Bug 1777157
| Summary: | SELinux is preventing systemd from using the 'setsched' accesses on a process. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Mikhail <mikhail.v.gavrilov> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | rawhide | CC: | dimapunk80, dwalsh, lvrabec, mgrepl, plautrba, systemd-maint, vondruch, zbyszek, zpytela |
| Target Milestone: | --- | Keywords: | Reopened |
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:ae490f733b3277f3defa1b3ac25fe01a89a54dd8152437cb373d91d482ac4e65;VARIANT_ID=workstation; | ||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-12-21 16:19:45 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Fedora 29 changed to end-of-life (EOL) status on 2019-11-26. Fedora 29 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed. That's not 29. That's rawhide! This started to happen with systemd-244. Not sure what is the reason, but it pops up all the time. Actually, this might be related to my usage of mock. This is snippet from my journal:
~~~
Dec 12 12:15:53 localhost.localdomain systemd-machined[934]: New machine 901b223a48c34486b739882360c7c5e4.
Dec 12 12:15:53 localhost.localdomain audit[1]: AVC avc: denied { setsched } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=process permissive=0
Dec 12 12:15:53 localhost.localdomain systemd[1]: Started Container 901b223a48c34486b739882360c7c5e4.
Dec 12 12:15:56 localhost.localdomain setroubleshoot[1574953]: SELinux brání systemd využívat setsched přístup k procesu. Pro úplné zprávy SELinuxu spusťte: sealert -l 94fbd50b-3629-44a6-bb97-6ba54295da60
Dec 12 12:15:56 localhost.localdomain python3[1574953]: SELinux brání systemd využívat setsched přístup k procesu.
***** Plugin catchall (100. důvěry) naznačuje*********************************
Pokud jste přesvědčeni, že má systemd mít ve výchozím stavu přístup setsched na procesy se značkou syslogd_t.
Pak měli byste tento problém nahlásit jako chybu.
Abyste přístup povolili, můžete vygenerovat lokální modul pravidel.
Udělejte
prozatím tento přístup povolíte příkazy:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp
~~~
and this is the `sealert` output:
~~~
$ LC_ALL=C.UTF-8 sealert -l 94fbd50b-3629-44a6-bb97-6ba54295da60
SELinux is preventing systemd from using the setsched access on a process.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that systemd should be allowed setsched access on processes labeled syslogd_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp
Additional Information:
Source Context system_u:system_r:init_t:s0
Target Context system_u:system_r:syslogd_t:s0
Target Objects Neznámé [ process ]
Source systemd
Source Path systemd
Port <Unknown>
Host localhost.localdomain
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.14.5-18.fc32.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name localhost.localdomain
Platform Linux localhost.localdomain 5.4.0-2.fc32.x86_64 #1
SMP Mon Nov 25 22:45:19 UTC 2019 x86_64 x86_64
Alert Count 105044
First Seen 2019-12-04 14:06:45 CET
Last Seen 2019-12-12 12:15:53 CET
Local ID 94fbd50b-3629-44a6-bb97-6ba54295da60
Raw Audit Messages
type=AVC msg=audit(1576149353.684:159698): avc: denied { setsched } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=process permissive=0
Hash: systemd,init_t,syslogd_t,process,setsched
~~~
Can anybody from systemd guys take look into this? This is very annoying behavior :( Here is longer snippet from my journal, when I am at mock prompt via "mock shell --unpriv":
~~~
$ LC_ALL=C.UTF-8 journalctl -f
-- Logs begin at Thu 2019-12-05 04:19:02 CET. --
Dec 19 15:47:32 localhost.localdomain NetworkManager[994]: <info> [1576766852.3075] device (p2p-dev-wlp58s0): supplicant management interface state: disconnected -> scanning
Dec 19 15:47:32 localhost.localdomain setroubleshoot[412838]: Plugin Exception catchall_labels
Dec 19 15:47:32 localhost.localdomain setroubleshoot[412838]: Plugin Exception httpd_unified
Dec 19 15:47:32 localhost.localdomain setroubleshoot[412838]: Plugin Exception openvpn
Dec 19 15:47:32 localhost.localdomain setroubleshoot[412838]: Plugin Exception qemu_blk_image
Dec 19 15:47:32 localhost.localdomain setroubleshoot[412838]: Plugin Exception device
Dec 19 15:47:32 localhost.localdomain setroubleshoot[412838]: Plugin Exception allow_execstack
Dec 19 15:47:32 localhost.localdomain setroubleshoot[412838]: Plugin Exception swapfile
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception mounton
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception sshd_root
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception allow_ftpd_use_nfs
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception rsync_data
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception qemu_file_image
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception chrome
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception sandbox_connect
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception mozplugger_remove
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception httpd_write_content
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception filesystem_associate
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: SELinux brání systemd využívat setsched přístup k procesu. Pro úplné zprávy SELinuxu spusťte: sealert -l 94fbd50b-3629-44a6-bb97-6ba54295da60
Dec 19 15:47:33 localhost.localdomain python3[412838]: SELinux brání systemd využívat setsched přístup k procesu.
