Bug 2096857

Essential parts (scontext=,tcontext=, tclass=) of the SELinux denials are missing or incomplete.

Please collect the SELinux denials via the following command and attach them to this BZ:

# ausearch -m avc -m user_avc -m selinux_err -i -ts today

Thank you.

Opps, sorry, didn't notice the cut+paste from the journal got truncated the full data is

type=AVC msg=audit(14/06/22 08:37:26.946:464) : avc:  denied  { read write open } for  pid=1841 comm=(sd-mkdcreds) path=/dev/shm/.#credb203d1a46b4d1f68 dev="ramfs" ino=29895 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:ramfs_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(14/06/22 08:37:26.946:465) : avc:  denied  { setattr } for  pid=1841 comm=(sd-mkdcreds) name=.#credb203d1a46b4d1f68 dev="ramfs" ino=29895 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:ramfs_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(14/06/22 08:37:26.946:466) : avc:  denied  { rename } for  pid=1841 comm=(sd-mkdcreds) name=.#credb203d1a46b4d1f68 dev="ramfs" ino=29895 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:ramfs_t:s0 tclass=file permissive=1

Daniel,

I see ramfs_t type in the reported files in /dev/shm. Does your system have some special setup?

ls -lZa /dev/shm
grep shm /proc/mounts

No special setup is needed. The systemd-creds command complains about missing TCTI device, but the device is not really needed.

The following SELinux denial appears when the scenario is reproduced in enforcing mode:
----
type=PROCTITLE msg=audit(06/14/2022 12:10:47.770:673) : proctitle=(sd-mkdcreds) 
type=PATH msg=audit(06/14/2022 12:10:47.770:673) : item=1 name=.#credd43963dcf21a4c4c inode=25102 dev=00:2f mode=file,600 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ramfs_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(06/14/2022 12:10:47.770:673) : item=0 name=/ inode=25101 dev=00:2f mode=dir,700 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(06/14/2022 12:10:47.770:673) : cwd=/ 
type=SYSCALL msg=audit(06/14/2022 12:10:47.770:673) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0x3 a1=0x557deee0a8a0 a2=O_RDWR|O_CREAT|O_EXCL|O_NOCTTY|O_NOFOLLOW|O_CLOEXEC a3=0x180 items=2 ppid=1519 pid=1520 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(sd-mkdcreds) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(06/14/2022 12:10:47.770:673) : avc:  denied  { read write open } for  pid=1520 comm=(sd-mkdcreds) path=/dev/shm/.#credd43963dcf21a4c4c dev="ramfs" ino=25102 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:ramfs_t:s0 tclass=file permissive=0 
----

# rpm -qa selinux\* systemd\* | sort
selinux-policy-37.4-1.fc37.noarch
selinux-policy-targeted-37.4-1.fc37.noarch
systemd-251.2-1.fc37.x86_64
systemd-libs-251.2-1.fc37.x86_64
systemd-networkd-251.2-1.fc37.x86_64
systemd-oomd-defaults-251.2-1.fc37.noarch
systemd-pam-251.2-1.fc37.x86_64
systemd-resolved-251.2-1.fc37.x86_64
systemd-udev-251.2-1.fc37.x86_64
#

