Bug 2043025

Summary: SELinux is preventing restorecon from using the mac_admin capability
Product: [Fedora] Fedora Reporter: Garry T. Williams <gtwilliams>
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 35CC: dwalsh, grepl.miroslav, lvrabec, mmalik, omosnace, pkoncity, vmojzis, zpytela
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-01-20 16:11:59 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Garry T. Williams 2022-01-20 14:00:50 UTC
Description of problem:

Additional Information:
Source Context                unconfined_u:unconfined_r:setfiles_t:s0-
                              s0:c0.c1023
Target Context                unconfined_u:unconfined_r:setfiles_t:s0-
                              s0:c0.c1023
Target Objects                Unknown [ capability2 ]
Source                        restorecon
Source Path                   restorecon
Port                          <Unknown>
Host                          gtw
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-35.9-1.fc35.noarch
                              selinux-policy-targeted-35.10-1.fc35.noarch
Local Policy RPM              selinux-policy-targeted-35.9-1.fc35.noarch
                              selinux-policy-targeted-35.10-1.fc35.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     gtw
Platform                      Linux gtw 5.15.14-200.fc35.x86_64 #1 SMP Tue Jan
                              11 16:49:27 UTC 2022 x86_64 x86_64
Alert Count                   1
First Seen                    2022-01-20 08:47:44 EST
Last Seen                     2022-01-20 08:47:44 EST
Local ID                      29f21cbf-1464-4c8e-8510-25606ffbd526

Raw Audit Messages
type=AVC msg=audit(1642686464.768:2865): avc:  denied  { mac_admin } for  pid=58070 comm="restorecon" capability=33  scontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 tclass=capability2 permissive=0


Hash: restorecon,setfiles_t,setfiles_t,capability2,mac_admin


garry@gtw$ sudo ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today
----
type=AVC msg=audit(01/20/2022 08:47:44.768:2865) : avc:  denied  { mac_admin } for  pid=58070 comm=restorecon capability=mac_admin  scontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 tclass=capability2 permissive=0 
----
type=SELINUX_ERR msg=audit(01/20/2022 08:47:44.768:2866) : op=setxattr invalid_context=system_u:object_r:swtpm_exec_t:s0 
garry@gtw$ rpm -qa selinux-policy\*                  
selinux-policy-35.10-1.fc35.noarch
selinux-policy-targeted-35.10-1.fc35.noarch
garry@gtw$

Comment 1 Zdenek Pytela 2022-01-20 16:11:59 UTC
Please update to selinux-policy-35.11-1.fc35 and ensure only one copy of each of the selinux-policy packages is installed.

*** This bug has been marked as a duplicate of bug 2042369 ***