Bug 1644039
| Summary: | SELinux is preventing sss_cache from using the 'signal' accesses on a process. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Nicolas Mailhot <nicolas.mailhot> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rawhide | CC: | dwalsh, lslebodn, lvrabec, mgrepl, plautrba |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:cbc966582ee0532bfd3284c1edc34256ca794183f11c61cd832f26fec5203e56;VARIANT_ID=workstation; | ||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-11-13 08:29:06 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 1640255 *** |
Description of problem: SELinux is preventing sss_cache from using the 'signal' accesses on a process. ***** Plugin catchall (100. confidence) suggests ************************** Si vous pensez que sss_cache devrait être autorisé à accéder signal sur les processus étiquetés sssd_t par défaut. Then vous devriez rapporter ceci en tant qu'anomalie. Vous pouvez générer un module de stratégie local pour autoriser cet accès. Do autoriser cet accès pour le moment en exécutant : # ausearch -c "sss_cache" --raw | audit2allow -M my-ssscache # semodule -X 300 -i my-ssscache.pp Additional Information: Source Context unconfined_u:unconfined_r:groupadd_t:s0-s0:c0.c102 3 Target Context system_u:system_r:sssd_t:s0 Target Objects Unknown [ process ] Source sss_cache Source Path sss_cache Port <Inconnu> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.14.3-10.fc30.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 4.19.0-1.fc30.x86_64 #1 SMP Mon Oct 22 14:04:41 UTC 2018 x86_64 x86_64 Alert Count 3 First Seen 2018-10-15 22:24:54 CEST Last Seen 2018-10-29 20:33:45 CET Local ID 0bfe3698-f5a0-4e8c-8d0b-02ad17f2c645 Raw Audit Messages type=AVC msg=audit(1540841625.794:560): avc: denied { signal } for pid=19476 comm="sss_cache" scontext=unconfined_u:unconfined_r:groupadd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sssd_t:s0 tclass=process permissive=1 Hash: sss_cache,groupadd_t,sssd_t,process,signal Version-Release number of selected component: selinux-policy-3.14.3-10.fc30.noarch Additional info: component: selinux-policy reporter: libreport-2.9.6 hashmarkername: setroubleshoot kernel: 4.19.0-1.fc30.x86_64 type: libreport