.`systemd` can now execute files from `/home/_user_/bin`
Previously, `systemd` services could not execute files from the `/home/_user_/bin/` directory because the SELinux policy did not include the policy rules that allow such access. Consequently, the `systemd` services failed and eventually logged the Access Vector Cache (AVC) denial Audit messages. This update adds the missing SELinux rules that allow access, and `systemd` services can now correctly execute commands from `/home/_user_/bin/`.
Description of problem:
When an executable is in /home/user/bin and a systemd unit file attempts to run it, we fail with AVC denial:
# ausearch -i -m avc,user_avc
----
type=AVC msg=audit(07/24/2020 10:40:46.402:762) : avc: denied { execute } for pid=5221 comm=(test.sh) name=test.sh dev="dm-0" ino=8424005 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:home_bin_t:s0 tclass=file permissive=0
Version-Release number of selected component (if applicable):
RHEL 8
How reproducible:
Every time
Steps to Reproduce:
1. mkdir /home/user/bin
2. Create executable:
# cat /home/vagrant/bin/test.sh
#!/bin/bash
echo 'test'
3. Create systemd unit file:
# cat /etc/systemd/system/test.service
[Service]
ExecStart=/home/vagrant/bin/test.sh
4. systemd daemon-reload; systemd start test.service
Actual results:
AVC denial:
type=AVC msg=audit(07/24/2020 10:40:46.402:762) : avc: denied { execute } for pid=5221 comm=(test.sh) name=test.sh dev="dm-0" ino=8424005 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:home_bin_t:s0 tclass=file permissive=0
Expected results:
systemd should be able to run an executable in a user's bin home without AVC.
Additional info:
This can be worked around by wrapping the executable in a shell so it's bin_t instead of init_t:
# cat /etc/systemd/system/test.service
[Service]
ExecStart=/bin/sh -c '/home/vagrant/bin/test.sh'
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2022:1995
Description of problem: When an executable is in /home/user/bin and a systemd unit file attempts to run it, we fail with AVC denial: # ausearch -i -m avc,user_avc ---- type=AVC msg=audit(07/24/2020 10:40:46.402:762) : avc: denied { execute } for pid=5221 comm=(test.sh) name=test.sh dev="dm-0" ino=8424005 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:home_bin_t:s0 tclass=file permissive=0 Version-Release number of selected component (if applicable): RHEL 8 How reproducible: Every time Steps to Reproduce: 1. mkdir /home/user/bin 2. Create executable: # cat /home/vagrant/bin/test.sh #!/bin/bash echo 'test' 3. Create systemd unit file: # cat /etc/systemd/system/test.service [Service] ExecStart=/home/vagrant/bin/test.sh 4. systemd daemon-reload; systemd start test.service Actual results: AVC denial: type=AVC msg=audit(07/24/2020 10:40:46.402:762) : avc: denied { execute } for pid=5221 comm=(test.sh) name=test.sh dev="dm-0" ino=8424005 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:home_bin_t:s0 tclass=file permissive=0 Expected results: systemd should be able to run an executable in a user's bin home without AVC. Additional info: This can be worked around by wrapping the executable in a shell so it's bin_t instead of init_t: # cat /etc/systemd/system/test.service [Service] ExecStart=/bin/sh -c '/home/vagrant/bin/test.sh'