Bug 2056200

This type of denial happened when abrt-server used coredumpctl to get the core dump from a crash of maliit-keyboard resulting in errors like abrt-server[1378]: Error: File './coredump' is not a coredump. 

Feb 19 12:53:32 abrt-server[1378]: Retrieving coredump with coredumpctl
Feb 19 12:53:32 audit[2337]: AVC avc:  denied  { read } for  pid=2337 comm="coredumpctl" name="core.maliit-keyboard.989.17ab8a3e7cd446fb8b03145d79d85e92.1323.1645293192000000.zst" dev="dm-0" ino=3934283 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_coredump_var_lib_t:s0 tclass=file permissive=0
Feb 19 12:53:32 audit[2337]: AVC avc:  denied  { read } for  pid=2337 comm="coredumpctl" name="core.maliit-keyboard.989.17ab8a3e7cd446fb8b03145d79d85e92.1323.1645293192000000.zst" dev="dm-0" ino=3934283 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_coredump_var_lib_t:s0 tclass=file permissive=0
Feb 19 12:53:32 abrt-server[1378]: Error: File './coredump' is not a coredump
Feb 19 12:53:32 abrt-server[1378]: eu-readelf: input file is empty
Feb 19 12:53:32 plasmashell[1544]: qt.qpa.wayland: Wayland does not support QWindow::requestActivate()
Feb 19 12:53:33 abrt-server[1378]: Error while running gdb:
Feb 19 12:53:33 abrt-server[1378]: /usr/libexec/gdb: warning: Couldn't determine a path for the index cache directory.
Feb 19 12:53:33 abrt-server[1378]: "/var/spool/abrt/ccpp-2022-02-19-12:53:13.701626-1323/./coredump" is not a core dump: file format not recognized
Feb 19 12:53:33 abrt-server[1378]: Python Exception <class 'ValueError'>: invalid literal for int() with base 10: ''
Feb 19 12:53:33 abrt-server[1378]: Error occurred in Python: invalid literal for int() with base 10: ''
Feb 19 12:53:33 setroubleshoot[2312]: SELinux is preventing coredumpctl from read access on the file core.maliit-keyboard.989.17ab8a3e7cd446fb8b03145d79d85e92.1291.1645293189000000.zst. For complete SELinux messages run: sealert -l 30c9fd06-7cfb-4860-bf38-c0cf60166138
Feb 19 12:53:33 setroubleshoot[2312]: SELinux is preventing coredumpctl from read access on the file core.maliit-keyboard.989.17ab8a3e7cd446fb8b03145d79d85e92.1291.1645293189000000.zst.
                                      
                                      *****  Plugin catchall (100. confidence) suggests   **************************
                                      
                                      If you believe that coredumpctl should be allowed read access on the core.maliit-keyboard.989.17ab8a3e7cd446fb8b03145d79d85e92.1291.1645293189000000.zst file by default.
                                      Then you should report this as a bug.
                                      You can generate a local policy module to allow this access.
                                      Do
                                      allow this access for now by executing:
                                      # ausearch -c 'coredumpctl' --raw | audit2allow -M my-coredumpctl
                                      # semodule -X 300 -i my-coredumpctl.pp
                                      
Feb 19 12:53:33 setroubleshoot[2312]: AnalyzeThread.run(): Set alarm timeout to 10
Feb 19 12:53:33 setroubleshoot[2312]: AnalyzeThread.run(): Cancel pending alarm
Feb 19 12:53:33 abrt-server[1378]: eu-unstrip: cannot read ELF core file: not a valid ELF file
Feb 19 12:53:33 abrt-server[1378]: Can't open file 'core_backtrace' for reading: No such file or directory

gnome-abrt doesn't have the core dump in the maliit-keyboard crash report as a result. When I tried to report the crash with gnome-abrt, the error Processing failed happened with the log
--- Running report_uReport ---
Error: File './coredump' is not a coredump
('report_uReport' exited with 1)

These types of denials happened after crashes of sddm https://bugzilla.redhat.com/show_bug.cgi?id=2056308 , gutenprint53+usb https://bugzilla.redhat.com/show_bug.cgi?id=2055504 , plasmashell, xdg-desktop-portal-kde, and others with the same abrt errors and missing core dumps in gnome-abrt. The abrt server might not be able to accept reports for programs which produce core dumps because the core dumps are missing. Should the problem be assessed as a possible F36 beta blocker under the criterion "Bug hinders execution of required Beta test plans or dramatically reduces test coverage"? https://fedoraproject.org/wiki/Fedora_36_Beta_Release_Criteria

Our automatic OS regression tracker [1] has not seen this any more in the last three weeks. So it seems this got fixed?

[1] https://github.com/cockpit-project/bots/issues/2988

(In reply to Martin Pitt from comment #2)
> Our automatic OS regression tracker [1] has not seen this any more in the
> last three weeks. So it seems this got fixed?
> 
> [1] https://github.com/cockpit-project/bots/issues/2988

I don't see any related change in policy. It keeps being required to turn this boolean on to allow abrt execute various handlers:

  # setsebool -P abrt_handle_event on

There is nothing to be done in selinux-policy.

I think this type of coredumpctl denial was fixed by abrt-2.15.1-1.fc36 as described in https://bugzilla.redhat.com/show_bug.cgi?id=2052872