Bug 1769673
| Summary: | SELinux is preventing systemd from 'ioctl' accesses on the file /usr/lib/systemd/system/nxserver.service. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Richard L. England <rlengland> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | 31 | CC: | aannoaanno, dwalsh, edward.911, lvrabec, mgrepl, plautrba, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:066932cb5b8154c213c9fbf01830d1cc51d8362c0b3b7abe96bd4fc37c210e61;VARIANT_ID=matecompiz; | ||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-01-30 12:36:09 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Hi Richard, The nx_unit_file_t type does not seem to be in selinux-policy in Fedora. Do you know how it happened to be on your system? Was it for instance a custom policy module as a part of the package containing the service? nx_unit_file_t appears to be related to NoMachine ( https://www.nomachine.com/ ) so it appears it is on them to correct this and I should care for it locally. Richard, Given this information, I'd suggest to contact the vendors to add support for the requested operation. It should declare in the SELinux policy module the nx_unit_file_t type be part of systemd_unit_file_type attribute, possibly some additional rules. I am closing the bugzilla as NOTABUG. Feel free to reopen it or create a new one in case of outstanding issue. *** Bug 2014733 has been marked as a duplicate of this bug. *** |
Description of problem: Not certain what the cause was. Did an software update via dragora and the error occured SELinux is preventing systemd from 'ioctl' accesses on the file /usr/lib/systemd/system/nxserver.service. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that systemd should be allowed ioctl access on the nxserver.service file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'systemd' --raw | audit2allow -M my-systemd # semodule -X 300 -i my-systemd.pp Additional Information: Source Context system_u:system_r:init_t:s0 Target Context system_u:object_r:nx_unit_file_t:s0 Target Objects /usr/lib/systemd/system/nxserver.service [ file ] Source systemd Source Path systemd Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM <Unknown> Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 5.3.7-301.fc31.x86_64 #1 SMP Mon Oct 21 19:18:58 UTC 2019 x86_64 x86_64 Alert Count 35 First Seen 2019-10-29 21:42:56 PDT Last Seen 2019-11-06 23:14:03 PST Local ID 1b52958f-022a-4156-94a9-8f881f2697be Raw Audit Messages type=AVC msg=audit(1573110843.80:328): avc: denied { ioctl } for pid=1 comm="systemd" path="/usr/lib/systemd/system/nxserver.service" dev="dm-0" ino=3933744 ioctlcmd=0x5401 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:nx_unit_file_t:s0 tclass=file permissive=0 Hash: systemd,init_t,nx_unit_file_t,file,ioctl Additional info: component: selinux-policy reporter: libreport-2.10.1 hashmarkername: setroubleshoot kernel: 5.3.7-301.fc31.x86_64 type: libreport