Bug 2000039
| Summary: | AVC failures seen with : denied { create } comm="systemd" | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | anuja <amore> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | high | ||
| Version: | 9.0 | CC: | hewang, jchecahi, jstodola, lvrabec, mmalik, mvarun, sgoveas, ssekidde, ssidhaye, xiliang |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 9.0 | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-34.1.24-1.el9 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-05-17 15:49:27 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1942219 | ||
This permission actually is allowed:
# sesearch -A -s user_t -t user_tmp_t -c dir -p create
allow user_t user_home_type:dir { add_name create getattr ioctl link lock open read relabelfrom relabelto remove_name rename reparent rmdir search setattr unlink watch watch_reads write };
allow user_usertype user_tmp_type:dir { add_name create getattr ioctl link lock mounton open read relabelfrom relabelto remove_name rename reparent rmdir search setattr unlink watch watch_reads write };
but I suppose we are hitting a clone of bz#1878094.
To backport:
commit 925e0fcfc3747fa0d8bae5c6f266b4f2d754b6f5 (HEAD -> rawhide, upstream/rawhide)
Author: Zdenek Pytela <zpytela>
Date: Tue Dec 14 20:40:40 2021 +0100
Change /run/user/[0-9]+ to /run/user/%{USERID} for proper labeling
*** Bug 2051852 has been marked as a duplicate of this bug. *** *** Bug 2052065 has been marked as a duplicate of this bug. *** *** Bug 2052102 has been marked as a duplicate of this bug. *** *** Bug 2052912 has been marked as a duplicate of this bug. *** *** Bug 2052998 has been marked as a duplicate of this bug. *** *** Bug 2056754 has been marked as a duplicate of this bug. *** Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (new packages: selinux-policy), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:3918 |
Description of problem: Following AVC denial seen during bash tests with latest IPA build for RHEL9.0 ---- time->Thu Aug 26 14:18:02 2021 type=PROCTITLE msg=audit(1630001882.660:2737): proctitle="(systemd)" type=SYSCALL msg=audit(1630001882.660:2737): arch=c000003e syscall=83 success=no exit=-13 a0=561de90da280 a1=1ed a2=561888d331ea a3=0 items=0 ppid=1 pid=21494 auid=725801116 uid=725801116 gid=725801116 euid=725801116 suid=725801116 fsuid=725801116 egid=725801116 sgid=725801116 fsgid=725801116 tty=(none) ses=48 comm="systemd" exe="/usr/lib/systemd/systemd" subj=user_u:user_r:user_t:s0 key=(null) type=AVC msg=audit(1630001882.660:2737): avc: denied { create } for pid=21494 comm="systemd" name="systemd" scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:user_tmp_t:s0 tclass=dir permissive=0 ---- time->Thu Aug 26 14:18:02 2021 type=PROCTITLE msg=audit(1630001882.683:2739): proctitle="(systemd)" type=SYSCALL msg=audit(1630001882.683:2739): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe9ce11910 a1=1ed a2=561888d3325a a3=0 items=0 ppid=1 pid=21494 auid=725801116 uid=725801116 gid=725801116 euid=725801116 suid=725801116 fsuid=725801116 egid=725801116 sgid=725801116 fsgid=725801116 tty=(none) ses=48 comm="systemd" exe="/usr/lib/systemd/systemd" subj=user_u:user_r:user_t:s0 key=(null) type=AVC msg=audit(1630001882.683:2739): avc: denied { create } for pid=21494 comm="systemd" name="systemd" scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:user_tmp_t:s0 tclass=dir permissive=0 Version-Release number of selected component (if applicable): selinux-policy-34.1.13-1.el9.noarch ipa-server-4.9.6-5.el9.x86_64.rpm Actual results: AVC denial seen Expected results: No AVC denial should be there.