Bug 1652808

Summary:	user service file has wrong selinux context
Product:	[Fedora] Fedora	Reporter:	Robin Powell <rlpowell>
Component:	syncthing	Assignee:	Fabio Valentini <decathorpe>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	29	CC:	decathorpe
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-11-23 11:39:15 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Robin Powell 2018-11-23 06:27:52 UTC

The syncthing package provides this file:

$  ls -lZ /usr/lib/systemd/user/syncthing.service
-rw-r--r--. 1 root root system_u:object_r:lib_t:s0 285 Nov  6 00:18 /usr/lib/systemd/user/syncthing.service

The obvious thing to do with this file is something like:

$ cd ~/.config/systemd/user/
$ ln -s /usr/lib/systemd/user/syncthing.service

But that won't work properly with selinux because the context is wrong; that file's type should be systemd_unit_file_t , not lib_t

Comment 1 Robin Powell 2018-11-23 06:58:16 UTC

Turns out you don't need to symlink things in that directory, you can just use them directly, but the problem still stands:

Nov 22 22:56:52 vrici systemd[958]: selinux: avc:  denied  { start } for auid=n/a uid=1000 gid=1000 path="/usr/lib/systemd/user/syncthing.service" cmdline="" scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=service permissive=1
Nov 22 22:56:52 vrici systemd[958]: selinux: avc:  denied  { status } for auid=n/a uid=1000 gid=1000 path="/usr/lib/systemd/user/syncthing.service" cmdline="" scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=service permissive=1
Nov 22 22:57:00 vrici systemd[958]: selinux: avc:  denied  { stop } for auid=n/a uid=1000 gid=1000 path="/usr/lib/systemd/user/syncthing.service" cmdline="" scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=service permissive=1

Comment 2 Robin Powell 2018-11-23 07:01:54 UTC

Having said all of that, though, it looks like *all* the files in that dir have the wrong context, which makes it a problem for the selinux policy ; see https://bugzilla.redhat.com/show_bug.cgi?id=1652814

Comment 3 Fabio Valentini 2018-11-23 11:39:15 UTC

Curious. I am using syncthing in this setup (user service, SELinux enforcing) for years, and I haven't had any avc denials happen.

But I can confirm that the selinux context for those files is the same here, and that this is an issue with the selinux policy. As you already opened a bug there, I'll close this report for syncthing as I can't do anything about this.

*** This bug has been marked as a duplicate of bug 1652814 ***

Comment 4 Robin Powell 2018-11-24 01:48:19 UTC

I expect that it's working for you because you have the "unconfined" module enabled; I have it turned off, cuz I'm crazy.  :D

Comment 5 Fabio Valentini 2018-11-24 13:24:34 UTC

Ah, I see. I didn't even know that was possible. TIL, I guess. :)