***** Plugin catchall (100. důvěry) naznačuje*********************************
Pokud jste přesvědčeni, že má systemd mít ve výchozím stavu přístup setsched na procesy se značkou syslogd_t.
Pak měli byste tento problém nahlásit jako chybu.
Abyste přístup povolili, můžete vygenerovat lokální modul pravidel.
Udělejte
prozatím tento přístup povolíte příkazy:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception file
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception allow_ftpd_use_cifs
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception cvs_data
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception xen_image
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception automount_exec_config
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception samba_share
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception connect_ports
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception bind_ports
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: SELinux brání systemd využívat setsched přístup k procesu. Pro úplné zprávy SELinuxu spusťte: sealert -l 94fbd50b-3629-44a6-bb97-6ba54295da60
Dec 19 15:47:33 localhost.localdomain python3[412838]: SELinux brání systemd využívat setsched přístup k procesu.
***** Plugin catchall (100. důvěry) naznačuje*********************************
Pokud jste přesvědčeni, že má systemd mít ve výchozím stavu přístup setsched na procesy se značkou syslogd_t.
Pak měli byste tento problém nahlásit jako chybu.
Abyste přístup povolili, můžete vygenerovat lokální modul pravidel.
Udělejte
prozatím tento přístup povolíte příkazy:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception public_content
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception allow_anon_write
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception httpd_can_sendmail
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: Plugin Exception mozplugger
Dec 19 15:47:33 localhost.localdomain setroubleshoot[412838]: SELinux brání systemd využívat setsched přístup k procesu. Pro úplné zprávy SELinuxu spusťte: sealert -l 94fbd50b-3629-44a6-bb97-6ba54295da60
Dec 19 15:47:33 localhost.localdomain python3[412838]: SELinux brání systemd využívat setsched přístup k procesu.
***** Plugin catchall (100. důvěry) naznačuje*********************************
Pokud jste přesvědčeni, že má systemd mít ve výchozím stavu přístup setsched na procesy se značkou syslogd_t.
Pak měli byste tento problém nahlásit jako chybu.
Abyste přístup povolili, můžete vygenerovat lokální modul pravidel.
Udělejte
prozatím tento přístup povolíte příkazy:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp
Dec 19 15:47:33 localhost.localdomain NetworkManager[994]: <info> [1576766853.4296] device (wlp58s0): supplicant interface state: scanning -> disconnected
Dec 19 15:47:33 localhost.localdomain NetworkManager[994]: <info> [1576766853.4297] device (p2p-dev-wlp58s0): supplicant management interface state: scanning -> disconnected
Dec 19 15:47:35 localhost.localdomain NetworkManager[994]: <info> [1576766855.3094] device (wlp58s0): supplicant interface state: disconnected -> scanning
Dec 19 15:47:35 localhost.localdomain NetworkManager[994]: <info> [1576766855.3095] device (p2p-dev-wlp58s0): supplicant management interface state: disconnected -> scanning
Dec 19 15:47:35 localhost.localdomain setroubleshoot[412838]: SELinux brání systemd využívat setsched přístup k procesu. Pro úplné zprávy SELinuxu spusťte: sealert -l 94fbd50b-3629-44a6-bb97-6ba54295da60
Dec 19 15:47:35 localhost.localdomain python3[412838]: SELinux brání systemd využívat setsched přístup k procesu.
