Bug 1277779
| Summary: | SELinux is preventing /usr/bin/bash from 'getattr' accesses on the file /usr/sbin/dmsetup. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Kazuo Moriwaka <kmoriwak> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | 22 | CC: | dominick.grift, dwalsh, lvrabec, mgrepl, plautrba |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:68c1251196d623635be421f4eaecbc63442dc365f24b264da186fb2e0be62ff2;VARIANT_ID=workstation; | ||
| Fixed In Version: | selinux-policy-3.13.1-128.22.fc22 selinux-policy-3.13.1-128.28.fc22 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-05-10 17:57:51 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
commit 32c66a72dbe29e1f6840f793f6313112dc0efbaa
Author: Lukas Vrabec <lvrabec>
Date: Fri Nov 20 16:32:00 2015 +0100
Allow pcp_pmcd_t domain transition to lvm_t. BZ(1277779)
selinux-policy-3.13.1-128.22.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-8083abc683 selinux-policy-3.13.1-128.22.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with $ su -c 'dnf --enablerepo=updates-testing update selinux-policy' You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-8083abc683 selinux-policy-3.13.1-128.25.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2016-825869e1a4 selinux-policy-3.13.1-128.25.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-825869e1a4 selinux-policy-3.13.1-128.27.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2016-ce419c9cab selinux-policy-3.13.1-128.27.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-ce419c9cab selinux-policy-3.13.1-128.28.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2016-ce419c9cab selinux-policy-3.13.1-128.28.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-ce419c9cab selinux-policy-3.13.1-128.28.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: reproduce: 1. install pcp-pmda-dm-3.10.7-1.fc22.x86_64 2. cd /var/lib/pcp/pmdas/dm ; ./Install 3. systemctl start pmcd.service Related info: $(pcp)/src/pmdas/dm/dmthin.c calls "dmsetup status " with popen. Thank you, SELinux is preventing /usr/bin/bash from 'getattr' accesses on the file /usr/sbin/dmsetup. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that bash should be allowed getattr access on the dmsetup file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep sh /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:pcp_pmcd_t:s0 Target Context system_u:object_r:lvm_exec_t:s0 Target Objects /usr/sbin/dmsetup [ file ] Source sh Source Path /usr/bin/bash Port <Unknown> Host (removed) Source RPM Packages bash-4.3.42-1.fc22.x86_64 Target RPM Packages device-mapper-1.02.93-3.fc22.x86_64 Policy RPM selinux-policy-3.13.1-128.18.fc22.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.2.3-200.fc22.x86_64 #1 SMP Thu Oct 8 03:23:55 UTC 2015 x86_64 x86_64 Alert Count 297 First Seen 2015-09-28 09:37:14 JST Last Seen 2015-11-04 12:25:03 JST Local ID 8e2ccc64-800f-4115-a4d3-07357432b0e3 Raw Audit Messages type=AVC msg=audit(1446607503.360:2718): avc: denied { getattr } for pid=18008 comm="sh" path="/usr/sbin/dmsetup" dev="dm-1" ino=82494 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file permissive=0 type=SYSCALL msg=audit(1446607503.360:2718): arch=x86_64 syscall=stat success=no exit=EACCES a0=564c3866fb80 a1=7ffd20e6e2c0 a2=7ffd20e6e2c0 a3=0 items=0 ppid=1197 pid=18008 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=sh exe=/usr/bin/bash subj=system_u:system_r:pcp_pmcd_t:s0 key=(null) Hash: sh,pcp_pmcd_t,lvm_exec_t,file,getattr Version-Release number of selected component: selinux-policy-3.13.1-128.18.fc22.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.3-200.fc22.x86_64 type: libreport