Bug 1290400

Mirek,
Thank you for patches. Back ported.

Ok, the backports do not seem to be enough, or we regressed again with selinux-policy-3.13.1-93.el7. I still cannot login in MLS in single user mode. What I see is:

Welcome to emergency mode! After logging in, type "journalctl -xb" to view
system logs, "systemctl reboot" to reboot, "systemctl default" or ^D to
boot into default mode.

But no login prompt is presented ...

After booting in permissive and check the denied AVCs in journal I see:

Aug 26 00:12:23 localhost.localdomain kernel: type=1400 audit(1472163143.782:309): avc:  granted  { setfscreate } for  pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0-s15:c0.c1023 tcontext=system_u:system_r:init_t:s0-s15:c0.c1023 tclass=process
Aug 26 00:12:23 localhost.localdomain kernel: type=1400 audit(1472163143.782:310): avc:  denied  { read } for  pid=1 comm="systemd" name="audit" dev="dm-6" ino=67 scontext=system_u:system_r:init_t:s0-s15:c0.c1023 tcontext=system_u:object_r:initrc_var_log_t:s0 tclass=dir
--
Aug 26 00:12:31 localhost.localdomain kernel: type=1300 audit(1472163151.133:314): arch=c000003e syscall=1 success=yes exit=39 a0=3 a1=7e09f0 a2=27 a3=7ffcf70c14c0 items=0 ppid=602 pid=603 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cp" exe="/usr/bin/cp" subj=system_u:system_r:initrc_t:s0-s15:c0.c1023 key=(null)
Aug 26 00:12:31 localhost.localdomain kernel: type=1400 audit(1472163151.133:315): avc:  denied  { relabelfrom } for  pid=603 comm="cp" name="/" dev="dm-4" ino=64 scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tcontext=system_u:object_r:var_t:s0 tclass=dir
Aug 26 00:12:31 localhost.localdomain kernel: type=1400 audit(1472163151.133:315): avc:  denied  { relabelto } for  pid=603 comm="cp" name="/" dev="dm-4" ino=64 scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s15:c0.c1023 tclass=dir
--
Aug 26 00:12:31 localhost.localdomain kernel: type=1300 audit(1472163151.133:315): arch=c000003e syscall=189 success=yes exit=0 a0=7e08f0 a1=7f4b3ac93f4a a2=7e0a60 a3=27 items=0 ppid=602 pid=603 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cp" exe="/usr/bin/cp" subj=system_u:system_r:initrc_t:s0-s15:c0.c1023 key=(null)
Aug 26 00:12:31 localhost.localdomain kernel: type=1400 audit(1472163151.134:316): avc:  denied  { relabelfrom } for  pid=603 comm="cp" name="lib" dev="dm-4" ino=2097219 scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir
--
Aug 26 00:13:22 localhost.localdomain kernel: type=1300 audit(1472163202.322:479): arch=c000003e syscall=1 success=yes exit=39 a0=3 a1=1679dd0 a2=27 a3=30633a3531732d30 items=0 ppid=632 pid=635 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=4294967295 comm="sulogin" exe="/usr/sbin/sulogin" subj=system_u:system_r:sulogin_t:s15:c0.c1023 key=(null)
Aug 26 00:13:22 localhost.localdomain kernel: type=1400 audit(1472163202.323:480): avc:  denied  { transition } for  pid=635 comm="sulogin" path="/usr/bin/bash" dev="dm-0" ino=16851170 scontext=system_u:system_r:sulogin_t:s15:c0.c1023 tcontext=root:sysadm_r:sysadm_t:s0-s15:c0.c1023 tclass=process
Aug 26 00:13:22 localhost.localdomain kernel: type=1400 audit(1472163202.323:480): avc:  denied  { use } for  pid=635 comm="bash" path="/dev/ttyS0" dev="devtmpfs" ino=6508 scontext=root:sysadm_r:sysadm_t:s0-s15:c0.c1023 tcontext=system_u:system_r:sulogin_t:s15:c0.c1023 tclass=fd
Aug 26 00:13:22 localhost.localdomain kernel: type=1300 audit(1472163202.323:480): arch=c000003e syscall=59 success=yes exit=0 a0=1676066 a1=7ffc69d172e0 a2=1679ae0 a3=7ffc69d190d0 items=0 ppid=632 pid=635 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=4294967295 comm="bash" exe="/usr/bin/bash" subj=root:sysadm_r:sysadm_t:s0-s15:c0.c1023 key=(null)
Aug 26 00:13:22 localhost.localdomain kernel: type=1400 audit(1472163202.329:481): avc:  denied  { use } for  pid=635 comm="bash" path="/dev/ttyS0" dev="devtmpfs" ino=6508 scontext=root:sysadm_r:sysadm_t:s0-s15:c0.c1023 tcontext=system_u:system_r:sulogin_t:s15:c0.c1023 tclass=fd
Aug 26 00:13:22 localhost.localdomain kernel: type=1300 audit(1472163202.329:481): arch=c000003e syscall=16 success=yes exit=0 a0=ff a1=540f a2=7ffe336c2ea0 a3=7ffe336c2c40 items=0 ppid=632 pid=635 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=4294967295 comm="bash" exe="/usr/bin/bash" subj=root:sysadm_r:sysadm_t:s0-s15:c0.c1023 key=(null)
Aug 26 00:14:03 localhost.localdomain kernel: type=1400 audit(1472163243.839:482): avc:  denied  { use } for  pid=651 comm="rpm" path="/dev/ttyS0" dev="devtmpfs" ino=6508 scontext=root:system_r:rpm_t:s0-s15:c0.c1023 tcontext=system_u:system_r:sulogin_t:s15:c0.c1023 tclass=fd
Aug 26 00:14:03 localhost.localdomain kernel: type=1300 audit(1472163243.839:482): arch=c000003e syscall=59 success=yes exit=0 a0=16fc290 a1=170dea0 a2=1709e10 a3=7ffe336c2ad0 items=0 ppid=635 pid=651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=4294967295 comm="rpm" exe="/usr/bin/rpm" subj=root:system_r:rpm_t:s0-s15:c0.c1023 key=(null)
Aug 26 00:17

Moving to rc compose, we do not fix this for beta ...

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2283.html