***** Plugin catchall (100. důvěry) naznačuje*********************************
Pokud jste přesvědčeni, že má systemd mít ve výchozím stavu přístup setsched na procesy se značkou syslogd_t.
Pak měli byste tento problém nahlásit jako chybu.
Abyste přístup povolili, můžete vygenerovat lokální modul pravidel.
Udělejte
prozatím tento přístup povolíte příkazy:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp
Dec 19 15:47:36 localhost.localdomain NetworkManager[994]: <info> [1576766856.5620] device (wlp58s0): supplicant interface state: scanning -> disconnected
Dec 19 15:47:36 localhost.localdomain NetworkManager[994]: <info> [1576766856.5626] device (p2p-dev-wlp58s0): supplicant management interface state: scanning -> disconnected
Dec 19 15:47:37 localhost.localdomain NetworkManager[994]: <info> [1576766857.3074] device (wlp58s0): supplicant interface state: disconnected -> scanning
Dec 19 15:47:37 localhost.localdomain NetworkManager[994]: <info> [1576766857.3080] device (p2p-dev-wlp58s0): supplicant management interface state: disconnected -> scanning
Dec 19 15:47:38 localhost.localdomain NetworkManager[994]: <info> [1576766858.5710] device (wlp58s0): supplicant interface state: scanning -> disconnected
Dec 19 15:47:38 localhost.localdomain NetworkManager[994]: <info> [1576766858.5721] device (p2p-dev-wlp58s0): supplicant management interface state: scanning -> disconnected
Dec 19 15:47:39 localhost.localdomain NetworkManager[994]: <info> [1576766859.3083] device (wlp58s0): supplicant interface state: disconnected -> scanning
Dec 19 15:47:39 localhost.localdomain NetworkManager[994]: <info> [1576766859.3084] device (p2p-dev-wlp58s0): supplicant management interface state: disconnected -> scanning
Dec 19 15:47:41 localhost.localdomain NetworkManager[994]: <info> [1576766861.4145] device (wlp58s0): supplicant interface state: scanning -> disconnected
Dec 19 15:47:41 localhost.localdomain NetworkManager[994]: <info> [1576766861.4147] device (p2p-dev-wlp58s0): supplicant management interface state: scanning -> disconnected
Dec 19 15:47:42 localhost.localdomain NetworkManager[994]: <info> [1576766862.3095] device (wlp58s0): supplicant interface state: disconnected -> scanning
Dec 19 15:47:42 localhost.localdomain NetworkManager[994]: <info> [1576766862.3096] device (p2p-dev-wlp58s0): supplicant management interface state: disconnected -> scanning
Dec 19 15:47:43 localhost.localdomain NetworkManager[994]: <info> [1576766863.6615] device (wlp58s0): supplicant interface state: scanning -> disconnected
Dec 19 15:47:43 localhost.localdomain NetworkManager[994]: <info> [1576766863.6618] device (p2p-dev-wlp58s0): supplicant management interface state: scanning -> disconnected
Dec 19 15:47:44 localhost.localdomain NetworkManager[994]: <info> [1576766864.3081] device (wlp58s0): supplicant interface state: disconnected -> scanning
Dec 19 15:47:44 localhost.localdomain NetworkManager[994]: <info> [1576766864.3087] device (p2p-dev-wlp58s0): supplicant management interface state: disconnected -> scanning
Dec 19 15:47:45 localhost.localdomain NetworkManager[994]: <info> [1576766865.4323] device (wlp58s0): supplicant interface state: scanning -> disconnected
Dec 19 15:47:45 localhost.localdomain NetworkManager[994]: <info> [1576766865.4323] device (p2p-dev-wlp58s0): supplicant management interface state: scanning -> disconnected
Dec 19 15:47:45 localhost.localdomain audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=dbus-:1.7-org.fedoraproject.Setroubleshootd@1593 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Dec 19 15:47:45 localhost.localdomain systemd[1]: dbus-:1.7-org.fedoraproject.Setroubleshootd: Succeeded.
