Bug 1883906
Summary: | selinux prevents timedatex (timedatectl) commands running from cron on RHEL8.x | ||
---|---|---|---|
Product: | Red Hat Enterprise Linux 8 | Reporter: | Eize Speerstra <eize.speerstra> |
Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | --- | CC: | jangerrit.kootstra, lvrabec, mmalik, plautrba, ssekidde |
Target Milestone: | rc | Keywords: | Triaged |
Target Release: | 8.4 | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | No Doc Update | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2021-05-18 14:58:17 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Eize Speerstra
2020-09-30 13:45:00 UTC
Reproducible on RHEL-8.3 too: ---- type=USER_AVC msg=audit(10/01/2020 10:23:01.668:335) : pid=1158 uid=dbus auid=unset ses=unset subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.213 spid=7160 tpid=7159 scontext=system_u:system_r:timedatex_t:s0 tcontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 tclass=dbus permissive=0 exe=/usr/bin/dbus-daemon sauid=dbus hostname=? addr=? terminal=?' ---- # rpm -qa selinux\* selinux-policy-devel-3.14.3-54.el8.noarch selinux-policy-3.14.3-54.el8.noarch selinux-policy-doc-3.14.3-54.el8.noarch selinux-policy-minimum-3.14.3-54.el8.noarch selinux-policy-sandbox-3.14.3-54.el8.noarch selinux-policy-mls-3.14.3-54.el8.noarch selinux-policy-targeted-3.14.3-54.el8.noarch # grep -v '#' /etc/crontab SHELL=/bin/bash PATH=/sbin:/bin:/usr/sbin:/usr/bin MAILTO=root * * * * * root timedatectl set-timezone Europe/Prague # The only SELinux denial which appeared in permissive mode is: ---- type=USER_AVC msg=audit(10/01/2020 10:27:01.641:394) : pid=1158 uid=dbus auid=unset ses=unset subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.245 spid=8554 tpid=8553 scontext=system_u:system_r:timedatex_t:s0 tcontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 tclass=dbus permissive=1 exe=/usr/bin/dbus-daemon sauid=dbus hostname=? addr=? terminal=?' ---- # sesearch -s timedatex_t -t system_cronjob_t -c dbus -A # sesearch -s system_cronjob_t -t timedatex_t -c dbus -A allow dbusd_unconfined timedatex_t:dbus send_msg; # Does the scenario work for normal or confined users? The scenario executed under normal confined users does not produce any SELinux denials. Unfortunately, it fails to change the timezone - Not authorized. I've submitted a Fedora PR to address the issue: https://github.com/fedora-selinux/selinux-policy/pull/502 This is the rawhide commit: commit 4d2207194e25b20e9b2c52de49f4d550c1488ab3 (HEAD -> rawhide, upstream/rawhide) Author: Zdenek Pytela <zpytela> Date: Tue Dec 8 22:49:21 2020 +0100 Allow timedatex dbus chat with cron system domain Resolves: rhbz#1883906 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:1639 |