Bug 1630675
| Summary: | SELinux is preventing dovecot from 'getattr' accesses on the file /proc/sys/fs/suid_dumpable. | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Niki Guldbrand <niki.guldbrand> | |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 29 | CC: | dan, dwalsh, gnikandrov+fedora, lvrabec, mgrepl, nphilipp, plautrba, ppywlkiqletw | |
| Target Milestone: | --- | Keywords: | Reopened | |
| Target Release: | --- | |||
| Hardware: | x86_64 | |||
| OS: | Unspecified | |||
| Whiteboard: | abrt_hash:088a1bf98c8a3c8a5057caef8efb63f5d006f428337de08e9e89616588462c0b;VARIANT_ID=workstation; | |||
| Fixed In Version: | selinux-policy-3.14.2-42.fc29 selinux-policy-3.14.2-46.fc29 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1648698 (view as bug list) | Environment: | ||
| Last Closed: | 2019-01-17 02:16:22 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
Description of problem: After upgrade from f28 to f29 this problem started occurring. Version-Release number of selected component: selinux-policy-3.14.2-36.fc29.noarch Additional info: reporter: libreport-2.9.6 hashmarkername: setroubleshoot kernel: 4.18.14-200.fc28.x86_64 type: libreport Description of problem: This was noticed after upgrading to FC29. Version-Release number of selected component: selinux-policy-3.14.2-40.fc29.noarch Additional info: reporter: libreport-2.9.6 hashmarkername: setroubleshoot kernel: 4.18.16-300.fc29.x86_64 type: libreport commit bb32a71dcac5c8f6e022151cc3e32b3b994fa136 (HEAD -> rawhide)
Author: Lukas Vrabec <lvrabec>
Date: Sun Nov 4 13:27:51 2018 +0100
Improve fs_manage_ecryptfs_files to allow caller domain also mmap ecryptfs_t files BZ(1630675)
selinux-policy-3.14.2-42.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-3129f981d3 After updating to selinux-policy-3.14.2-42.fc29.noarch the situation is unchanged. That is, the bug is not solved. selinux-policy-3.14.2-42.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-3129f981d3 Notfixed by selinux-policy-3.14.2-42.fc29. selinux-policy-3.14.2-42.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report. As the issue is not solved, can we get this re-opened? Description of problem: Start Dovecot. Version-Release number of selected component: selinux-policy-3.14.2-42.fc29.noarch Additional info: reporter: libreport-2.9.6 hashmarkername: setroubleshoot kernel: 4.18.16-300.fc29.x86_64 type: libreport Not fixed by selinux-policy-3.14.2-42.fc29.noarch I see the same issue on one of my systems. Reopening. Meanwhile https://bugzilla.redhat.com/show_bug.cgi?id=1648698 was created as a clone of this one. commit 68211b2358b7a60c67f076187f7b05864c19028d
Author: Lukas Vrabec <lvrabec>
Date: Wed Dec 12 16:58:40 2018 +0100
Allow dovecot_t domain to read proc_security_t BZ(1648698)
selinux-policy-3.14.2-46.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2019-6a20cfef61 selinux-policy-3.14.2-46.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-6a20cfef61 selinux-policy-3.14.2-46.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: This har started to show up after my upgrade from F28 to F29, haven't changed any settings in dovecot SELinux is preventing dovecot from 'getattr' accesses on the file /proc/sys/fs/suid_dumpable. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that dovecot should be allowed getattr access on the suid_dumpable file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'dovecot' --raw | audit2allow -M my-dovecot # semodule -X 300 -i my-dovecot.pp Additional Information: Source Context system_u:system_r:dovecot_t:s0 Target Context system_u:object_r:proc_security_t:s0 Target Objects /proc/sys/fs/suid_dumpable [ file ] Source dovecot Source Path dovecot Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.14.2-34.fc29.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.18.5-300.fc29.x86_64 #1 SMP Fri Aug 24 17:16:35 UTC 2018 x86_64 x86_64 Alert Count 2 First Seen 2018-09-19 06:13:11 CEST Last Seen 2018-09-19 06:19:26 CEST Local ID 382e040d-0ad7-43b5-b13f-3d582163c0f8 Raw Audit Messages type=AVC msg=audit(1537330766.95:1520): avc: denied { getattr } for pid=12649 comm="dovecot" path="/proc/sys/fs/suid_dumpable" dev="proc" ino=11080399 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:proc_security_t:s0 tclass=file permissive=0 Hash: dovecot,dovecot_t,proc_security_t,file,getattr Version-Release number of selected component: selinux-policy-3.14.2-34.fc29.noarch Additional info: component: selinux-policy reporter: libreport-2.9.5 hashmarkername: setroubleshoot kernel: 4.18.5-300.fc29.x86_64 type: libreport