Dec 19 15:47:45 localhost.localdomain systemd[1]: dbus-:1.7-org.fedoraproject.Setroubleshootd: Consumed 1.277s CPU time.
Dec 19 15:47:45 localhost.localdomain audit[1]: AVC avc: denied { setsched } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=process permissive=0
Dec 19 15:47:45 localhost.localdomain audit[1]: AVC avc: denied { setsched } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=process permissive=0
Dec 19 15:47:46 localhost.localdomain audit[1]: AVC avc: denied { setsched } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=process permissive=0
Dec 19 15:47:47 localhost.localdomain NetworkManager[994]: <info> [1576766867.3078] device (wlp58s0): supplicant interface state: disconnected -> scanning
Dec 19 15:47:47 localhost.localdomain NetworkManager[994]: <info> [1576766867.3079] device (p2p-dev-wlp58s0): supplicant management interface state: disconnected -> scanning
Dec 19 15:47:48 localhost.localdomain NetworkManager[994]: <info> [1576766868.4359] device (wlp58s0): supplicant interface state: scanning -> disconnected
Dec 19 15:47:48 localhost.localdomain NetworkManager[994]: <info> [1576766868.4359] device (p2p-dev-wlp58s0): supplicant management interface state: scanning -> disconnected
Dec 19 15:47:49 localhost.localdomain audit[1]: AVC avc: denied { setsched } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=process permissive=0
Dec 19 15:47:49 localhost.localdomain systemd[1]: Started dbus-:1.7-org.fedoraproject.Setroubleshootd.
Dec 19 15:47:49 localhost.localdomain audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=dbus-:1.7-org.fedoraproject.Setroubleshootd@1594 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Dec 19 15:47:49 localhost.localdomain NetworkManager[994]: <info> [1576766869.3060] device (wlp58s0): supplicant interface state: disconnected -> scanning
Dec 19 15:47:49 localhost.localdomain NetworkManager[994]: <info> [1576766869.3061] device (p2p-dev-wlp58s0): supplicant management interface state: disconnected -> scanning
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception catchall_labels
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception httpd_unified
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception openvpn
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception qemu_blk_image
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception device
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception allow_execstack
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception swapfile
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception mounton
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception sshd_root
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception allow_ftpd_use_nfs
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception rsync_data
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception qemu_file_image
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception chrome
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception sandbox_connect
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception mozplugger_remove
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception httpd_write_content
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception filesystem_associate
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: SELinux brání systemd využívat setsched přístup k procesu. Pro úplné zprávy SELinuxu spusťte: sealert -l 94fbd50b-3629-44a6-bb97-6ba54295da60
Dec 19 15:47:49 localhost.localdomain python3[412851]: SELinux brání systemd využívat setsched přístup k procesu.
***** Plugin catchall (100. důvěry) naznačuje*********************************
Pokud jste přesvědčeni, že má systemd mít ve výchozím stavu přístup setsched na procesy se značkou syslogd_t.
Pak měli byste tento problém nahlásit jako chybu.
Abyste přístup povolili, můžete vygenerovat lokální modul pravidel.
