Bug 2144079
| Summary: | fapolicyd fails on f37 | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Silvan Nagl <mail> |
| Component: | fapolicyd | Assignee: | Radovan Sroka <rsroka> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 37 | CC: | rsroka, sgrubb |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | fapolicyd-1.1.7-1.fc37 fapolicyd-1.1.7-1.fc36 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-12-07 01:34:49 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
FEDORA-2022-ce04eee7a5 has been submitted as an update to Fedora 37. https://bodhi.fedoraproject.org/updates/FEDORA-2022-ce04eee7a5 FEDORA-2022-b6fee9ac9f has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2022-b6fee9ac9f FEDORA-2022-b6fee9ac9f has been pushed to the Fedora 36 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2022-b6fee9ac9f` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-b6fee9ac9f See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2022-ce04eee7a5 has been pushed to the Fedora 37 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2022-ce04eee7a5` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-ce04eee7a5 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2022-ce04eee7a5 has been pushed to the Fedora 37 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2022-b6fee9ac9f has been pushed to the Fedora 36 stable repository. If problem still persists, please make note of it in this bug report. |
Description of problem: fapolicyd won't start because of SELinux. Version-Release number of selected component (if applicable): fapolicyd-1.1.5-2.fc37.src.rpm How reproducible: Always. Steps to Reproduce: Update Fedora to latest release, fapolicy will break. Actual results: Nov 18 21:48:25 53c70r.de systemd[1]: Starting fapolicyd.service - File Access Policy Daemon... Nov 18 21:48:25 53c70r.de fagenrules[971]: /usr/sbin/fagenrules: No change Nov 18 21:48:25 53c70r.de systemd[1]: fapolicyd.service: Can't open PID file /run/fapolicyd.pid (yet?) after start: Operation not permitted Nov 18 21:48:25 53c70r.de fapolicyd[1042]: Initializing the trust database Nov 18 21:48:25 53c70r.de systemd[1]: Started fapolicyd.service - File Access Policy Daemon. Nov 18 21:48:25 53c70r.de fapolicyd[1042]: fapolicyd integrity is 0 Nov 18 21:48:25 53c70r.de fapolicyd[1042]: Loading rpmdb backend Nov 18 21:48:34 53c70r.de fapolicyd[1042]: Checking if the trust database up to date Nov 18 21:48:34 53c70r.de fapolicyd[1042]: Importing trust data from rpmdb backend Nov 18 21:48:34 53c70r.de fapolicyd[1042]: Importing trust data from file backend Nov 18 21:48:34 53c70r.de fapolicyd[1042]: Entries in trust DB: 35966 Nov 18 21:48:34 53c70r.de fapolicyd[1042]: Loaded trust info from all backends(without duplicates): 35966 Nov 18 21:48:34 53c70r.de fapolicyd[1042]: Trust database checks OK Nov 18 21:48:34 53c70r.de fapolicyd[1042]: Error (Permission denied) adding fanotify mark for /dev/shm Nov 18 21:48:35 53c70r.de systemd[1]: fapolicyd.service: Main process exited, code=exited, status=1/FAILURE Nov 18 21:48:35 53c70r.de systemd[1]: fapolicyd.service: Failed with result 'exit-code'. Nov 18 21:48:35 53c70r.de systemd[1]: fapolicyd.service: Consumed 1.489s CPU time. [root@53c70r ~]# audit2allow -b #============= fapolicyd_t ============== allow fapolicyd_t boot_t:dir watch; allow fapolicyd_t root_t:dir watch; allow fapolicyd_t tmp_t:dir watch; allow fapolicyd_t tmpfs_t:dir watch; allow fapolicyd_t user_tmp_t:dir watch; Expected results: No failure. No audit log. Additional info: Will fix the problem: policy_module(fapolicyd_t, 1.0.0) gen_require(` type fapolicyd_t; ') ######################################## # # fapolicyd_t customized policy # require { type fapolicyd_t; } #============= fapolicyd_t ============== files_watch_boot_dirs(fapolicyd_t) files_watch_generic_tmp_dirs(fapolicyd_t) files_watch_root_dirs(fapolicyd_t) fs_manage_tmpfs_dirs(fapolicyd_t) userdom_watch_tmp_dirs(fapolicyd_t)