Bug 1515373

Thanks for reporting this. I fixed all AVC and fixes should be part of next selinux-policy build. Please let me know if is issue fixed. 

Lukas.

selinux-policy-3.13.1-283.17.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2017-d05b1a2ab9

selinux-policy-3.13.1-283.17.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-d05b1a2ab9

I updated selinux-policy and selinux-policy-targeted

selinux-policy-3.13.1-283.17.fc27.noarch
selinux-policy-targeted-3.13.1-283.17.fc27.noarch

Problem persists, but with a different message:

audit: type=1400 audit(1511447203.561:370): avc:  denied  { create } for  pid=2128 comm="mount" name="utab.lock" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:mount_var_run:t:s0 tclass=file permissive=0

tried forcing relabeling with touch /.autorelabel and also tried refreshing the initrd with dracut -f but didn't solve the issue.

selinux-policy-3.13.1-283.17.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.

Hi.

I'm still having the issue reported in comment #4.

I managed to connect another computer to the serial console and these are the last messages in the console.



[  OK  ] Reached target Shutdown.
[  762.838064] watchdog: watchdog0: watchdog did not stop!
[  764.099462] systemd-shutdown[1]: Sending SIGTERM to remaining processes...
[  764.129057] systemd-journald[674]: Received SIGTERM from PID 1 (systemd-shutdow).
[  764.214757] systemd-shutdown[1]: Sending SIGKILL to remaining processes...
[  764.219996] systemd-shutdown[1]: Hardware watchdog 'iTCO_wdt', version 0
[  764.221030] systemd-shutdown[1]: Unmounting file systems.
[  764.221102] systemd-shutdown[1]: Failed to parse /proc/self/mountinfo:1.
[  764.221110] systemd-shutdown[1]: Failed to parse /proc/self/mountinfo:2.
[  764.221118] systemd-shutdown[1]: Failed to parse /proc/self/mountinfo:3.
[  764.221125] systemd-shutdown[1]: Failed to parse /proc/self/mountinfo:4.
[  764.221132] systemd-shutdown[1]: Failed to parse /proc/self/mountinfo:5.
[  764.221139] systemd-shutdown[1]: Failed to parse /proc/self/mountinfo:6.
[  764.261509] systemd-shutdow: 29 output lines suppressed due to ratelimiting
<30>systemd-shutdown[1]: Successfully changed into root pivot.
<30>systemd-shutdown[1]: Returning to initrd...
[  764.264838] watchdog: watchdog0: watchdog did not stop!
[  764.295468] audit: type=1400 audit(1513013998.645:498): avc:  denied  { create } for  pid=5112 comm="mount" name="utab.lock" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:mount




The computer then stays like that for 10 minutes and then reboots.
I figured that the 10 minutes wait is from the ShutdownWatchdogSec=10min option in /etc/systemd/system.conf because I changed that option to 1min, systemctl daemon-reload and reboot. Now the computer is only stuck 1 minute

I have the same issue with 

selinux-policy-3.13.1-283.17.fc27.noarch
selinux-policy-targeted-3.13.1-283.17.fc27.noarch

Temporary disabling selinux allows me to reboot:

setenforce 0; reboot

I posted the same bug for Fedora 24 more than a year ago  https://bugzilla.redhat.com/show_bug.cgi?id=1379044

I proposed a solution with a small selinux module, but nobody has incorporated this module to selinux-policy before Fedora 24 EOL.


This solution is still working in Fedora 27: after compiling and installing this module I can easy reboot or shutdown:

----------------------------------------------------------------------
module my-mdadm 1.0;

require {
	type mdadm_var_run_t;
	type init_t;
	type mdadm_t;
	type tmpfs_t;
	type user_tmp_t;
	class unix_stream_socket connectto;
	class sock_file { relabelto write };
	class file { create getattr rename write };
}

#============= init_t ==============

#!!!! This avc is allowed in the current policy
allow init_t mdadm_t:unix_stream_socket connectto;

#!!!! This avc is allowed in the current policy
allow init_t mdadm_var_run_t:file { create rename write };

#!!!! This avc is allowed in the current policy
allow init_t mdadm_var_run_t:sock_file { relabelto write };

#============= mdadm_t ==============

#!!!! The file '/dev/shm/lldpad.state' is mislabeled on your system.  
#!!!! Fix with $ restorecon -R -v /dev/shm/lldpad.state
allow mdadm_t tmpfs_t:file getattr;
----------------------------------------------------------------------

Some more information: my mdadm process is launched from dracut instead of systemd so it has init_t context instead of mdadm_t. Maybe it is wrong...

Oleg, 

Could you attach output of: 

# ls -Z 

Thanks,
Lukas.

Hello,

After upgrading to versions:

selinux-policy-3.13.1-283.26.fc27.noarch
selinux-policy-targeted-3.13.1-283.26.fc27.noarch

I no longer have this issue.