Udělejte
prozatím tento přístup povolíte příkazy:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception file
Dec 19 15:47:49 localhost.localdomain setroubleshoot[412851]: Plugin Exception allow_ftpd_use_cifs
Dec 19 15:47:50 localhost.localdomain setroubleshoot[412851]: Plugin Exception cvs_data
Dec 19 15:47:50 localhost.localdomain setroubleshoot[412851]: Plugin Exception xen_image
Dec 19 15:47:50 localhost.localdomain setroubleshoot[412851]: Plugin Exception automount_exec_config
Dec 19 15:47:50 localhost.localdomain setroubleshoot[412851]: Plugin Exception samba_share
Dec 19 15:47:50 localhost.localdomain setroubleshoot[412851]: Plugin Exception connect_ports
Dec 19 15:47:50 localhost.localdomain setroubleshoot[412851]: Plugin Exception bind_ports
Dec 19 15:47:50 localhost.localdomain setroubleshoot[412851]: SELinux brání systemd využívat setsched přístup k procesu. Pro úplné zprávy SELinuxu spusťte: sealert -l 94fbd50b-3629-44a6-bb97-6ba54295da60
Dec 19 15:47:50 localhost.localdomain python3[412851]: SELinux brání systemd využívat setsched přístup k procesu.
***** Plugin catchall (100. důvěry) naznačuje*********************************
Pokud jste přesvědčeni, že má systemd mít ve výchozím stavu přístup setsched na procesy se značkou syslogd_t.
Pak měli byste tento problém nahlásit jako chybu.
Abyste přístup povolili, můžete vygenerovat lokální modul pravidel.
Udělejte
prozatím tento přístup povolíte příkazy:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp
Dec 19 15:47:50 localhost.localdomain setroubleshoot[412851]: Plugin Exception public_content
Dec 19 15:47:50 localhost.localdomain setroubleshoot[412851]: Plugin Exception allow_anon_write
Dec 19 15:47:50 localhost.localdomain setroubleshoot[412851]: Plugin Exception httpd_can_sendmail
Dec 19 15:47:50 localhost.localdomain setroubleshoot[412851]: Plugin Exception mozplugger
Dec 19 15:47:50 localhost.localdomain setroubleshoot[412851]: SELinux brání systemd využívat setsched přístup k procesu. Pro úplné zprávy SELinuxu spusťte: sealert -l 94fbd50b-3629-44a6-bb97-6ba54295da60
Dec 19 15:47:50 localhost.localdomain python3[412851]: SELinux brání systemd využívat setsched přístup k procesu.
***** Plugin catchall (100. důvěry) naznačuje*********************************
Pokud jste přesvědčeni, že má systemd mít ve výchozím stavu přístup setsched na procesy se značkou syslogd_t.
Pak měli byste tento problém nahlásit jako chybu.
Abyste přístup povolili, můžete vygenerovat lokální modul pravidel.
Udělejte
prozatím tento přístup povolíte příkazy:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp
Dec 19 15:47:50 localhost.localdomain NetworkManager[994]: <info> [1576766870.4473] device (wlp58s0): supplicant interface state: scanning -> disconnected
Dec 19 15:47:50 localhost.localdomain NetworkManager[994]: <info> [1576766870.4474] device (p2p-dev-wlp58s0): supplicant management interface state: scanning -> disconnected
Dec 19 15:47:51 localhost.localdomain NetworkManager[994]: <info> [1576766871.3062] device (wlp58s0): supplicant interface state: disconnected -> scanning
Dec 19 15:47:51 localhost.localdomain NetworkManager[994]: <info> [1576766871.3063] device (p2p-dev-wlp58s0): supplicant management interface state: disconnected -> scanning
Dec 19 15:47:52 localhost.localdomain wpa_supplicant[1062]: wlp58s0: Reject scan trigger since one is already pending
Dec 19 15:47:52 localhost.localdomain setroubleshoot[412851]: SELinux brání systemd využívat setsched přístup k procesu. Pro úplné zprávy SELinuxu spusťte: sealert -l 94fbd50b-3629-44a6-bb97-6ba54295da60
Dec 19 15:47:52 localhost.localdomain python3[412851]: SELinux brání systemd využívat setsched přístup k procesu.
