Bug 1645631

Summary: SELinux is preventing systemd-logind from 'ioctl' accesses on the blk_file /dev/sda.
Product: [Fedora] Fedora Reporter: ep
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 29CC: bill_pachc, clnetbox, devin, dwalsh, lvrabec, mgrepl, plautrba
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:b0c3442939d7d1ba9c115049622f5c5f9bd397bf1e7a1ff5f0693ed95782fb47;VARIANT_ID=workstation;
Fixed In Version: selinux-policy-3.14.2-41.fc29 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1823201 (view as bug list) Environment:
Last Closed: 2018-11-07 02:41:55 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description ep 2018-11-02 17:00:37 UTC
Description of problem:
SELinux is preventing systemd-logind from 'ioctl' accesses on the blk_file /dev/sda.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that systemd-logind should be allowed ioctl access on the sda blk_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'systemd-logind' --raw | audit2allow -M my-systemdlogind
# semodule -X 300 -i my-systemdlogind.pp

Additional Information:
Source Context                system_u:system_r:systemd_logind_t:s0
Target Context                system_u:object_r:fixed_disk_device_t:s0
Target Objects                /dev/sda [ blk_file ]
Source                        systemd-logind
Source Path                   systemd-logind
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.14.2-40.fc29.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.18.16-300.fc29.x86_64 #1 SMP Sat
                              Oct 20 23:24:08 UTC 2018 x86_64 x86_64
Alert Count                   18
First Seen                    2018-11-02 17:59:21 CET
Last Seen                     2018-11-02 17:59:21 CET
Local ID                      c2f0aee3-da97-4e9d-9cef-570e43e9058d

Raw Audit Messages
type=AVC msg=audit(1541177961.531:471): avc:  denied  { ioctl } for  pid=987 comm="systemd-logind" path="/dev/sda" dev="devtmpfs" ino=1119 ioctlcmd=0x1268 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=0


Hash: systemd-logind,systemd_logind_t,fixed_disk_device_t,blk_file,ioctl

Version-Release number of selected component:
selinux-policy-3.14.2-40.fc29.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.9.6
hashmarkername: setroubleshoot
kernel:         4.18.16-300.fc29.x86_64
type:           libreport

Comment 1 Christian Labisch 2018-11-02 18:03:10 UTC
I can confirm this bug, it appears since systemd was upgraded to version 239-6 :
SELinux is preventing systemd-logind from open access on the blk_file /dev/sdb1.
The systemd packages were updated today, after every reboot the warning appears,
and even after applying the suggested policy module the warning message appears.

Comment 2 Lukas Vrabec 2018-11-03 12:07:16 UTC
commit 5a103fd1d605fb1195fbfb02361a723d0f7669aa (HEAD -> rawhide, origin/rawhide)
Author: Lukas Vrabec <lvrabec@redhat.com>
Date:   Sat Nov 3 13:06:47 2018 +0100

    Allow systemd_logind_t to read fixed dist device BZ(1645631)

Comment 3 Fedora Update System 2018-11-04 10:07:43 UTC
selinux-policy-3.14.2-41.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-506e97bb9b

Comment 4 Fedora Update System 2018-11-05 04:20:00 UTC
selinux-policy-3.14.2-41.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-506e97bb9b

Comment 5 Fedora Update System 2018-11-07 02:41:55 UTC
selinux-policy-3.14.2-41.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.