Bug 1711682
| Summary: | Allow systemd unit file flag ReadWritePaths=/var/lib/boinc | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Germano Massullo (Thetra) <germano.massullo> | |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | urgent | Docs Contact: | ||
| Priority: | urgent | |||
| Version: | 30 | CC: | dwalsh, germano.massullo, Laurence.Field, lvrabec, mgrepl, mmahut, plautrba, xjakub, zpytela | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | selinux-policy-3.14.3-39.fc30 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1779070 (view as bug list) | Environment: | ||
| Last Closed: | 2019-06-20 02:54:59 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
thanks to grift of #selinux Freenode IRC channel we found out that the problem is originated by ReadWritePaths=/var/lib/boinc boinc-client systemd unit file flag. Can you please allow it in next selinux-policy release? For information completeness, ReadWritePaths=/var/lib/boinc is not yet in BOINC stable, I was testing it during process of testing of the following pull request https://github.com/BOINC/boinc/pull/2873/files So it will be arrive soon in a new BOINC version commit e2b3b2f154fe28e051fcadec2ddec76f36b36a16 (HEAD -> rawhide, origin/rawhide, origin/HEAD)
Author: Lukas Vrabec <lvrabec>
Date: Mon May 20 18:01:23 2019 +0200
Make boinc_var_lib_t mountpoint BZ(1711682)
Will be part of next selinux-policy update.
Thank you very much Lukas. Have a nice day FEDORA-2019-3f20be4d52 has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-3f20be4d52 selinux-policy-3.14.3-38.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-3f20be4d52 FEDORA-2019-9da5c35472 has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-9da5c35472 selinux-policy-3.14.3-39.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-9da5c35472 selinux-policy-3.14.3-39.fc30 has been pushed to the Fedora 30 stable repository. If problems still persist, please make note of it in this bug report. |
Updating from Fedora 29 to 30 leads to SELinux being updated from 3.14.2-57.fc29 to 3.14.3-35.fc30. This new versions unables BOINC client from starting as client. =============== # systemctl status boinc-client ● boinc-client.service - Berkeley Open Infrastructure Network Computing Client Loaded: loaded (/etc/systemd/system/boinc-client.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Sun 2019-05-19 17:14:28 CEST; 18min ago Docs: man:boinc(1) Process: 3459 ExecStart=/usr/bin/boinc (code=exited, status=226/NAMESPACE) Process: 3460 ExecStopPost=/bin/rm -f lockfile (code=exited, status=226/NAMESPACE) Main PID: 3459 (code=exited, status=226/NAMESPACE) mag 19 17:14:28 office-machine systemd[1]: Started Berkeley Open Infrastructure Network Computing Client. mag 19 17:14:28 office-machine systemd[3459]: boinc-client.service: Failed to set up mount namespacing: Permission denied mag 19 17:14:28 office-machine systemd[3459]: boinc-client.service: Failed at step NAMESPACE spawning /usr/bin/boinc: Permission denied mag 19 17:14:28 office-machine systemd[1]: boinc-client.service: Main process exited, code=exited, status=226/NAMESPACE mag 19 17:14:28 office-machine systemd[3460]: boinc-client.service: Failed to set up mount namespacing: Permission denied mag 19 17:14:28 office-machine systemd[3460]: boinc-client.service: Failed at step NAMESPACE spawning /bin/rm: Permission denied mag 19 17:14:28 office-machine systemd[1]: boinc-client.service: Control process exited, code=exited, status=226/NAMESPACE mag 