***** Plugin catchall (100. důvěry) naznačuje*********************************
Pokud jste přesvědčeni, že má systemd mít ve výchozím stavu přístup setsched na procesy se značkou syslogd_t.
Pak měli byste tento problém nahlásit jako chybu.
Abyste přístup povolili, můžete vygenerovat lokální modul pravidel.
Udělejte
prozatím tento přístup povolíte příkazy:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp
Dec 19 15:47:53 localhost.localdomain NetworkManager[994]: <info> [1576766873.4168] device (wlp58s0): supplicant interface state: scanning -> disconnected
Dec 19 15:47:53 localhost.localdomain NetworkManager[994]: <info> [1576766873.4180] device (p2p-dev-wlp58s0): supplicant management interface state: scanning -> disconnected
Dec 19 15:47:54 localhost.localdomain NetworkManager[994]: <info> [1576766874.3072] device (wlp58s0): supplicant interface state: disconnected -> scanning
Dec 19 15:47:54 localhost.localdomain NetworkManager[994]: <info> [1576766874.3078] device (p2p-dev-wlp58s0): supplicant management interface state: disconnected -> scanning
Dec 19 15:47:55 localhost.localdomain NetworkManager[994]: <info> [1576766875.5502] device (wlp58s0): supplicant interface state: scanning -> disconnected
Dec 19 15:47:55 localhost.localdomain NetworkManager[994]: <info> [1576766875.5506] device (p2p-dev-wlp58s0): supplicant management interface state: scanning -> disconnected
Dec 19 15:47:57 localhost.localdomain NetworkManager[994]: <info> [1576766877.3095] device (wlp58s0): supplicant interface state: disconnected -> scanning
Dec 19 15:47:57 localhost.localdomain NetworkManager[994]: <info> [1576766877.3096] device (p2p-dev-wlp58s0): supplicant management interface state: disconnected -> scanning
Dec 19 15:47:58 localhost.localdomain NetworkManager[994]: <info> [1576766878.5687] device (wlp58s0): supplicant interface state: scanning -> disconnected
Dec 19 15:47:58 localhost.localdomain NetworkManager[994]: <info> [1576766878.5688] device (p2p-dev-wlp58s0): supplicant management interface state: scanning -> disconnected
Dec 19 15:48:01 localhost.localdomain NetworkManager[994]: <info> [1576766881.3094] device (wlp58s0): supplicant interface state: disconnected -> scanning
Dec 19 15:48:01 localhost.localdomain NetworkManager[994]: <info> [1576766881.3096] device (p2p-dev-wlp58s0): supplicant management interface state: disconnected -> scanning
Dec 19 15:48:02 localhost.localdomain NetworkManager[994]: <info> [1576766882.4362] device (wlp58s0): supplicant interface state: scanning -> disconnected
Dec 19 15:48:02 localhost.localdomain NetworkManager[994]: <info> [1576766882.4363] device (p2p-dev-wlp58s0): supplicant management interface state: scanning -> disconnected
Dec 19 15:48:02 localhost.localdomain systemd[1]: dbus-:1.7-org.fedoraproject.Setroubleshootd: Succeeded.
Dec 19 15:48:02 localhost.localdomain systemd[1]: dbus-:1.7-org.fedoraproject.Setroubleshootd: Consumed 1.221s CPU time.
Dec 19 15:48:02 localhost.localdomain audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=dbus-:1.7-org.fedoraproject.Setroubleshootd@1594 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Dec 19 15:48:02 localhost.localdomain audit[1]: AVC avc: denied { setsched } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=process permissive=0
Dec 19 15:48:02 localhost.localdomain audit[1]: AVC avc: denied { setsched } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=process permissive=0
Dec 19 15:48:02 localhost.localdomain audit[1]: AVC avc: denied { setsched } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=process permissive=0
Dec 19 15:48:03 localhost.localdomain NetworkManager[994]: <info> [1576766883.3065] device (wlp58s0): supplicant interface state: disconnected -> scanning
Dec 19 15:48:03 localhost.localdomain NetworkManager[994]: <info> [1576766883.3066] device (p2p-dev-wlp58s0): supplicant management interface state: disconnected -> scanning
Dec 19 15:48:04 localhost.localdomain NetworkManager[994]: <info> [1576766884.4276] device (wlp58s0): supplicant interface state: scanning -> disconnected
Dec 19 15:48:04 localhost.localdomain NetworkManager[994]: <info> [1576766884.4276] device (p2p-dev-wlp58s0): supplicant management interface state: scanning -> disconnected
Dec 19 15:48:05 localhost.localdomain audit[1]: AVC avc: denied { setsched } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=process permissive=0
Dec 19 15:48:05 localhost.localdomain systemd[1]: Started dbus-:1.7-org.fedoraproject.Setroubleshootd.
Dec 19 15:48:05 localhost.localdomain audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=dbus-:1.7-org.fedoraproject.Setroubleshootd@1595 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Dec 19 15:48:06 localhost.localdomain NetworkManager[994]: <info> [1576766886.3062] device (wlp58s0): supplicant interface state: disconnected -> scanning
Dec 19 15:48:06 localhost.localdomain NetworkManager[994]: <info> [1576766886.3062] device (p2p-dev-wlp58s0): supplicant management interface state: disconnected -> scanning
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception catchall_labels
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception httpd_unified
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception openvpn
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception qemu_blk_image
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception device
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception allow_execstack
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception swapfile
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception mounton
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception sshd_root
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception allow_ftpd_use_nfs
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception rsync_data
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception qemu_file_image
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception chrome
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception sandbox_connect
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception mozplugger_remove
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception httpd_write_content
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception filesystem_associate
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: SELinux brání systemd využívat setsched přístup k procesu. Pro úplné zprávy SELinuxu spusťte: sealert -l 94fbd50b-3629-44a6-bb97-6ba54295da60
Dec 19 15:48:06 localhost.localdomain python3[412869]: SELinux brání systemd využívat setsched přístup k procesu.
***** Plugin catchall (100. důvěry) naznačuje*********************************
Pokud jste přesvědčeni, že má systemd mít ve výchozím stavu přístup setsched na procesy se značkou syslogd_t.
Pak měli byste tento problém nahlásit jako chybu.
Abyste přístup povolili, můžete vygenerovat lokální modul pravidel.
Udělejte
prozatím tento přístup povolíte příkazy:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception file
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception allow_ftpd_use_cifs
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception cvs_data
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception xen_image
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception automount_exec_config
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception samba_share
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception connect_ports
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: Plugin Exception bind_ports
Dec 19 15:48:06 localhost.localdomain setroubleshoot[412869]: SELinux brání systemd využívat setsched přístup k procesu. Pro úplné zprávy SELinuxu spusťte: sealert -l 94fbd50b-3629-44a6-bb97-6ba54295da60
Dec 19 15:48:06 localhost.localdomain python3[412869]: SELinux brání systemd využívat setsched přístup k procesu.
***** Plugin catchall (100. důvěry) naznačuje*********************************
Pokud jste přesvědčeni, že má systemd mít ve výchozím stavu přístup setsched na procesy se značkou syslogd_t.
Pak měli byste tento problém nahlásit jako chybu.
Abyste přístup povolili, můžete vygenerovat lokální modul pravidel.
Udělejte
prozatím tento přístup povolíte příkazy:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp
Dec 19 15:48:07 localhost.localdomain setroubleshoot[412869]: Plugin Exception public_content
Dec 19 15:48:07 localhost.localdomain setroubleshoot[412869]: Plugin Exception allow_anon_write
Dec 19 15:48:07 localhost.localdomain setroubleshoot[412869]: Plugin Exception httpd_can_sendmail
Dec 19 15:48:07 localhost.localdomain setroubleshoot[412869]: Plugin Exception mozplugger
Dec 19 15:48:07 localhost.localdomain setroubleshoot[412869]: SELinux brání systemd využívat setsched přístup k procesu. Pro úplné zprávy SELinuxu spusťte: sealert -l 94fbd50b-3629-44a6-bb97-6ba54295da60
Dec 19 15:48:07 localhost.localdomain python3[412869]: SELinux brání systemd využívat setsched přístup k procesu.
