Bug 1342732

Description of problem:
Appears on boot of current Rawhide Workstation live with enforcing=0 . If you attempt to boot without enforcing=0, the system never reaches the desktop. There are 3 other alerts, not sure which is the critical one.

Version-Release number of selected component:
selinux-policy-3.13.1-194.fc25.noarch

Additional info:
reporter:       libreport-2.7.1
hashmarkername: setroubleshoot
kernel:         4.7.0-0.rc2.git1.1.fc25.x86_64
reproducible:   Not sure how to reproduce the problem
type:           libreport

Proposing as an F25 Alpha blocker: "All release-blocking images must boot in their supported configurations. ...  Release-blocking live images must boot to the expected boot menu, and then to a desktop or to a login prompt where it is clear how to log in to a desktop." - Workstation live does not reach a desktop unless you boot with enforcing=0 . This (and/or the other two related denials I listed in 'See Also') are my best bets as to why.

adding Ray for info, as he's the accountsservice maintainer.

Confirming this also appears to be what prevents a fresh Workstation network install from booting; I see the same denial and can boot with enforcing=0 . (The other two accounts-daemon denials don't happen for this case, though).

probably dupe of bug 1331926.  i guess i forgot to do a rawhide build.

Sorry, it's still broken the same way in today's Rawhide nightly, with accountsservice-0.6.42-1.fc25.

Ray, 
What is state of this issue? Do you need any policy changes?

no sure. I tried to reproduce everything worked for me.  adamw mentioned to me on the 15th (on irc) that things were working for him again, too, so I'll just close this WORKSFORME

If a problem remanifests we can reopen.

Description of problem:
Alert appeared in the SELinux Troubleshooter utility after removing directory /root/.cache and rebooting the system.

Version-Release number of selected component:
selinux-policy-3.13.1-197.fc25.noarch

Additional info:
reporter:       libreport-2.7.1
hashmarkername: setroubleshoot
kernel:         4.7.0-0.rc4.git1.2.fc25.x86_64
reproducible:   Not sure how to reproduce the problem
type:           libreport

(In reply to Joachim Frieben from comment #9)
Installed packages include accountsservice-0.6.42-1.fc25.

(In reply to Ray Strode [halfline] from comment #8)
As of accountsservice-0.6.42-1.fc25, directory /root/.cache does get created upon reboot every time it has been removed, and this action does trigger an AVC as reported in /var/log/audit/audit.log but currently -not- by the SELinux Troubleshooter utility.
This behaviour contradicts the changelog of package accountsservice which states:

* Tue May 31 2016 Ray Strode <rstrode redhat com> - 0.6.40-4
- Don't create /root/.cache at startup
  Resolves: #1331926

does your /usr/lib/systemd/system/accounts-daemon.service have:

Environment=GVFS_DISABLE_FUSE=1
Environment=GIO_USE_VFS=local
Environment=GVFS_REMOTE_VOLUME_MONITOR_IGNORE=1

in it?

Both Fedora 24 and Fedora 25 include identical files /usr/lib/systemd/system/accounts-daemon.service with content:

[Unit]
Description=Accounts Service

# In order to avoid races with identity-providing services like SSSD or
# winbind, we need to ensure that Accounts Service starts after
# nss-user-lookup.target
After=nss-user-lookup.target
Wants=nss-user-lookup.target

[Service]
Type=dbus
BusName=org.freedesktop.Accounts
ExecStart=/usr/libexec/accounts-daemon
StandardOutput=syslog
Environment=GVFS_DISABLE_FUSE=1
Environment=GIO_USE_VFS=local
Environment=GVFS_REMOTE_VOLUME_MONITOR_IGNORE=1

[Install]
# We pull this in by graphical.target instead of waiting for the bus
# activation, to speed things up a little: gdm uses this anyway so it is nice
# if it is already around when gdm wants to use it and doesn't have to wait for
# it.
WantedBy=graphical.target

can you run strings /proc/$(pidof accounds-daemon)/environ and post the output ?

(In reply to Ray Strode [halfline] from comment #14)
LANG=en_US.UTF-8
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
GVFS_DISABLE_FUSE=1
GIO_USE_VFS=local
GVFS_REMOTE_VOLUME_MONITOR_IGNORE=1

Discussed at 2016-07-20 blocker review meeting: [1]. 

We decided to remove blocker nomination from this bug. Original bug seems to be already fixed. There is no need to block on this now. If the problem appears again, please repropose.

[1] https://meetbot.fedoraproject.org/fedora-blocker-review/2016-07-20/f25-blocker-review.2016-07-20-16.00.html

(In reply to Petr Schindler from comment #16)
Comment 11 is still valid even though related AVCs are again reported by the graphical SELinux Troubleshooter utility.

SELinux is preventing accounts-daemon from write access on the directory /root.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that accounts-daemon should be allowed write access on the root directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'accounts-daemon' --raw | audit2allow -M my-accountsdaemon
# semodule -X 300 -i my-accountsdaemon.pp

Additional Information:
Source Context                system_u:system_r:accountsd_t:s0
Target Context                system_u:object_r:admin_home_t:s0
Target Objects                /root [ dir ]
Source                        accounts-daemon
Source Path                   accounts-daemon
Port                          <Unknown>
Host                          noname
Source RPM Packages           
Target RPM Packages           filesystem-3.2-37.fc24.x86_64
Policy RPM                    selinux-policy-3.13.1-203.fc25.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     noname
Platform                      Linux noname 4.7.0-0.rc7.git4.2.fc25.x86_64 #1 SMP
                              Tue Jul 19 15:56:43 UTC 2016 x86_64 x86_64
Alert Count                   1
First Seen                    2016-07-21 13:35:52 CEST
Last Seen                     2016-07-21 13:35:52 CEST
Local ID                      a5502fb0-e5b5-4f36-993c-f0d6a463462d

Raw Audit Messages
type=AVC msg=audit(1469100952.512:91): avc:  denied  { write } for  pid=672 comm="accounts-daemon" name="root" dev="dm-0" ino=262146 scontext=system_u:system_r:accountsd_t:s0 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir permissive=0


Hash: accounts-daemon,accountsd_t,admin_home_t,dir,write

This bug appears to have been reported against 'rawhide' during the Fedora 25 development cycle.
Changing version to '25'.

Description of problem:
This popped up on me on first boot after a default Workstation Live install (Fedora-Workstation-Live-x86_64-25-20160815.n.2.iso). I just started terminal and ran dnf, nothing else. Not sure whether this occurred before or after.

Version-Release number of selected component:
selinux-policy-3.13.1-207.fc25.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.8.0-0.rc1.git0.1.fc25.x86_64
type:           libreport

Proposing as a Final blocker:
"There must be no SELinux denial notifications or crash notifications on boot of or during installation from a release-blocking live image, or at first login after a default install of a release-blocking desktop. "
https://fedoraproject.org/wiki/Fedora_25_Final_Release_Criteria#SELinux_and_crash_notifications

Description of problem:
Bug occurred on booting a F25 Workstation livemedia

Version-Release number of selected component:
selinux-policy-3.13.1-207.fc25.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.8.0-0.rc1.git0.1.fc25.x86_64
type:           libreport

Discussed during the 2016-08-22 blocker review meeting: [1]

The decision to classify this bug as an AcceptedBlocker was made as it is a clear violation of "There must be no SELinux denial notifications or crash notifications on boot of or during installation from a release-blocking live image, or at first login after a default install of a release-blocking desktop."

[1] https://meetbot.fedoraproject.org/fedora-blocker-review/2016-08-22/f25-blocker-review.2016-08-22-16.00.txt

Description of problem:
Alert appears after booting from Fedora-Workstation-Live-x86_64-25_Alpha-1.1 media.

Version-Release number of selected component:
selinux-policy-3.13.1-208.fc25.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.8.0-0.rc2.git3.1.fc25.x86_64
type:           libreport

selinux-policy-3.13.1-211.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-cbdde50ec4

Description of problem:
I booted a Fedora 25 Workstation iso compose (2016-08-27) in a virtual machine using virt-manager and got this selinux alert after boot.

Version-Release number of selected component:
selinux-policy-3.13.1-208.fc25.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.8.0-0.rc2.git3.1.fc25.x86_64
type:           libreport

Description of problem:
Just run Fedora from live USB

Version-Release number of selected component:
selinux-policy-3.13.1-208.fc25.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.8.0-0.rc2.git3.1.fc25.x86_64
type:           libreport

selinux-policy-3.13.1-211.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

*** Bug 1380849 has been marked as a duplicate of this bug. ***