Bug 1936705
| Summary: | SELinux is preventing usbmuxd from getattr access on the filesystem /sys/fs/cgroup. | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Joe Walker <joe.c.walker0> | |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> | |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | low | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 34 | CC: | dwalsh, grepl.miroslav, lvrabec, mmalik, omosnace, plautrba, vmojzis, zpytela | |
| Target Milestone: | --- | Keywords: | Triaged | |
| Target Release: | --- | |||
| Hardware: | x86_64 | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | selinux-policy-34.2-1.fc34 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1965411 (view as bug list) | Environment: | ||
| Last Closed: | 2021-04-24 19:45:23 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1965411 | |||
Merged in rawhide:
commit 0058d3ca0a82d244a63eeb588a075d10b309a10b (HEAD -> rawhide, upstream/rawhide, upstream-rw/rawhide, origin/rawhide, origin/HEAD)
Author: Zdenek Pytela <zpytela>
Date: Tue Apr 6 18:23:58 2021 +0200
Allow usbmuxd get attributes of cgroup filesystems
Resolves: rhbz#1936705
FEDORA-2021-79ef7c5af6 has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2021-79ef7c5af6 FEDORA-2021-79ef7c5af6 has been pushed to the Fedora 34 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-79ef7c5af6` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-79ef7c5af6 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2021-79ef7c5af6 has been pushed to the Fedora 34 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2021-79ef7c5af6 has been pushed to the Fedora 34 stable repository. If problem still persists, please make note of it in this bug report. |
SELinux is preventing usbmuxd from getattr access on the filesystem /sys/fscgroup. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that usbmuxd should be allowed getattr access on the cgroup filesystem by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'usbmuxd' --raw | audit2allow -M my-usbmuxd # semodule -X 300 -i my-usbmuxd.pp Additional Information: Source Context system_u:system_r:usbmuxd_t:s0 Target Context system_u:object_r:cgroup_t:s0 Target Objects /sys/fs/cgroup [ filesystem ] Source usbmuxd Source Path usbmuxd Port <Unknown> Host grumpey Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-3.14.7-24.fc34.noarch Local Policy RPM selinux-policy-targeted-3.14.7-24.fc34.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name grumpey Platform Linux grumpey 5.11.3-300.fc34.x86_64 #1 SMP Thu Mar 4 19:03:18 UTC 2021 x86_64 x86_64 Alert Count 1 First Seen 2021-03-08 18:56:34 EST Last Seen 2021-03-08 18:56:34 EST Local ID c3125051-ae2c-48e0-835a-61450ae5aba4 Raw Audit Messages type=AVC msg=audit(1615247794.812:645): avc: denied { getattr } for pid=6447 comm="usbmuxd" name="/" dev="cgroup2" ino=1 scontext=system_u:system_r:usbmuxd_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=filesystem permissive=0 Hash: usbmuxd,usbmuxd_t,cgroup_t,filesystem,getattr