Bug 1931460

Summary: SELinux prevents hibernation (preventing systemd-sleep from getattr access to swap partition)
Product: Red Hat Enterprise Linux 8 Reporter: Zdenek Pytela <zpytela>
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact:
Priority: medium    
Version: 8.3CC: dwalsh, extras-qa, grepl.miroslav, lvrabec, mmalik, omosnace, plautrba, ryan, ssekidde, vmojzis, zpytela
Target Milestone: rcKeywords: AutoVerified, Triaged
Target Release: 8.5   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.14.3-72.el8 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: 1928539 Environment:
Last Closed: 2021-11-09 19:42:58 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1928539    
Bug Blocks:    

Description Zdenek Pytela 2021-02-22 13:14:49 UTC 
+++ This bug was initially created as a clone of Bug #1928539 +++

Description of problem:

SELinux prevents hibernation (and therefore hybrid-sleep) on FC34 due to denying systemd-sleep access to the swap partition


Version-Release number of selected component (if applicable):

FC34

How reproducible:

100%

Steps to Reproduce:
1. Upgrade to FC34
2. Enable hibernation by creating a swap partition and setting resume=<partition> in kernel boot params
3. Execute systemctl hibernate

Actual results:

Hibernation fails. This is a regression from FC33.

Expected results:

Hibernation succeeds.

Additional info:

Logs:Feb 15 08:24:08 firebert setroubleshoot[10858]: SELinux is preventing systemd-sleep from getattr access on the blk_file /dev/dm-2. For complete SELinux messages run: sealert -l 2e75eafb-e816-4902-89e7>
Feb 15 08:24:08 firebert setroubleshoot[10858]: SELinux is preventing systemd-sleep from getattr access on the blk_file /dev/dm-2.

                                                *****  Plugin catchall (100. confidence) suggests   **************************

                                                If you believe that systemd-sleep should be allowed getattr access on the dm-2 blk_file by default.
                                                Then you should report this as a bug.
                                                You can generate a local policy module to allow this access.
                                                Do
                                                allow this access for now by executing:
                                                # ausearch -c 'systemd-sleep' --raw | audit2allow -M my-systemdsleep
                                                # semodule -X 300 -i my-systemdsleep.pp



Possibly similar to #1797543

Using the workaround logged by setroubleshoot allows hibernation to succeed.

--- Additional comment from Zdenek Pytela on 2021-02-19 21:13:29 CET ---

Fixed in rawhide:
https://github.com/fedora-selinux/selinux-policy/pull/602
Comment 1 Zdenek Pytela 2021-06-25 18:45:51 UTC 
To backport:
commit 30654cfd4d8c2949d8c5c2c5b56655045ae3c7b7
Author: Zdenek Pytela <zpytela>
Date:   Thu Feb 18 21:29:19 2021 +0100

    Allow systemd-sleep get attributes of fixed disk device nodes
Comment 13 errata-xmlrpc 2021-11-09 19:42:58 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:4420