The following SELinux denials appear when the scenario is reproduced in permissive mode:
----
type=PROCTITLE msg=audit(06/14/2022 12:19:28.536:687) : proctitle=(sd-mkdcreds) 
type=PATH msg=audit(06/14/2022 12:19:28.536:687) : item=1 name=.#cred7b48b9455a1f4c47 inode=25599 dev=00:32 mode=file,600 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ramfs_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(06/14/2022 12:19:28.536:687) : item=0 name=/ inode=25598 dev=00:32 mode=dir,700 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(06/14/2022 12:19:28.536:687) : cwd=/ 
type=SYSCALL msg=audit(06/14/2022 12:19:28.536:687) : arch=x86_64 syscall=openat success=yes exit=4 a0=0x3 a1=0x557deedbb500 a2=O_RDWR|O_CREAT|O_EXCL|O_NOCTTY|O_NOFOLLOW|O_CLOEXEC a3=0x180 items=2 ppid=1588 pid=1589 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(sd-mkdcreds) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(06/14/2022 12:19:28.536:687) : avc:  denied  { read write open } for  pid=1589 comm=(sd-mkdcreds) path=/dev/shm/.#cred7b48b9455a1f4c47 dev="ramfs" ino=25599 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:ramfs_t:s0 tclass=file permissive=1 
----
type=PROCTITLE msg=audit(06/14/2022 12:19:28.537:688) : proctitle=(sd-mkdcreds) 
type=PATH msg=audit(06/14/2022 12:19:28.537:688) : item=0 name=(null) inode=25599 dev=00:32 mode=file,600 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ramfs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(06/14/2022 12:19:28.537:688) : cwd=/ 
type=SYSCALL msg=audit(06/14/2022 12:19:28.537:688) : arch=x86_64 syscall=fchmod success=yes exit=0 a0=0x4 a1=0400 a2=0x0 a3=0x180 items=1 ppid=1588 pid=1589 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(sd-mkdcreds) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(06/14/2022 12:19:28.537:688) : avc:  denied  { setattr } for  pid=1589 comm=(sd-mkdcreds) name=.#cred7b48b9455a1f4c47 dev="ramfs" ino=25599 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:ramfs_t:s0 tclass=file permissive=1 
----
type=PROCTITLE msg=audit(06/14/2022 12:19:28.537:689) : proctitle=(sd-mkdcreds) 
type=PATH msg=audit(06/14/2022 12:19:28.537:689) : item=3 name=bar inode=25599 dev=00:32 mode=file,400 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ramfs_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(06/14/2022 12:19:28.537:689) : item=2 name=.#cred7b48b9455a1f4c47 inode=25599 dev=00:32 mode=file,400 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ramfs_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(06/14/2022 12:19:28.537:689) : item=1 name=/ inode=25598 dev=00:32 mode=dir,700 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(06/14/2022 12:19:28.537:689) : item=0 name=/ inode=25598 dev=00:32 mode=dir,700 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(06/14/2022 12:19:28.537:689) : cwd=/ 
type=SYSCALL msg=audit(06/14/2022 12:19:28.537:689) : arch=x86_64 syscall=renameat success=yes exit=0 a0=0x3 a1=0x557deedbb500 a2=0x3 a3=0x557deee091b0 items=4 ppid=1588 pid=1589 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(sd-mkdcreds) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(06/14/2022 12:19:28.537:689) : avc:  denied  { rename } for  pid=1589 comm=(sd-mkdcreds) name=.#cred7b48b9455a1f4c47 dev="ramfs" ino=25599 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:ramfs_t:s0 tclass=file permissive=1 
----