19 17:14:28 office-machine systemd[1]: boinc-client.service: Failed with result 'exit-code'. =============== and it causes SELinux to trigger the following alerts =============== # ausearch -m avc -ts recent ---- time->Sun May 19 17:12:10 2019 type=AVC msg=audit(1558278730.833:253): avc: denied { mounton } for pid=1992 comm="(boinc)" path="/run/systemd/unit-root/var/lib/boinc" dev="dm-2" ino=5505250 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:boinc_var_lib_t:s0 tclass=dir permissive=0 ---- time->Sun May 19 17:12:10 2019 type=AVC msg=audit(1558278730.845:254): avc: denied { mounton } for pid=1993 comm="(rm)" path="/run/systemd/unit-root/var/lib/boinc" dev="dm-2" ino=5505250 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:boinc_var_lib_t:s0 tclass=dir permissive=0 ---- time->Sun May 19 17:13:38 2019 type=AVC msg=audit(1558278818.286:335): avc: denied { mounton } for pid=3341 comm="(boinc)" path="/run/systemd/unit-root/var/lib/boinc" dev="dm-2" ino=5505250 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:boinc_var_lib_t:s0 tclass=dir permissive=1 ---- time->Sun May 19 17:13:38 2019 type=AVC msg=audit(1558278818.513:336): avc: denied { read } for pid=3359 comm="lsmod" name="modules.softdep" dev="dm-2" ino=9307896 scontext=system_u:system_r:boinc_t:s0 tcontext=system_u:object_r:modules_dep_t:s0 tclass=file permissive=1 ---- time->Sun May 19 17:13:38 2019 type=AVC msg=audit(1558278818.513:337): avc: denied { open } for pid=3359 comm="lsmod" path="/usr/lib/modules/5.0.16-300.fc30.x86_64/modules.softdep" dev="dm-2" ino=9307896 scontext=system_u:system_r:boinc_t:s0 tcontext=system_u:object_r:modules_dep_t:s0 tclass=file permissive=1 ---- time->Sun May 19 17:13:38 2019 type=AVC msg=audit(1558278818.584:338): avc: denied { unlink } for pid=3341 comm="boinc" name="output.tgz" dev="dm-2" ino=5505836 scontext=system_u:system_r:boinc_t:s0 tcontext=system_u:object_r:boinc_project_var_lib_t:s0 tclass=lnk_file permissive=1 ---- time->Sun May 19 17:13:38 2019 type=AVC msg=audit(1558278818.588:339): avc: denied { getattr } for pid=3341 comm="boinc" path="/var/lib/boinc/slots/206/cernvm/shared/tmp/tmp.gb65xnkdnx/generator.hepmc" dev="dm-2" ino=5507008 scontext=system_u:system_r:boinc_t:s0 tcontext=system_u:object_r:boinc_project_var_lib_t:s0 tclass=fifo_file permissive=1 ---- time->Sun May 19 17:13:38 2019 type=AVC msg=audit(1558278818.588:340): avc: denied { unlink } for pid=3341 comm="boinc" name="generator.hepmc" dev="dm-2" ino=5507008 scontext=system_u:system_r:boinc_t:s0 tcontext=system_u:object_r:boinc_project_var_lib_t:s0 tclass=fifo_file permissive=1 ---- time->Sun May 19 17:14:21 2019 type=AVC msg=audit(1558278861.954:341): avc: denied { mounton } for pid=3452 comm="(boinccmd)" path="/run/systemd/unit-root/var/lib/boinc" dev="dm-2" ino=5505250 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:boinc_var_lib_t:s0 tclass=dir permissive=1 ---- time->Sun May 19 17:14:28 2019 type=AVC msg=audit(1558278868.565:347): avc: denied { mounton } for pid=3459 comm="(boinc)" path="/run/systemd/unit-root/var/lib/boinc" dev="dm-2" ino=5505250 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:boinc_var_lib_t:s0 tclass=dir permissive=0 ---- time->Sun May 19 17:14:28 2019 type=AVC msg=audit(1558278868.574:348): avc: denied { mounton } for pid=3460 comm="(rm)" path="/run/systemd/unit-root/var/lib/boinc" dev="dm-2" ino=5505250 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:boinc_var_lib_t:s0 tclass=dir permissive=0 ===============