Bug 1370872
Summary: | SELinux is preventing NetworkManager from 'unlink' accesses on the file /etc/resolv.conf. | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Melvin Jones <melvinj> |
Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | medium | Docs Contact: | |
Priority: | high | ||
Version: | 24 | CC: | dominick.grift, dwalsh, lvrabec, melvinj, mgrepl, plautrba |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | x86_64 | ||
OS: | Unspecified | ||
Whiteboard: | abrt_hash:77261c568d4cfcbf07123b7b7e390e3dff8311e7b19383353fadd043dc635488;VARIANT_ID=workstation; | ||
Fixed In Version: | selinux-policy-3.13.1-191.20.fc24 | Doc Type: | If docs needed, set a value |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2016-11-10 03:29:49 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Melvin Jones
2016-08-27 17:04:05 UTC
Network Manager manages the /etc/resolv.conf file, so it renames content over the file. The weird thing is that ShrewSoft VPN Client on Fedora 24 is mislabeling the file when it creates it. Most likely it is creating a temporary file in /etc and then renaming it over /etc/resolv.conf. If you could figure out the file name that the tool is creating, then we might be able to setup a file trans fule for this creation. Or if you could modify the code to run a restorecon after it creates the file, or you could try to use restorecond to watch for new file creations and then fix the label. Dan is right. Could you provide info? Thanks for the follow up. I looked into it and this is what is happening. When I am not connected using ShrewSoft the /etc/resolv.conf file is a symlink that points to /var/run/NetworkManager/resolv.conf, which has the proper type of net_conf_t. Whenever I connect with Shrewsoft, it removes the symlink and adds it's own version of /etc/resolv.conf with has a type of etc_t. I am not sure what happens at this point, but it appears NetworkManager tries to remove the file so it can recreate the symlink or something? Like I said before, it still works fine besides the alert that comes up. Melvin, Could you connect using ShrewSoft and then attach output of: # ps -efZ | grep ShrewSoft Thanks. [melvin@MyComputer ~]$ ps -efZ | grep ike system_u:system_r:unconfined_service_t:s0 root 19988 1 0 08:37 ? 00:00:00 /usr/sbin/iked -f /etc/iked.conf unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 melvin 21044 1 0 10:21 pts/1 00:00:00 /usr/bin/qikea unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 melvin 21048 21044 1 10:21 pts/1 00:00:00 qikec -r MySite iked is the daemon that runs in the background, qikea is the GUI which holds all of the connections and qikec runs whenever you actually create a connection and put in your username/password. https://github.com/fedora-selinux/selinux-policy/pull/152 Might fix the problem. selinux-policy-3.13.1-191.20.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-7ce27629b3 selinux-policy-3.13.1-191.20.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-7ce27629b3 selinux-policy-3.13.1-191.20.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report. |