Bug 1451376

Summary: SELinux is preventing abrtd from using the 'dac_read_search' capabilities.
Product: [Fedora] Fedora Reporter: Delete My Account <c.crispino8611>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 27CC: dominick.grift, dwalsh, ivan.makfinsky, lvrabec, mgrepl, mikhail.v.gavrilov, plautrba, pmoore, rxguyrx, ssekidde, vondruch
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:65b5f4ddf2fae1fb5118b327b5195f852e648902b155bd55054d808a6a2ed04e;
Fixed In Version: selinux-policy-3.13.1-283.14.fc27 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-10-31 15:35:22 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Delete My Account 2017-05-16 14:21:56 UTC
Description of problem:
SELinux is preventing abrtd from using the 'dac_read_search' capabilities.

*****  Plugin dac_override (91.4 confidence) suggests   **********************

If si vuole aiutare ad identificare se al dominio serva questo accesso o se si possiede un file con i permessi sbagliati sul sistema
Then attivare l'auditing completo per ottenere le informazioni del percorso del file incriminato e generare nuovamente l'errore.

Attivare il controllo completo auditing
# auditctl -w /etc/shadow -p w
Provare a ricreare AVC. Eseguire quindi
# ausearch -m avc -ts recent
Qualora si noti il record PATH, controllare la proprietà/i permessi sul file e correggerli,
altrimenti registrare un bugzilla.

*****  Plugin catchall (9.59 confidence) suggests   **************************

If si pensa che abrtd dovrebbe avere funzionalità dac_read_search in modo predefinito.
Then si dovrebbe riportare il problema come bug.
E' possibile generare un modulo di politica locale per consentire questo accesso.
allow this access for now by executing:
# ausearch -c 'abrtd' --raw | audit2allow -M my-abrtd
# semodule -X 300 -i my-abrtd.pp

Additional Information:
Source Context                system_u:system_r:abrt_t:s0-s0:c0.c1023
Target Context                system_u:system_r:abrt_t:s0-s0:c0.c1023
Target Objects                Unknown [ capability ]
Source                        abrtd
Source Path                   abrtd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-253.fc27.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.12.0-0.rc0.git9.1.fc27.x86_64 #1
                              SMP Sat May 13 13:39:12 UTC 2017 x86_64 x86_64
Alert Count                   3725
First Seen                    2017-05-07 08:23:35 CEST
Last Seen                     2017-05-16 16:21:18 CEST
Local ID                      8f76a84e-d053-45a4-885d-02b984230b5b

Raw Audit Messages
type=AVC msg=audit(1494944478.477:530): avc:  denied  { dac_read_search } for  pid=2129 comm="abrt-server" capability=2  scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tclass=capability permissive=0

Hash: abrtd,abrt_t,abrt_t,capability,dac_read_search

Version-Release number of selected component:

Additional info:
component:      selinux-policy
reporter:       libreport-2.9.1
hashmarkername: setroubleshoot
kernel:         4.12.0-0.rc0.git9.1.fc27.x86_64
type:           libreport

Comment 1 Vít Ondruch 2017-07-03 08:36:19 UTC
Interesting ... I have selinux-policy-3.13.1-261.fc27.noarch installed and got this error ...

Comment 2 Jan Kurik 2017-08-15 08:45:23 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 27 development cycle.
Changing version to '27'.

Comment 3 Fedora Update System 2017-10-25 10:12:37 UTC
selinux-policy-3.13.1-283.13.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2017-b5e9ce60d2

Comment 4 Fedora Update System 2017-10-27 18:45:29 UTC
selinux-policy-3.13.1-283.14.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-b5e9ce60d2

Comment 5 Fedora Update System 2017-10-31 15:35:22 UTC
selinux-policy-3.13.1-283.14.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.