***** Plugin catchall (100. důvěry) naznačuje*********************************
Pokud jste přesvědčeni, že má systemd mít ve výchozím stavu přístup setsched na procesy se značkou syslogd_t.
Pak měli byste tento problém nahlásit jako chybu.
Abyste přístup povolili, můžete vygenerovat lokální modul pravidel.
Udělejte
prozatím tento přístup povolíte příkazy:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp
Dec 19 15:48:08 localhost.localdomain NetworkManager[994]: <info> [1576766888.4180] device (wlp58s0): supplicant interface state: scanning -> disconnected
Dec 19 15:48:08 localhost.localdomain NetworkManager[994]: <info> [1576766888.4189] device (p2p-dev-wlp58s0): supplicant management interface state: scanning -> disconnected
Dec 19 15:48:09 localhost.localdomain NetworkManager[994]: <info> [1576766889.3099] device (wlp58s0): supplicant interface state: disconnected -> scanning
Dec 19 15:48:09 localhost.localdomain NetworkManager[994]: <info> [1576766889.3106] device (p2p-dev-wlp58s0): supplicant management interface state: disconnected -> scanning
Dec 19 15:48:09 localhost.localdomain setroubleshoot[412869]: SELinux brání systemd využívat setsched přístup k procesu. Pro úplné zprávy SELinuxu spusťte: sealert -l 94fbd50b-3629-44a6-bb97-6ba54295da60
Dec 19 15:48:09 localhost.localdomain python3[412869]: SELinux brání systemd využívat setsched přístup k procesu.
***** Plugin catchall (100. důvěry) naznačuje*********************************
Pokud jste přesvědčeni, že má systemd mít ve výchozím stavu přístup setsched na procesy se značkou syslogd_t.
Pak měli byste tento problém nahlásit jako chybu.
Abyste přístup povolili, můžete vygenerovat lokální modul pravidel.
Udělejte
prozatím tento přístup povolíte příkazy:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp
^C
~~~
You can see that in just ~30 seconds, it generated several AVCs.
*** This bug has been marked as a duplicate of bug 1778088 *** |
Description of problem: occured during selinux-policy upgrade SELinux is preventing systemd from using the 'setsched' accesses on a process. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that systemd should be allowed setsched access on processes labeled syslogd_t by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'systemd' --raw | audit2allow -M my-systemd # semodule -X 300 -i my-systemd.pp Additional Information: Source Context system_u:system_r:init_t:s0 Target Context system_u:system_r:syslogd_t:s0 Target Objects Unknown [ process ] Source systemd Source Path systemd Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.14.5-15.fc32.noarch selinux- policy-3.14.5-16.fc32.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 5.4.0-0.rc8.git0.2.fc32.x86_64 #1 SMP Wed Nov 20 18:14:11 UTC 2019 x86_64 x86_64 Alert Count 1 First Seen 2019-11-27 08:16:34 +05 Last Seen 2019-11-27 08:16:34 +05 Local ID 2dc6f2c4-0ce4-4f9a-bd7e-d5a100c7f6db Raw Audit Messages type=AVC msg=audit(1574824594.939:16672): avc: denied { setsched } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=process permissive=1 Hash: systemd,init_t,syslogd_t,process,setsched Version-Release number of selected component: selinux-policy-3.14.5-15.fc32.noarch selinux-policy-3.14.5-16.fc32.noarch Additional info: component: selinux-policy reporter: libreport-2.11.3 hashmarkername: setroubleshoot kernel: 5.4.0-0.rc8.git0.2.fc32.x86_64 type: libreport