Bug 2250935
| Summary: | SELinux is preventing systemd from 'bind' accesses on the netlink_netfilter_socket labeled init_t. | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Mikhail <mikhail.v.gavrilov> | ||||||
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> | ||||||
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||
| Severity: | unspecified | Docs Contact: | |||||||
| Priority: | medium | ||||||||
| Version: | rawhide | CC: | dwalsh, lvrabec, mikhail.v.gavrilov, mmalik, nknazeko, omosnacek, pkoncity, vmojzis, zbyszek, zdohnal, zpytela | ||||||
| Target Milestone: | --- | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | x86_64 | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | abrt_hash:9fc85b3070ddc8db0bf5c68926a5dc71cf135a8c7bcf39d02fae27dfb638beac;VARIANT_ID=workstation; | ||||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2024-01-25 11:23:49 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
Created attachment 2000757 [details]
File: description
Created attachment 2000758 [details]
File: os_info
*** Bug 2250934 has been marked as a duplicate of this bug. *** *** Bug 2250936 has been marked as a duplicate of this bug. *** *** Bug 2250938 has been marked as a duplicate of this bug. *** *** Bug 2250937 has been marked as a duplicate of this bug. *** Mikhail, Unlike the other denial, this one does not appear out of the box, do you happen to know what makes it pop up? Please try the latest packages if the issue still reproduces: # rpm -q systemd selinux-policy systemd-255~rc4-3.fc40.x86_64 selinux-policy-40.6-1.fc40.noarch If yes, please attach the denials from full auditing mode. https://fedoraproject.org/wiki/SELinux/Debugging#Enable_full_auditing *** Bug 2253602 has been marked as a duplicate of this bug. *** *** Bug 2253601 has been marked as a duplicate of this bug. *** *** Bug 2253600 has been marked as a duplicate of this bug. *** Reproducible on systemd update, triggered by some rpm scriptlet.
systemd-255-1.fc40.x86_64
----
type=AVC msg=audit(12/08/2023 06:07:03.373:259) : avc: denied { create } for pid=1 comm=systemd scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=netlink_netfilter_socket permissive=1
----
type=AVC msg=audit(12/08/2023 06:07:03.373:260) : avc: denied { getopt } for pid=1 comm=systemd scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=netlink_netfilter_socket permissive=1
----
type=AVC msg=audit(12/08/2023 06:07:03.373:261) : avc: denied { setopt } for pid=1 comm=systemd scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=netlink_netfilter_socket permissive=1
----
type=AVC msg=audit(12/08/2023 06:07:03.373:262) : avc: denied { bind } for pid=1 comm=systemd scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=netlink_netfilter_socket permissive=1
----
type=AVC msg=audit(12/08/2023 06:07:03.373:263) : avc: denied { getattr } for pid=1 comm=systemd scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=netlink_netfilter_socket permissive=1
systemd 1 [000] 106.441036: avc:selinux_audited: requested=0x8 denied=0x8 audited=0x8 res>
ffffffffaf70b705 avc_audit_post_callback+0x205 ([kernel.kallsyms])
ffffffffaf70b705 avc_audit_post_callback+0x205 ([kernel.kallsyms])
ffffffffaf73473f common_lsm_audit+0x2af ([kernel.kallsyms])
ffffffffaf70c91c slow_avc_audit+0xbc ([kernel.kallsyms])
ffffffffaf70d191 avc_has_perm+0xc1 ([kernel.kallsyms])
ffffffffaf712741 selinux_socket_create+0xc1 ([kernel.kallsyms])
