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Lukas,
I added to rawhide
commit 9eedb27cd19e756a74be02153f5178a90caece91
Author: Miroslav Grepl <mgrepl>
Date: Mon May 11 14:26:41 2015 +0200
Add rpm_exec_t labeling for /usr/bin/dnf-automatic,/usr/bin/dnf-2 and /usr/bin/dnf-3.
to see how it works.
joshua, you can test it using # chcon -t rpm_exec_t /usr/bin/dnf-automatic That seems to work... thank you Just a note in case anyone else runs into this. The problem is fixed as of selinux-policy-3.13.1-128 (in F22; no fix for F21 that I can see). However, I found that I still ran into this problem. The problem was that /usr/bin/dnf* were mislabeled. The installer will only install files using the policy which was in place when the install images were created. Even if your install set includes the updates repository (as mine does) your files will still be mislabeled unless you force a relabel, run restorecon over everything or fix things up in %post using setfiles. commit e95ea8d4f637117cf3da58a70f034d3ade5c4630
Author: Miroslav Grepl <mgrepl>
Date: Mon May 11 14:26:41 2015 +0200
Add rpm_exec_t labeling for /usr/bin/dnf-automatic,/usr/bin/dnf-2 and /usr/bin/dnf-3.
selinux-policy-3.13.1-105.20.fc21 has been submitted as an update for Fedora 21. https://admin.fedoraproject.org/updates/selinux-policy-3.13.1-105.20.fc21 Package selinux-policy-3.13.1-105.20.fc21: * should fix your issue, * was pushed to the Fedora 21 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.13.1-105.20.fc21' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2015-12049/selinux-policy-3.13.1-105.20.fc21 then log in and leave karma (feedback). selinux-policy-3.13.1-105.20.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: running dnf-automatic via cron.daily SELinux is preventing dnf-automatic from using the 'transition' accesses on a process. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that dnf-automatic should be allowed transition access on processes labeled rpm_script_t by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep dnf-automatic /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 Target Context system_u:system_r:rpm_script_t:s0-s0:c0.c1023 Target Objects /usr/bin/bash [ process ] Source dnf-automatic Source Path dnf-automatic Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages bash-4.3.33-1.fc21.x86_64 Policy RPM selinux-policy-3.13.1-105.9.fc21.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.19.3-200.fc21.x86_64 #1 SMP Thu Mar 26 21:39:42 UTC 2015 x86_64 x86_64 Alert Count 17 First Seen 2015-04-06 03:23:38 EDT Last Seen 2015-04-06 03:23:44 EDT Local ID 8cebbcd8-aa87-4751-94eb-6d1712ac4774 Raw Audit Messages type=AVC msg=audit(1428305024.311:1327): avc: denied { transition } for pid=30252 comm="dnf-automatic" path="/usr/bin/bash" dev="dm-0" ino=33176 scontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_script_t:s0-s0:c0.c1023 tclass=process permissive=0 Hash: dnf-automatic,system_cronjob_t,rpm_script_t,process,transition Version-Release number of selected component: selinux-policy-3.13.1-105.9.fc21.noarch Additional info: reporter: libreport-2.3.0 hashmarkername: setroubleshoot kernel: 3.19.3-200.fc21.x86_64 type: libreport