# cat /proc/mounts 
proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0
sysfs /sys sysfs rw,seclabel,nosuid,nodev,noexec,relatime 0 0
devtmpfs /dev devtmpfs rw,seclabel,nosuid,size=4096k,nr_inodes=1048576,mode=755,inode64 0 0
securityfs /sys/kernel/security securityfs rw,nosuid,nodev,noexec,relatime 0 0
tmpfs /dev/shm tmpfs rw,seclabel,nosuid,nodev,inode64 0 0
devpts /dev/pts devpts rw,seclabel,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0
tmpfs /run tmpfs rw,seclabel,nosuid,nodev,size=403236k,nr_inodes=819200,mode=755,inode64 0 0
cgroup2 /sys/fs/cgroup cgroup2 rw,seclabel,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot 0 0
pstore /sys/fs/pstore pstore rw,seclabel,nosuid,nodev,noexec,relatime 0 0
bpf /sys/fs/bpf bpf rw,nosuid,nodev,noexec,relatime,mode=700 0 0
/dev/vda1 / ext4 rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,nosuid,noexec,relatime 0 0
systemd-1 /proc/sys/fs/binfmt_misc autofs rw,relatime,fd=41,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=14890 0 0
debugfs /sys/kernel/debug debugfs rw,seclabel,nosuid,nodev,noexec,relatime 0 0
hugetlbfs /dev/hugepages hugetlbfs rw,seclabel,relatime,pagesize=2M 0 0
mqueue /dev/mqueue mqueue rw,seclabel,nosuid,nodev,noexec,relatime 0 0
tracefs /sys/kernel/tracing tracefs rw,seclabel,nosuid,nodev,noexec,relatime 0 0
fusectl /sys/fs/fuse/connections fusectl rw,nosuid,nodev,noexec,relatime 0 0
configfs /sys/kernel/config configfs rw,nosuid,nodev,noexec,relatime 0 0
tmpfs /tmp tmpfs rw,seclabel,nosuid,nodev,nr_inodes=1048576,inode64 0 0
sunrpc /var/lib/nfs/rpc_pipefs rpc_pipefs rw,relatime 0 0
tmpfs /run/user/0 tmpfs rw,seclabel,nosuid,nodev,relatime,size=201616k,nr_inodes=50404,mode=700,inode64 0 0
binfmt_misc /proc/sys/fs/binfmt_misc binfmt_misc rw,nosuid,nodev,noexec,relatime 0 0
# ls -alZ /dev/shm/
total 0
drwxrwxrwt.  2 root root system_u:object_r:tmpfs_t:s0    40 Jun 14 12:00 .
drwxr-xr-x. 18 root root system_u:object_r:device_t:s0 3640 Jun 14 12:01 ..
#

(In reply to Zdenek Pytela from comment #3)
> I see ramfs_t type in the reported files in /dev/shm. Does your system have
> some special setup?
> 
> ls -lZa /dev/shm
> grep shm /proc/mounts

Milos' /proc/mounts & /dev/shm setup looks the same as what I have.

#  ls -lZa /dev/shm
total 0
drwxrwxrwt.  2 root root system_u:object_r:tmpfs_t:s0    40 Jun 14 07:08 .
drwxr-xr-x. 19 root root system_u:object_r:device_t:s0 3860 Jun 14 07:08 ..
# grep shm /proc/mounts
tmpfs /dev/shm tmpfs rw,seclabel,nosuid,nodev,inode64 0 0


I am testing in a fresh Fedora 36 server VM installed last week with no significant setup changes applied.

Test coverage for this BZ exists in a form of PR:
 * https://src.fedoraproject.org/tests/selinux/pull-request/311

The PR waits for review.

*** Bug 2097681 has been marked as a duplicate of this bug. ***

*** Bug 2118802 has been marked as a duplicate of this bug. ***

Any ETA on getting this fixed? The PR has been sitting since July with no movement since September. Fedora 37 has shipped and this is still broken with systemd-251.5-607.fc37.x86_64 and selinux-policy-37.12-2.fc37.noarch.

$ sudo setenforce 0
$ sudo systemd-run -P --wait -p LoadCredential=abc:/etc/hosts systemd-creds cat abc
Running as unit: run-u5979.service
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
Finished with result: success
Main processes terminated with: code=exited/status=0
Service runtime: 15ms 
CPU time consumed: 8ms
$ sudo setenforce 1
$ sudo systemd-run -P --wait -p LoadCredential=abc:/etc/hosts systemd-creds cat abc
Running as unit: run-u5995.service
Finished with result: exit-code
Main processes terminated with: code=exited/status=243
Service runtime: 4ms
CPU time consumed: 4ms

The problem will be addressed by the next build this week, together with some other important reported bugs.

FEDORA-2022-e7d50924ec has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2022-e7d50924ec

FEDORA-2022-e7d50924ec has been pushed to the Fedora 36 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2022-e7d50924ec`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-e7d50924ec

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

FEDORA-2022-e7d50924ec has been pushed to the Fedora 36 stable repository.
If problem still persists, please make note of it in this bug report.