ffffffffaf709991 security_socket_create+0x41 ([kernel.kallsyms])
ffffffffafd4bce7 __sock_create+0x67 ([kernel.kallsyms])
ffffffffafd4e93d __sys_socket+0x8d ([kernel.kallsyms])
ffffffffafd4e9e7 __x64_sys_socket+0x17 ([kernel.kallsyms])
ffffffffafff1461 do_syscall_64+0x61 ([kernel.kallsyms])
ffffffffb02000ea entry_SYSCALL_64_after_hwframe+0x6e ([kernel.kallsyms])
7f82a772e64b __socket+0xb (/usr/lib64/libc.so.6)
7f82a7ac1abe netlink_open_family+0x1e (/usr/lib64/systemd/libsystemd-shared-255-1.fc4>
7f82a79260ba fw_nftables_init_full+0x4a (/usr/lib64/systemd/libsystemd-shared-255-1.f>
7f82a792634b firewall_backend_probe+0x12b (inlined)
7f82a792634b fw_ctx_new_full+0x12b (/usr/lib64/systemd/libsystemd-shared-255-1.fc40.s>
7f82a7f74f8d unit_modify_user_nft_set+0x22d (/usr/lib64/systemd/libsystemd-core-255-1>
7f82a7f75144 unit_ref_uid_gid+0x84 (/usr/lib64/systemd/libsystemd-core-255-1.fc40.so)
7f82a7f5d610 unit_deserialize_state+0x2100 (/usr/lib64/systemd/libsystemd-core-255-1.>
7f82a7f002c0 manager_deserialize_one_unit+0x3c0 (inlined)
7f82a7f002c0 manager_deserialize_units+0x3c0 (inlined)
7f82a7f002c0 manager_deserialize+0x3c0 (/usr/lib64/systemd/libsystemd-core-255-1.fc40>
7f82a7f0103d manager_startup+0x1ed (/usr/lib64/systemd/libsystemd-core-255-1.fc40.so)
5588747b87fc main+0x157c (/usr/lib/systemd/systemd)
7f82a7645149 __libc_start_call_main+0x79 (/usr/lib64/libc.so.6)
7f82a764520a __libc_start_main@@GLIBC_2.34+0x8a (/usr/lib64/libc.so.6)
5588747ba7f4 _start+0x24 (/usr/lib/systemd/systemd)
*** Bug 2254988 has been marked as a duplicate of this bug. *** *** Bug 2254992 has been marked as a duplicate of this bug. *** The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days |
Description of problem: Update systemd from 254.5-2.fc40 to 255~rc2-1.fc40 version SELinux is preventing systemd from 'bind' accesses on the netlink_netfilter_socket labeled init_t. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that systemd should be allowed bind access on netlink_netfilter_socket labeled init_t by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'systemd' --raw | audit2allow -M my-systemd # semodule -X 300 -i my-systemd.pp Additional Information: Source Context system_u:system_r:init_t:s0 Target Context system_u:system_r:init_t:s0 Target Objects Unknown [ netlink_netfilter_socket ] Source systemd Source Path systemd Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-40.5-1.fc40.noarch Local Policy RPM selinux-policy-targeted-40.5-1.fc40.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 6.7.0-0.rc2.22.fc40.x86_64+debug #1 SMP PREEMPT_DYNAMIC Mon Nov 20 14:05:16 UTC 2023 x86_64 Alert Count 1 First Seen 2023-11-22 01:55:16 +05 Last Seen 2023-11-22 01:55:16 +05 Local ID b3adb800-d7d3-483e-be0e-a6f617dd94d9 Raw Audit Messages type=AVC msg=audit(1700600116.340:1437): avc: denied { bind } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=netlink_netfilter_socket permissive=1 Hash: systemd,init_t,init_t,netlink_netfilter_socket,bind Version-Release number of selected component: selinux-policy-targeted-40.5-1.fc40.noarch Additional info: reporter: libreport-2.17.11 reason: SELinux is preventing systemd from 'bind' accesses on the netlink_netfilter_socket labeled init_t. package: selinux-policy-targeted-40.5-1.fc40.noarch component: selinux-policy hashmarkername: setroubleshoot type: libreport kernel: 6.7.0-0.rc2.22.fc40.x86_64+debug comment: Update systemd from 254.5-2.fc40 to 255~rc2-1.fc40 version component: selinux-policy