Bug 1896457
| Summary: | varnish unable to start because selinux is preventing lto1-wpa from map access on tempfiles | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Ingvar Hagelund <ingvar> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 33 | CC: | dwalsh, emilkm, grepl.miroslav, lvrabec, mmalik, plautrba, vmojzis, zpytela |
| Target Milestone: | --- | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.14.6-31.fc33 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-12-12 01:04:56 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Ingvar Hagelund
2020-11-10 15:47:42 UTC
Hi,
Is this the only denial you see now?
type=AVC msg=audit(1604000868.64:265): avc: denied { map } for pid=23973 comm="lto1-wpa" path="/tmp/ccUUg65n.o" dev="tmpfs" ino=56637 scontext=system_u:system_r:varnishd_t:s0 tcontext=system_u:object_r:varnishd_tmp_t:s0 tclass=file permissive=0
Yes, that is the only one I get. I've submitted a Fedora PR to address the issue: https://bugzilla.redhat.com/show_bug.cgi?id=1890884#c7 The default domain_can_mmap_files off was added for security reasons: # dnf install selinux-policy-devel # semanage boolean -l | grep domain_can_mmap_files domain_can_mmap_files (on , off) Allow any process to mmap any file on system with attribute file_type. A quick and dirty workaround is to switch if on again: # setsebool domain_can_mmap_files on Se for example here for some notes on the security impact: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/new_features_security The issue will be resolved allowing just one map permission, see the PR - this is the correct link: https://github.com/fedora-selinux/selinux-policy-contrib/pull/363 commit 2b2a20eb1be3213fd8d3b3e2f474e8e8790ce7ce (HEAD -> f33, upstream/f33)
Author: Zdenek Pytela <zpytela>
Date: Thu Nov 12 11:19:01 2020 +0100
Allow varnish map its private tmp files
Resolves: rhbz#1896457
FEDORA-2020-aff0be81b3 has been submitted as an update to Fedora 33. https://bodhi.fedoraproject.org/updates/FEDORA-2020-aff0be81b3 FEDORA-2020-aff0be81b3 has been pushed to the Fedora 33 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-aff0be81b3` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-aff0be81b3 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2020-aff0be81b3 has been pushed to the Fedora 33 stable repository. If problem still persists, please make note of it in this bug report. *** Bug 1892552 has been marked as a duplicate of this bug. *** |