Bug 1764543
| Summary: | SELinux is preventing restorecon from using the 'mac_admin' capabilities. | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Cocci Satch <coccisatch> | ||||||
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | ||||||
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||
| Severity: | unspecified | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 30 | CC: | dwalsh, lvrabec, mgrepl, plautrba, zpytela | ||||||
| Target Milestone: | --- | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | x86_64 | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | abrt_hash:1dc43931c1cd6f76536841a3456e2c67caea068e9a36125c2b45deebdf1f433a;VARIANT_ID=workstation; | ||||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2019-10-23 09:56:54 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
Created attachment 1628248 [details]
File: CameraZOOM-20191021204545113.jpg
Created attachment 1628249 [details]
File: CameraZOOM-20191021204602496.jpg
*** This bug has been marked as a duplicate of bug 1764541 *** |
Description of problem: Hello, I have this problem since the update of October 21, which caused a panic kernel, so I start on the previous kernel and I have this error. SELinux is preventing restorecon from using the 'mac_admin' capabilities. ***** Plugin catchall (100. confidence) suggests ************************** Si vous pensez que restorecon devrait avoir des capacités mac_admin par défaut. Then vous devriez rapporter ceci en tant qu'anomalie. Vous pouvez générer un module de stratégie local pour autoriser cet accès. Do autoriser cet accès pour le moment en exécutant : # ausearch -c "restorecon" --raw | audit2allow -M my-restorecon # semodule -X 300 -i my-restorecon.pp Additional Information: Source Context unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c102 3 Target Context unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c102 3 Target Objects Inconnu [ capability2 ] Source restorecon Source Path restorecon Port <Inconnu> Host (removed) Source RPM Packages Target RPM Packages Policy RPM <Inconnu> Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 5.2.15-200.fc30.x86_64 #1 SMP Mon Sep 16 15:17:36 UTC 2019 x86_64 x86_64 Alert Count 2 First Seen 2019-10-21 08:30:37 CEST Last Seen 2019-10-21 08:30:37 CEST Local ID 09e386fa-dab8-4765-b3f4-86094efb2941 Raw Audit Messages type=AVC msg=audit(1571639437.786:17982): avc: denied { mac_admin } for pid=1698 comm="restorecon" capability=33 scontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 tclass=capability2 permissive=0 Hash: restorecon,setfiles_t,setfiles_t,capability2,mac_admin Additional info: component: selinux-policy reporter: libreport-2.10.1 hashmarkername: setroubleshoot kernel: 5.2.15-200.fc30.x86_64 type: libreport Potential duplicate: bug 714136