Bug 1481670

Summary:	SELinux is preventing arping from 'write' accesses on the fifo_file /var/tmp/dracut.tP3e5r/systemd-cat.
Product:	[Fedora] Fedora	Reporter:	Frank Büttner <bugzilla>
Component:	selinux-policy	Assignee:	Lukas Vrabec <lvrabec>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	26	CC:	dominick.grift, dwalsh, lsm5, lvrabec, mgrepl, mvollmer, plautrba, pmoore, pvolpe, ssekidde, stefw
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Unspecified
Whiteboard:	abrt_hash:bd564c6531bf90e3240eaa16ab2821f1c67e649b1527f4f473185a678bee3dfb;VARIANT_ID=workstation;
Fixed In Version:	selinux-policy-3.13.1-260.14.fc26	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-11-15 20:11:54 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Frank Büttner 2017-08-15 12:13:15 UTC

Description of problem:
Boot the system.
SELinux is preventing arping from 'write' accesses on the fifo_file /var/tmp/dracut.tP3e5r/systemd-cat.

*****  Plugin catchall (100. confidence) suggests   **************************

If sie denken, dass es arping standardmäßig erlaubt sein sollte, write Zugriff auf systemd-cat fifo_file zu erhalten.
Then sie sollten dies als Fehler melden.
Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen.
Do
allow this access for now by executing:
# ausearch -c 'arping' --raw | audit2allow -M my-arping
# semodule -X 300 -i my-arping.pp

Additional Information:
Source Context                system_u:system_r:netutils_t:s0
Target Context                system_u:object_r:kdumpctl_tmp_t:s0
Target Objects                /var/tmp/dracut.tP3e5r/systemd-cat [ fifo_file ]
Source                        arping
Source Path                   arping
Port                          <Unbekannt>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-260.3.fc26.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.12.5-300.fc26.x86_64 #1 SMP Mon
                              Aug 7 15:27:25 UTC 2017 x86_64 x86_64
Alert Count                   1
First Seen                    2017-08-15 14:12:07 CEST
Last Seen                     2017-08-15 14:12:07 CEST
Local ID                      27f7032b-96fc-4645-9bce-e91c6957887b

Raw Audit Messages
type=AVC msg=audit(1502799127.665:217): avc:  denied  { write } for  pid=6506 comm="arping" path="/var/tmp/dracut.tP3e5r/systemd-cat" dev="dm-1" ino=5508073 scontext=system_u:system_r:netutils_t:s0 tcontext=system_u:object_r:kdumpctl_tmp_t:s0 tclass=fifo_file permissive=0


Hash: arping,netutils_t,kdumpctl_tmp_t,fifo_file,write

Version-Release number of selected component:
selinux-policy-3.13.1-260.3.fc26.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.9.1
hashmarkername: setroubleshoot
kernel:         4.12.5-300.fc26.x86_64
type:           libreport

Comment 1 Peter 2017-08-16 01:51:53 UTC

Running into this in cockpit tests as well.

Comment 2 Peter 2017-08-16 03:19:41 UTC

Also seeing this on fedora-25, i386 arches.

selinux-policy-targeted-3.13.1-225.19.fc25.noarch
selinux-policy-3.13.1-225.19.fc25.noarch

Comment 3 Stef Walter 2017-08-22 05:15:51 UTC

This is being tracked by the Cockpit Integration tests here: https://github.com/cockpit-project/cockpit/issues/7509

Comment 4 Frank Büttner 2017-09-16 13:31:06 UTC

Description of problem:
Log in after booting.

Version-Release number of selected component:
selinux-policy-3.13.1-260.8.fc26.noarch

Additional info:
reporter:       libreport-2.9.1
hashmarkername: setroubleshoot
kernel:         4.12.12-300.fc26.x86_64
type:           libreport

Comment 5 Fedora Update System 2017-10-26 12:32:28 UTC

selinux-policy-3.13.1-260.14.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-d312739a4e

Comment 6 Fedora Update System 2017-11-15 20:11:54 UTC

selinux-policy-3.13.1-260.14.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.

Comment 7 Marius Vollmer 2017-11-30 12:28:36 UTC

This doesn't happen anymore in the Cockpit integration tests.