Bug 1419980
| Summary: | SELinux is preventing abrt-dump-journ from 'execute' accesses on the file /usr/bin/lz4. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Michael Catanzaro <mcatanzaro+wrong-account-do-not-cc> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 26 | CC: | awilliam, dominick.grift, dwalsh, fzatlouk, gmarr, lvrabec, mgrepl, plautrba, pmoore, ssekidde, stickster |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:e9c843bfab72ba9984288171eeea9ba3a6f2ac2446440556633dcab070d282b1;VARIANT_ID=workstation; AcceptedFreezeException | ||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-03-24 17:04:39 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1349185, 1405995 | ||
|
Description
Michael Catanzaro
2017-02-07 14:45:51 UTC
(In reply to Michael Catanzaro from comment #0) > # systemctl stop abrt-ccpp.service > # systemctl start abrt-journal-core.service > (Start some app to be killed, say gedit) > # killall gedit Whooops, I meant to type 'killall -SEGV gedit' Description of problem: Warning raised when I killed gnome-calculator with -SEGV Version-Release number of selected component: selinux-policy-3.13.1-225.6.fc25.noarch Additional info: reporter: libreport-2.8.0 hashmarkername: setroubleshoot kernel: 4.9.7-201.fc25.x86_64 type: libreport Hi Lukas, will an update be available for this soon? (In reply to Michael Catanzaro from comment #3) > Hi Lukas, will an update be available for this soon? Hi Lukas, the change deadline for bug #1405995 was today and it is still blocked on this issue. The FESCo change review meeting is on Friday; it would be great to have an update released prior to then. Note that we identified a solution to this issue via private email on February 8: # cat abrt_exec_bin.cil (allow abrt_dump_oops_t bin_t (file (execute))) (allow abrt_dump_oops_t bin_t (file (execute_no_trans))) # semodule -i abrt_exec_bin.cil Proposed as a Freeze Exception for 26-alpha by Fedora user pfrields using the blocker tracking app because: This is a simple change to enable an accepted F26 Change. See also https://bugzilla.redhat.com/show_bug.cgi?id=1405995 which this bug blocks. Having this Change is important to the Workstation WG and we'd really like not to slip this for yet another release. I've reached out to the selinux-policy maintainers to ask for quick action here. [root@fraw ~]# sesearch -A -s abrt_dump_oops_t -t bin_t -c file -p execute
Found 2 semantic av rules:
allow abrt_dump_oops_t base_ro_file_type : file { ioctl read getattr lock execute execute_no_trans open } ;
allow abrt_dump_oops_t bin_t : file { ioctl read getattr lock execute execute_no_trans open } ;
[root@fraw ~]# rpm -q selinux-policy
selinux-policy-3.13.1-241.fc26.noarch
#============= abrt_dump_oops_t ==============
#!!!! This avc is allowed in the current policy
allow abrt_dump_oops_t bin_t:file execute;
This issue is already fixed in F26:
https://koji.fedoraproject.org/koji/buildinfo?buildID=860624
Discussed during the 2017-03-06 blocker review meeting: [1] The decision was made to accept this bug as an Alpha Freeze Exception as this prevents a significant accepted Change from working in the Workstation live environment. [1] https://meetbot.fedoraproject.org/fedora-blocker-review/2017-03-06/f26-blocker-review.2017-03-06-17.02.txt Current stable selinux-policy is much ahead of the one claimed to fix this, so closing. |