Bug 1480929

Summary:	SELinux is preventing journalctl from 'map' accesses on the file /var/log/journal/e0215049b3ad4b45be988a3894bb0931/system@000555eff2a070fa-00d74fe76412519e.journal~.
Product:	[Fedora] Fedora	Reporter:	Joachim Frieben <jfrieben>
Component:	selinux-policy	Assignee:	Lukas Vrabec <lvrabec>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	urgent	Docs Contact:
Priority:	unspecified
Version:	27	CC:	awilliam, dominick.grift, dwalsh, lsm5, lvrabec, mgrepl, plautrba, pmoore, ritt.georg, robatino, ssekidde
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Unspecified
Whiteboard:	abrt_hash:968386865a28322b76aa2677394862f9a7215efd46d7b5b5da08719f7d7c0577;VARIANT_ID=workstation;
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-21 17:15:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1396702, 1481454

Description Joachim Frieben 2017-08-12 23:15:43 UTC

Description of problem:
SELinux is preventing journalctl from 'map' accesses on the file /var/log/journal/e0215049b3ad4b45be988a3894bb0931/system~.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that journalctl should be allowed map access on the system~ file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'journalctl' --raw | audit2allow -M my-journalctl
# semodule -X 300 -i my-journalctl.pp

Additional Information:
Source Context                system_u:system_r:abrt_t:s0-s0:c0.c1023
Target Context                system_u:object_r:var_log_t:s0
Target Objects                /var/log/journal/e0215049b3ad4b45be988a3894bb0931/
                              system~
                              [ file ]
Source                        journalctl
Source Path                   journalctl
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-270.fc27.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 4.13.0-0.rc4.git4.1.fc27.x86_64 #1
                              SMP Fri Aug 11 15:03:46 UTC 2017 x86_64 x86_64
Alert Count                   2
First Seen                    2017-08-13 00:54:45 CEST
Last Seen                     2017-08-13 00:54:46 CEST
Local ID                      14df9d1b-ddc1-4c80-a934-7b2fe63ccfc0

Raw Audit Messages
type=AVC msg=audit(1502578486.319:473): avc:  denied  { map } for  pid=3064 comm="journalctl" path="/var/log/journal/e0215049b3ad4b45be988a3894bb0931/system~" dev="dm-0" ino=271739 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_log_t:s0 tclass=file permissive=1


Hash: journalctl,abrt_t,var_log_t,file,map

Version-Release number of selected component:
selinux-policy-3.13.1-270.fc27.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.9.1
hashmarkername: setroubleshoot
kernel:         4.13.0-0.rc4.git4.1.fc27.x86_64
type:           libreport

Comment 1 Adam Williamson 2017-08-14 23:42:16 UTC

Note we may get quite a lot of dupes of this, as everyone's journal files will be named differently. I see the same denial for my journal file. It seems to prevent the journald service from starting correctly, which is obviously a big problem (and a Beta blocker, per 'Alpha' criterion "A system logging infrastructure must be available, enabled by default, and working.")

Comment 2 Jan Kurik 2017-08-15 08:52:39 UTC

This bug appears to have been reported against 'rawhide' during the Fedora 27 development cycle.
Changing version to '27'.

Comment 3 Adam Williamson 2017-08-21 17:15:37 UTC

I believe 3.13.1-272 resolved this: I have that version installed, and my system is booted in enforcing mode, and the journal works. So, closing this as fixed.