Bug 1689975
| Summary: | Policy is blocking systemd reading /lib/modules/$KVER/modules.devname breaking /dev/ node creation | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Daniel Berrangé <berrange> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED NEXTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rawhide | CC: | casey.jao, dac.override, dwalsh, jpokorny, lvrabec, mgrepl, plautrba, samuel-rhbugs, yaneti, zpytela |
| Target Milestone: | --- | Keywords: | Regression |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.14.4-8.fc31 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-04-05 17:58:44 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
I suppose might be related to either https://github.com/fedora-selinux/selinux-policy/commit/aa6253cf8dbcff8d0d73a94c95b22a4813481bd8 or https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git/commit/?id=a06bacf500d56b72b5f9b121ebf7f6af9e3df185 The ironic thing is that the labeling is now actually correct. Type module_object_t is for kernel modules only AFAIK. FTR. there seems to be more fall out, e.g. with jmtpfs: # jmtpfs /mnt/card > [...] > fuse: device not found, try 'modprobe fuse' first # rpm -q selinux-policy jmtpfs > selinux-policy-3.14.4-4.fc31.noarch > jmtpfs-0.4-10.fc30.x86_64 (shout out to both libvirt and jmtpfs/fuse library? for these informed suggestions the users would be easily lost without) Thanks for investigation.
Adding patch:
commit b28842ef918897da153800b2df47bb991250c421 (HEAD -> rawhide)
Author: Lukas Vrabec <lvrabec>
Date: Tue Mar 19 09:26:57 2019 +0100
Update file context for modutils rhbz#1689975
- label /lib/modules/<KERNEL_VERSION>/modules.devname as modules_dep_t
instead of modules_object_t
- Allow init_t domain to read modules_dep_t files
Not sure about this but my policy seems to imply that systemd also maps module dependency files. https://github.com/DefenSec/dssp2-standard/blob/master/policy/systemd/s/systemd.cil#L3358 Yes looks like you have traces of that as well: https://github.com/fedora-selinux/selinux-policy/blob/b28842ef918897da153800b2df47bb991250c421/policy/modules/system/init.te#L569 I suspect these two should be removed (provided that module dependency files are labeled properly): files_read_kernel_modules(init_t) files_map_kernel_modules(init_t) And instead i suppose you would need to add: modutils_map_module_deps_files(init_t) |
Description of problem: On a new Fedora 31 install /dev/net/tun does not exist. This is a static device node that systemd creates on startup regardless of whether the kmod is loaded or not. This is done by the kmod-static-nodes.service unit but it is failing to start: # systemctl status kmod-static-nodes.service ● kmod-static-nodes.service - Create list of required static device nodes for the current kernel Loaded: loaded (/usr/lib/systemd/system/kmod-static-nodes.service; static; vendor preset: disabled) Active: inactive (dead) since Mon 2019-03-18 14:26:46 GMT; 1min 11s ago Condition: start condition failed at Mon 2019-03-18 14:27:56 GMT; 1s ago └─ ConditionFileNotEmpty=/lib/modules/5.1.0-0.rc0.git9.1.fc31.x86_64/modules.devname was not met Main PID: 331 (code=exited, status=0/SUCCESS) The file /lib/modules/5.1.0-0.rc0.git9.1.fc31.x86_64/modules.devname does exist with non-zero size. Audit.log reveals that SELinux is blocking this acess type=AVC msg=audit(1552919426.997:335): avc: denied { getattr } for pid=1 comm="systemd" path="/usr/lib/modules/5.1.0-0.rc0.git9.1.fc31.x86_64/modules.devname" dev="dm-0" ino=753068 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:modules_dep_t:s0 tclass=file permissive=1 The file is labelled with modules_dep_t type, which is different from what was used in previous Fedora which was modules_object_t Either the type needs to go back to modules_object_t as in previous Fedora, or the policy needs to grant modules_dep_t read access to systemd via the init_t type. Version-Release number of selected component (if applicable): kernel-5.1.0-0.rc0.git9.1.fc31.x86_64 systemd-241-2.gita09c170.fc31.x86_64 selinux-policy-3.14.4-4.fc31.noarch How reproducible: Always Steps to Reproduce: 1. Install fresh Fedora 31 x86_64 2. 3. Actual results: /dev/net/tun doesn't exist and kmod-static-nodes.service failed to run Expected results: /dev/net/tun exists & kmod-static-nodes.service runs Additional info: