Bug 2274709

Summary: SELinux is preventing abrt-dump-journ from 'write' accesses on the sock_file io.systemd.Machine.
Product: [Fedora] Fedora Reporter: Andrew Parker <andynparker>
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 40CC: andynparker, dwalsh, knazekovan, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:a7ebe5d62b0552fb1babfb9e9dd46c66bd6c593d689d4b22430b107e5de7fd53;VARIANT_ID=workstation;
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2024-04-15 06:01:10 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: description
none
File: os_info none

Description Andrew Parker 2024-04-12 11:11:04 UTC 
Description of problem:
Occurred after running DNF on Friday 12 April 2024 to update all software. last line of DNF update are:

 yt-dlp-zsh-completion-2024.04.09-1.fc40.noarch    
Installed:
  kernel-6.8.5-301.fc40.x86_64                           kernel-core-6.8.5-301.fc40.x86_64                      
  kernel-devel-6.8.5-301.fc40.x86_64                     kernel-modules-6.8.5-301.fc40.x86_64                   
  kernel-modules-core-6.8.5-301.fc40.x86_64              kernel-modules-extra-6.8.5-301.fc40.x86_64             
  kernel-uki-virt-6.8.5-301.fc40.x86_64                  python3-pam-2.0.2-8.fc40.noarch                        

Complete!
SELinux is preventing abrt-dump-journ from 'write' accesses on the sock_file io.systemd.Machine.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that abrt-dump-journ should be allowed write access on the io.systemd.Machine sock_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'abrt-dump-journ' --raw | audit2allow -M my-abrtdumpjourn
# semodule -X 300 -i my-abrtdumpjourn.pp

Additional Information:
Source Context                system_u:system_r:abrt_dump_oops_t:s0
Target Context                system_u:object_r:systemd_userdbd_runtime_t:s0
Target Objects                io.systemd.Machine [ sock_file ]
Source                        abrt-dump-journ
Source Path                   abrt-dump-journ
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-40.15-1.fc40.noarch
Local Policy RPM              selinux-policy-targeted-40.15-1.fc40.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 6.8.4-300.fc40.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Thu Apr 4 20:41:39 UTC 2024 x86_64
Alert Count                   8
First Seen                    2024-04-12 11:55:44 BST
Last Seen                     2024-04-12 11:55:44 BST
Local ID                      24de526b-a097-4e8c-b871-35b72be86159

Raw Audit Messages
type=AVC msg=audit(1712919344.193:439): avc:  denied  { write } for  pid=1557 comm="abrt-dump-journ" name="io.systemd.Machine" dev="tmpfs" ino=1659 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0


Hash: abrt-dump-journ,abrt_dump_oops_t,systemd_userdbd_runtime_t,sock_file,write

Version-Release number of selected component:
selinux-policy-targeted-40.15-1.fc40.noarch

Additional info:
reporter:       libreport-2.17.15
reason:         SELinux is preventing abrt-dump-journ from 'write' accesses on the sock_file io.systemd.Machine.
package:        selinux-policy-targeted-40.15-1.fc40.noarch
component:      selinux-policy
hashmarkername: setroubleshoot
type:           libreport
kernel:         6.8.4-300.fc40.x86_64
component:      selinux-policy
Comment 1 Andrew Parker 2024-04-12 11:11:06 UTC 
Created attachment 2026542 [details]
File: description
Comment 2 Andrew Parker 2024-04-12 11:11:08 UTC 
Created attachment 2026543 [details]
File: os_info
Comment 3 Milos Malik 2024-04-12 15:55:40 UTC 
I used this reproducer:

# for I in `ls /usr/lib/systemd/system/abrt* | cut -d / -f 6 | cut -d . -f 1` ; do service $I start ; done
Redirecting to /bin/systemctl start abrtd.service
Redirecting to /bin/systemctl start abrt-journal-core.service
Redirecting to /bin/systemctl start abrt-oops.service
Redirecting to /bin/systemctl start abrt-pstoreoops.service
Redirecting to /bin/systemctl start abrt-upload-watch.service
Redirecting to /bin/systemctl start abrt-vmcore.service
Redirecting to /bin/systemctl start abrt-xorg.service
# sleep 600 &
# killall --signal SIGABRT sleep
# ausearch -m avc -m user_avc -m selinux_err -i
----
type=PROCTITLE msg=audit(04/12/2024 11:46:35.635:631) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(04/12/2024 11:46:35.635:631) : item=0 name=/run/systemd/userdb/io.systemd.DynamicUser inode=42 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(04/12/2024 11:46:35.635:631) : cwd=/ 
type=SOCKADDR msg=audit(04/12/2024 11:46:35.635:631) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DynamicUser } 
type=SYSCALL msg=audit(04/12/2024 11:46:35.635:631) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0x9 a1=0x7ffe18b547d0 a2=0x2d a3=0x5619d9dbb220 items=1 ppid=1 pid=2176 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(04/12/2024 11:46:35.635:631) : avc:  denied  { write } for  pid=2176 comm=abrt-dump-journ name=io.systemd.DynamicUser dev="tmpfs" ino=42 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 
----
type=PROCTITLE msg=audit(04/12/2024 11:46:35.635:632) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(04/12/2024 11:46:35.635:632) : item=0 name=/run/systemd/userdb/io.systemd.DropIn inode=479 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(04/12/2024 11:46:35.635:632) : cwd=/ 
type=SOCKADDR msg=audit(04/12/2024 11:46:35.635:632) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DropIn } 
type=SYSCALL msg=audit(04/12/2024 11:46:35.635:632) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0x9 a1=0x7ffe18b547d0 a2=0x28 a3=0x5619d9dbb010 items=1 ppid=1 pid=2176 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(04/12/2024 11:46:35.635:632) : avc:  denied  { write } for  pid=2176 comm=abrt-dump-journ name=io.systemd.Multiplexer dev="tmpfs" ino=479 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 
----
type=PROCTITLE msg=audit(04/12/2024 11:46:35.635:633) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(04/12/2024 11:46:35.635:633) : item=0 name=/run/systemd/userdb/io.systemd.Home inode=1034 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(04/12/2024 11:46:35.635:633) : cwd=/ 
type=SOCKADDR msg=audit(04/12/2024 11:46:35.635:633) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.Home } 
type=SYSCALL msg=audit(04/12/2024 11:46:35.635:633) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0x9 a1=0x7ffe18b547d0 a2=0x26 a3=0x5619d9ddde30 items=1 ppid=1 pid=2176 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(04/12/2024 11:46:35.635:633) : avc:  denied  { write } for  pid=2176 comm=abrt-dump-journ name=io.systemd.Home dev="tmpfs" ino=1034 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 
----
type=PROCTITLE msg=audit(04/12/2024 11:46:35.636:634) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(04/12/2024 11:46:35.636:634) : item=0 name=/run/systemd/userdb/io.systemd.DynamicUser inode=42 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(04/12/2024 11:46:35.636:634) : cwd=/ 
type=SOCKADDR msg=audit(04/12/2024 11:46:35.636:634) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DynamicUser } 
type=SYSCALL msg=audit(04/12/2024 11:46:35.636:634) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0x9 a1=0x7ffe18b547c0 a2=0x2d a3=0x5619d9dbb920 items=1 ppid=1 pid=2176 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(04/12/2024 11:46:35.636:634) : avc:  denied  { write } for  pid=2176 comm=abrt-dump-journ name=io.systemd.DynamicUser dev="tmpfs" ino=42 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 
----
type=PROCTITLE msg=audit(04/12/2024 11:46:35.636:635) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(04/12/2024 11:46:35.636:635) : item=0 name=/run/systemd/userdb/io.systemd.DropIn inode=479 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(04/12/2024 11:46:35.636:635) : cwd=/ 
type=SOCKADDR msg=audit(04/12/2024 11:46:35.636:635) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DropIn } 
type=SYSCALL msg=audit(04/12/2024 11:46:35.636:635) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0x9 a1=0x7ffe18b547c0 a2=0x28 a3=0x5619d9dbb920 items=1 ppid=1 pid=2176 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(04/12/2024 11:46:35.636:635) : avc:  denied  { write } for  pid=2176 comm=abrt-dump-journ name=io.systemd.Multiplexer dev="tmpfs" ino=479 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 
----
type=PROCTITLE msg=audit(04/12/2024 11:46:35.636:636) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(04/12/2024 11:46:35.636:636) : item=0 name=/run/systemd/userdb/io.systemd.Home inode=1034 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(04/12/2024 11:46:35.636:636) : cwd=/ 
type=SOCKADDR msg=audit(04/12/2024 11:46:35.636:636) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.Home } 
type=SYSCALL msg=audit(04/12/2024 11:46:35.636:636) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0x9 a1=0x7ffe18b547c0 a2=0x26 a3=0x5619d9dbb920 items=1 ppid=1 pid=2176 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(04/12/2024 11:46:35.636:636) : avc:  denied  { write } for  pid=2176 comm=abrt-dump-journ name=io.systemd.Home dev="tmpfs" ino=1034 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 
----
Comment 4 Milos Malik 2024-04-12 16:02:09 UTC 
The following SELinux denials appear in permissive mode:
----
type=PROCTITLE msg=audit(04/12/2024 12:01:03.884:664) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(04/12/2024 12:01:03.884:664) : item=0 name=/run/systemd/userdb/io.systemd.DynamicUser inode=42 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(04/12/2024 12:01:03.884:664) : cwd=/ 
type=SOCKADDR msg=audit(04/12/2024 12:01:03.884:664) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DynamicUser } 
type=SYSCALL msg=audit(04/12/2024 12:01:03.884:664) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x9 a1=0x7ffc47a170c0 a2=0x2d a3=0x55e471cc7d70 items=1 ppid=1 pid=2443 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(04/12/2024 12:01:03.884:664) : avc:  denied  { write } for  pid=2443 comm=abrt-dump-journ name=io.systemd.DynamicUser dev="tmpfs" ino=42 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=1 
----
type=PROCTITLE msg=audit(04/12/2024 12:01:03.884:665) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(04/12/2024 12:01:03.884:665) : item=0 name=/run/systemd/userdb/io.systemd.DropIn inode=479 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(04/12/2024 12:01:03.884:665) : cwd=/ 
type=SOCKADDR msg=audit(04/12/2024 12:01:03.884:665) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DropIn } 
type=SYSCALL msg=audit(04/12/2024 12:01:03.884:665) : arch=x86_64 syscall=connect success=yes exit=0 a0=0xc a1=0x7ffc47a170c0 a2=0x28 a3=0x55e471ccd3f0 items=1 ppid=1 pid=2443 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(04/12/2024 12:01:03.884:665) : avc:  denied  { connectto } for  pid=2443 comm=abrt-dump-journ path=/run/systemd/userdb/io.systemd.Multiplexer scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:systemd_userdbd_t:s0 tclass=unix_stream_socket permissive=1 
----
type=PROCTITLE msg=audit(04/12/2024 12:01:03.884:666) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(04/12/2024 12:01:03.884:666) : item=0 name=/run/systemd/userdb/io.systemd.Home inode=1034 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(04/12/2024 12:01:03.884:666) : cwd=/ 
type=SOCKADDR msg=audit(04/12/2024 12:01:03.884:666) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.Home } 
type=SYSCALL msg=audit(04/12/2024 12:01:03.884:666) : arch=x86_64 syscall=connect success=yes exit=0 a0=0xd a1=0x7ffc47a170c0 a2=0x26 a3=0x55e471cee3b0 items=1 ppid=1 pid=2443 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(04/12/2024 12:01:03.884:666) : avc:  denied  { connectto } for  pid=2443 comm=abrt-dump-journ path=/run/systemd/userdb/io.systemd.Home scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket permissive=1 
----
Comment 5 Milos Malik 2024-04-12 17:08:28 UTC 
Test coverage for this bug exists in a form of PR:
 * https://src.fedoraproject.org/tests/selinux/pull-request/490

The PR waits for a review.
Comment 6 Zdenek Pytela 2024-04-15 06:01:10 UTC 

*** This bug has been marked as a duplicate of bug 2265927 ***